Function at 0x403f2e
Capabilities:
Get common file path
Get hostname
Manipulate console buffer

Disassembly:
mov eax, 0x42e4a0
call fcn.0042d74c
mov eax, 0x2c38
call fcn.0040e250
push ebx
push esi
xor ebx, ebx
cmp dword [0x2aa57f8], 0x5b1
push edi
jne 0x403fef
push ebx
push ebx
lea eax, [ebp - 0x1844]
push eax
push ebx
push ebx
call sub.USER32.dll_DdeQueryStringW
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x844]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
push 0x4037b4
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
lea eax, [ebp - 0x44]
call fcn.004042c2
push ebx
mov dword [ebp - 4], ebx
call fcn.00404cad
pop ecx
lea esi, [ebp - 0x28]
call fcn.00403ae0
mov ecx, esi
call fcn.00403b00
push ebx
push ebx
call fcn.004048a6
push ebx
call fcn.00404877
add esp, 0xc
push ebx
call fcn.00404d29
mov dword [esp], ebx
call fcn.00403b75
fstp st(0)
push ebx
call fcn.00404fd9
add dword [0x2aa57f8], 0x1134b
push dword [0x2aa57f8]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x2aa4748], eax
call fcn.00403e79
xor esi, esi
cmp dword [0x2aa57f8], ebx
jbe 0x40404b
cmp dword [0x2aa57f8], 0xa8
mov eax, dword [0x2aa57fc]
mov al, byte [eax + esi + 0x1134b]
mov ecx, dword [0x2aa4748]
mov byte [ecx + esi], al
jne 0x404042
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
inc esi
cmp esi, dword [0x2aa57f8]
jb 0x40401a
xor esi, esi
mov eax, dword [0x2aa57f8]
add eax, esi
cmp eax, 0xe
jne 0x4040ae
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
push ebx
lea eax, [ebp - 0x444]
push eax
push ebx
push 0x4037e4
push ebx
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push ebx
lea eax, [ebp - 0x1444]
push eax
push ebx
push 0x4037ec
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push ebx
push ebx
lea eax, [ebp - 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
inc esi
cmp esi, 0x39621
jl 0x40404d
call fcn.00403d73
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x26
jne 0x4040ce
call fcn.00403e5f
inc esi
cmp esi, 0x6753f
jl 0x4040be
push 0x7b
pop esi
cmp dword [0x2aa57f8], 0x86
jne 0x40411b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2444]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push ebx
lea eax, [ebp - 0x2044]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push ebx
lea eax, [ebp - 0x2c44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [0x2aa57f8], 0xf
jne 0x40412a
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
dec esi
jne 0x4040da
push 0x4037f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret