Function at 0x409620
Capabilities:
Copy file
Create mailslot
Enumerate gui resources
Get file size
Manipulate console buffer
Move file
Print debug messages
Read .ini file
Terminate process

Disassembly:
mov ecx, dword [0x47a8a4]
sub esp, 0xc50
cmp ecx, 0x177
jne 0x409657
push 0
call fcn.0040a710
push 0
push 0
call fcn.0040a4c0
push 0
push 0
call fcn.0040a470
add esp, 0x14
push 0
call fcn.00409ec0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
mov dword [esp + 0x10], eax
lea esp, [esp]
cmp ecx, 0x47
jne 0x409750
lea eax, [esp + 0x1c]
push eax
push 0
call esi
push 0
lea ecx, [esp + 0x464]
push ecx
call edi
xor eax, eax
lea edx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push edx
lea eax, [esp + 0x44]
push eax
push 0x401390
call ebx
push 0
lea ecx, [esp + 0x864]
push ecx
push 0
push 0
push 0
push 0
call ebp
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x18]
push ecx
mov word [esp + 0x18], dx
mov word [esp + 0x1a], ax
mov edx, dword [esp + 0x18]
push edx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
lea eax, [esp + 0x64]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
lea ecx, [esp + 0x38]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
mov ecx, dword [0x47a8a4]
mov eax, dword [esp + 0x10]
cmp eax, 0x6a1
je 0x409a41
cmp ecx, 0xf
je 0x409a52
inc eax
cmp eax, 0x1137686
mov dword [esp + 0x10], eax
jl 0x409680
mov edi, dword [sym.imp.USER32.dll_CharToOemBuffW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp esi, 0x7423
jge 0x409794
push 0
push 0
push 0
call edi
call ebx
inc esi
cmp esi, 0x180bc451
mov dword [0x479f30], 0
jl 0x409782
mov esi, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCommState]
xor ecx, ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x40d
jne 0x4097d7
push 0x47a8a4
call fcn.004092c0
cmp dword [0x47a8a4], 0x78
jne 0x409885
push 0
push 0
call esi
push 0
push 0
push 0
call edi
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
push 0x4013b8
push 0x401404
call ebx
push 0
push 0
call ebp
mov ecx, dword [esp + 0x18]
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0x401424
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFile]
mov ecx, dword [esp + 0x10]
inc ecx
cmp ecx, 0x40bd22
mov dword [esp + 0x10], ecx
jl 0x4097c5
call fcn.004093b0
mov edi, dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor esi, esi
cmp dword [0x47a8a4], 0x15
jne 0x4098b2
push 0
push 0
call edi
cmp esi, 0x1550
jne 0x4098c4
mov eax, dword [0x426008]
mov dword [0x47a8a8], eax
inc esi
cmp esi, 0x56a453
jl 0x4098a3
mov esi, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ebp, 0x719c87
cmp dword [0x47a8a4], 0xfd
jne 0x4098f4
push 0
call esi
cmp dword [0x47a8a4], 0x23
jne 0x409906
call edi
lea ecx, [esp + 0x20]
push ecx
call ebx
sub ebp, 1
jne 0x4098e4
xor esi, esi
cmp dword [0x47a8a4], esi
jbe 0x409924
push esi
call fcn.00409190
inc esi
cmp esi, dword [0x47a8a4]
jb 0x409915
mov esi, dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, 0x1756bb
jmp 0x409940
cmp dword [0x47a8a4], 0x15a
jne 0x40995d
push 0
push 0
call esi
push 0x40143c
push 0
push 0
call edi
sub ebx, 1
jne 0x409940
call fcn.004092d0
call fcn.004093d0
cmp dword [0x47a8a4], 0x1d
jne 0x409a2d
push ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x40146c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
xor edx, edx
xor ecx, ecx
mov word [esp + 0x10], cx
mov word [esp + 0x12], dx
mov eax, dword [esp + 0x10]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
call fcn.004092a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc50
ret 0x10
mov edx, dword [0x427100]
mov dword [0x47a8a4], edx
jmp 0x409774
push 0
lea eax, [esp + 0x64]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]