Function at 0x40b717
Capabilities:
Get file attributes
Get hostname
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c4c
call fcn.004096b0
mov eax, dword [0x44a008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
xor eax, eax
cmp eax, 0x180
jne 0x40b74c
mov ecx, dword [0x44dbf4]
add ecx, 0xa231
mov dword [0x1bc4eac], ecx
cmp dword [0x1bc4eac], 0x141
jne 0x40b769
or dword [0x44eb04], 0xffffffff
mov dword [0x44eb00], 0xec58acac
inc eax
cmp eax, 0x12376ec
jl 0x40b733
push edi
xor edi, edi
cmp edi, 0x562d05
jne 0x40b786
mov eax, dword [0x44afe8]
mov dword [0x1bc4fdc], eax
cmp dword [0x1bc4eac], 0x3c
jne 0x40b796
push esi
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
inc edi
cmp edi, 0x5f6c74
jl 0x40b774
cmp dword [0x1bc4eac], 0x7c
push ebx
mov ebx, 0x44ea78
jne 0x40b85b
lea eax, [ebp - 0x1c4c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
xor eax, eax
mov word [ebp - 0x1c38], ax
lea edi, [ebp - 0x1c36]
stosw word es:[edi], ax
mov word [ebp - 0x1c30], ax
lea edi, [ebp - 0x1c2e]
stosw word es:[edi], ax
lea eax, [ebp - 0x1c40]
push eax
push dword [ebp - 0x1c30]
lea eax, [ebp - 0x1c34]
push dword [ebp - 0x1c38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
push esi
lea eax, [ebp - 0x1804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
cmp dword [0x1bc4eac], 0x11
jne 0x40b847
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidth32W]
push 0x448afc
push ebx
call fcn.0040100f
push esi
call fcn.00401248
add esp, 0xc
cmp dword [0x1bc4eac], 0x110a
jne 0x40b953
lea eax, [ebp - 0x1c30]
push eax
push esi
push str.Dolakuf_taxusihajinug_heyad_tajey_mezajipuseb
push esi
push esi
mov dword [0x1bc4ea0], esi
mov dword [0x1bc4ea4], esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
lea eax, [ebp - 0x1c34]
push eax
lea eax, [ebp - 0x1c04]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor eax, eax
mov word [ebp - 0x1c48], ax
lea edi, [ebp - 0x1c46]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x1404]
push eax
push str.Rotefuwuzizof_tajiyu
lea eax, [ebp - 0x1c48]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push str.hejiyet
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push esi
push esi
lea eax, [ebp - 0x1004]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push esi
push esi
lea eax, [ebp - 0x804]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push esi
call fcn.004010db
mov dword [esp], str.0__s__d__f
call fcn.0040122b
push esi
call fcn.004010db
xor eax, eax
push esi
mov dword [ebp - 0x1c08], 7
mov dword [ebp - 0x1c0c], esi
mov word [ebp - 0x1c1c], ax
call fcn.004010db
push 0x448b64
push ebx
call fcn.0040122b
add esp, 0x14
push esi
call fcn.004014fe
call fcn.0040b464
xor edi, edi
pop ebx
cmp dword [0x1bc4eac], esi
jbe 0x40b9b8
mov eax, dword [0x1bc4fdc]
mov dword [ebp - 0x1c30], eax
mov eax, 0xa231
add dword [ebp - 0x1c30], eax
mov eax, dword [ebp - 0x1c30]
mov al, byte [eax + edi]
mov ecx, dword [0x1bc4cf4]
mov byte [ecx + edi], al
cmp dword [0x1bc4eac], 0x5ab
jne 0x40b9af
push esi
push dword [ebp - 0x1c34]
push esi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov dword [0x1bc4cf8], 0x19b0
inc edi
cmp edi, dword [0x1bc4eac]
jb 0x40b963
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.0040b4b9
call fcn.0040b49b
call fcn.0040b698
xor eax, eax
cmp eax, 0xd606b
jne 0x40b9e0
call fcn.0040b490
inc eax
cmp eax, 0x24e87d
jl 0x40b9d4
mov edi, 0x1e4165
cmp dword [0x1bc4eac], 0xcc1
jne 0x40ba02
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
cmp dword [0x1bc4eac], 0x7c4
mov dword [0x1bc4ea8], 0x8e46a6f0
jne 0x40ba20
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapWalk]
dec edi
jne 0x40b9ed
pop edi
cmp esi, 0x408e
jle 0x40ba38
cmp dword [ebp - 0x1c24], 0xf5bed7
jne 0x40ba41
inc esi
cmp esi, 0x687ed2
jl 0x40ba24
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401000
leave
ret