Function at 0x423230
Capabilities:
Create mailslot
Create thread
Enumerate gui resources
Get disk information
Get disk size
Get file attributes
Get hostname
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x423b71
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x16d0
call fcn.004221b0
cmp dword [0x81b258], 0x6c
push ebx
push ebp
push esi
push edi
jne 0x42332f
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x81b258], 0x3a
jne 0x42328b
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 0
call fcn.0040a05b
add esp, 0xc
push 0x4044d4
push 0
call fcn.0040a05b
push 0
call fcn.0040a020
add esp, 0xc
push 0
call fcn.00409c0e
add esp, 4
push 0
call fcn.0040a020
add esp, 4
lea ecx, [esp + 0x88]
push ecx
call fcn.00406290
lea esi, [esp + 0x18]
mov dword [esp + 0x16ec], 0
call fcn.00406b30
sub esp, 0x1c
mov byte [esp + 0x1708], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0
call fcn.00405e40
mov ecx, esi
call fcn.00406bd0
push 0
lea ecx, [esp + 0x4c]
call fcn.00405e40
lea ebx, [esp + 0x48]
mov eax, esi
mov byte [esp + 0x16ec], 2
call fcn.00406b50
mov ecx, ebx
call fcn.00405ed0
push 0
call fcn.0040a762
mov eax, 0x38d6
add dword [0x81b258], eax
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
mov ebp, dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor esi, esi
cmp esi, 0x1c2a7
jge 0x423356
push 0
call ebp
cmp esi, 0x1ea072e7
jle 0x42336e
cmp edi, 0xacd468
je 0x42336e
cmp ebx, 0xad1ade0
jne 0x423377
inc esi
cmp esi, 0x8c6fd558
jb 0x42334a
mov edx, dword [0x81b258]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov edi, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
mov ebp, dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov dword [0x8176c8], eax
mov eax, dword [0x81b258]
mov dword [esp + 0x10], 0x962d40
cmp eax, 0x3f5
jne 0x423480
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call esi
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x6e4]
push ecx
push 0x4044ec
call edi
push 0
push 0
push 0
push 0
call ebp
push 0
push 0x404504
call ebx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1a4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommMask]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0x40452c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x404540
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
lea eax, [esp + 0xee4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea ecx, [esp + 0x34]
push ecx
push 0
push 0x40457c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov eax, dword [0x81b258]
dec dword [esp + 0x10]
jne 0x4233b0
xor ebp, ebp
xor esi, esi
cmp eax, ebp
jbe 0x4234e9
mov edi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, edi
cmp eax, 0xfe
jne 0x4234ce
xor eax, eax
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
lea eax, [esp + 0x4c]
push eax
push 0x40459c
mov dword [esp + 0x24], ebp
call edi
call fcn.00422ee0
mov eax, dword [0x81b258]
cmp eax, 0x29
jne 0x4234e4
call ebx
mov eax, dword [0x81b258]
inc esi
cmp esi, eax
jb 0x4234a0
cmp eax, 0x19c
jne 0x423567
push 0x4045b0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea ecx, [esp + 0x10]
push ecx
push ebp
push ebp
lea edx, [esp + 0x20]
push edx
push ebp
push ebp
push ebp
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_BackupRead]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x48]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
push ebp
push ebp
lea eax, [esp + 0x1a8]
push eax
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x4045c4
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0x4045f0
push 0x4045f8
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [sym.imp.USER32.dll_GetMenu]
mov esi, 0x8dc
push ebp
call edi
dec esi
jne 0x423572
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, 0x25865
cmp dword [0x81b258], 0x15a
jne 0x4235a6
lea ecx, [esp + 0x88]
push ecx
call esi
push 0x404668
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
dec edi
jne 0x423583
mov byte [0x47a560], 0
call fcn.00422a20
call fcn.00423200
call fcn.00422ec0
mov esi, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov ebp, 0xdd7b3
cmp dword [0x81b258], 0x21
jne 0x42360d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
lea edx, [esp + 0x1a8]
push edx
push 0
call edi
lea eax, [esp + 0x14]
push eax
push 0x404670
push 0
call ebx
dec ebp
jne 0x4235d6
call fcn.004231c0
cmp dword [0x81b258], 0x58c
mov byte [0x47a561], 0x73
jne 0x4236c7
lea ecx, [esp + 0x5a0]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push ebp
push ebp
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push ebp
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x6e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push ebp
push ebp
push 0x404690
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
lea edx, [esp + 0x48]
push edx
push 0x4046e0
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
push ebp
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0x40467c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
push 0x404730
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
call fcn.00422ed0
mov ecx, dword [esp + 0x16e4]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret