Function at 0x40472a
Capabilities:
Delete file
Enumerate gui resources
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd88
push ebx
push esi
xor ebx, ebx
push edi
xor esi, esi
cmp esi, 0x1e101
jge 0x404751
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetBoundsRect]
cmp esi, 0x1ea07cf1
jle 0x40476b
cmp dword [ebp - 4], 0xacc888
je 0x40476b
cmp dword [ebp - 0x20], 0xad669fc
jne 0x404774
inc esi
cmp esi, 0x8df07a18
jb 0x40473a
xor esi, esi
cmp esi, 0x13b4
jne 0x404789
mov eax, 0x38d6
add dword [0x5810a4], eax
cmp dword [0x5810a4], 0xdcc
jne 0x4047a3
push 0x4012a8
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
inc esi
cmp esi, 0x31aa3a
jl 0x404776
push dword [0x5810a4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x580b88], eax
mov esi, 0x962aca
cmp dword [0x5810a4], 3
jne 0x4047da
lea eax, [ebp - 0x188]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp dword [0x5810a4], 0xd
jne 0x404825
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
push ebx
lea eax, [ebp - 0x588]
push eax
push 0x4012e4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FoldStringA]
dec esi
jne 0x4047c3
mov eax, dword [0x5810a4]
cmp eax, ebx
jbe 0x404865
cmp eax, 0xfe
jne 0x404855
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobSet]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push esi
call fcn.004041e6
mov eax, dword [0x5810a4]
inc esi
cmp esi, eax
jb 0x404831
cmp eax, 0x19c
jne 0x4048d1
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push 0x30
lea eax, [ebp - 0x34]
push ebx
push eax
mov dword [ebp - 0x38], ebx
call fcn.00404d50
add esp, 0xc
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x4012f0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push ebx
push ebx
push 0x40132c
push 0x401368
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
cmp esi, 0xab9d
jne 0x4048ed
push 0x441aa8
call edi
mov dword [0x5810a0], eax
inc esi
cmp esi, 0x2594b
jl 0x4048d9
mov byte [0x441aa8], bl
xor esi, esi
cmp esi, 0x141
jne 0x40490b
call fcn.004042cb
inc esi
cmp esi, 0x7127fd
jl 0x4048fe
push 0x4405b8
push dword [0x5810a4]
push dword [0x580b88]
call fcn.004041be
xor ecx, ecx
cmp ecx, 0x2f64
jne 0x404939
call fcn.004042bc
inc ecx
cmp ecx, 0x46d9a
jl 0x40492c
mov esi, 0xdd7b3
cmp dword [0x5810a4], 0x21
jne 0x404996
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push ebx
push ebx
lea eax, [ebp - 0xd88]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x588]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push 0x401398
push 0x4013d0
push 0x4013e8
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFlags]
dec esi
jne 0x404947
call fcn.004039d0
mov byte [0x441aa9], 0x73
mov esi, 0x1ef75
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
dec esi
jne 0x4049aa
cmp dword [0x5810a4], 0x58c
jne 0x4049de
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
push ebx
call edi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.004042b5
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret