Function at 0x403ba1
Capabilities:
Get disk information
Get disk size
Move file
Query environment variable
Read .ini file
Set console window title
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8c
push ebx
push esi
xor ebx, ebx
push edi
xor esi, esi
cmp esi, 0x1c874
jge 0x403bc6
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, 0x1e9d5e48
jle 0x403be0
cmp dword [ebp - 4], 0xad5cf8
je 0x403be0
cmp dword [ebp - 0x64], 0xad64abc
jne 0x403be9
inc esi
cmp esi, 0x8e2a8a27
jb 0x403bb1
xor esi, esi
cmp esi, 0x420
jne 0x403bfe
mov eax, 0x38d6
add dword [0x5a8e60], eax
cmp dword [0x5a8e60], 0x3fe
jne 0x403c11
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
inc esi
cmp esi, 0x40dece
jl 0x403beb
call fcn.00403b8d
xor esi, esi
cmp dword [0x5a8e60], ebx
jbe 0x403c51
push esi
call fcn.0040390c
cmp dword [0x5a8e60], 0x1f
jne 0x403c48
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
inc esi
cmp esi, dword [0x5a8e60]
jb 0x403c29
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov edi, 0x5aedb1f
cmp dword [0x5a8e60], 0x2d5
jne 0x403cc8
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push ebx
push ebx
push ebx
push ebx
call esi
push ebx
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push ebx
push ebx
lea eax, [ebp - 0xd8c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
push 0x401484
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push ebx
push ebx
push ebx
push ebx
call esi
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x58c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapQueryInformation]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec edi
jne 0x403c5c
mov esi, 0x447d68
cmp dword [0x5a8e60], 0x92
jne 0x403ce7
push 0x401498
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, 0xa9a9
jne 0x403cfb
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x5a72dc], eax
inc edi
cmp edi, 0x25563
jl 0x403cd0
push esi
push dword [0x5a72dc]
mov byte [0x447d68], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x447d64], eax
xor esi, esi
cmp esi, 0x1c
jne 0x403d28
call fcn.00403a8f
inc esi
cmp esi, 0x3debc7
jl 0x403d1e
push 0x416010
push dword [0x5a8e60]
push dword [0x599b9c]
call fcn.00403875
xor esi, esi
cmp dword [0x5a8e60], 0x10
jne 0x403d59
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp esi, 0x1e674
jne 0x403d66
call fcn.00403a81
inc esi
cmp esi, 0x3e4e2
jl 0x403d49
call fcn.0040366d
cmp dword [0x5a8e60], 0x1144
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
jne 0x403e0e
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4014a8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
mov esi, dword [sym.imp.KERNEL32.dll_SearchPathA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CancelTimerQueueTimer]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x58c]
push eax
push ebx
push 0x4014bc
push 0x4014c8
push 0x4014e8
call esi
push ebx
push ebx
push ebx
push ebx
push ebx
call edi
cmp dword [0x5a8e60], 0x1d
jne 0x403eca
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebx
push ebx
push ebx
push 0x4014f8
push 0x401518
call edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push ebx
lea eax, [ebp - 0x98c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x401548
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
call fcn.00403a7b
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret