Function at 0x41ba20
Capabilities:
Copy file
Get file size
Manipulate console buffer
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88c
push esi
push edi
cmp dword [0x4b49c4], 0x177
jne 0x41baa3
push 0x436320
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xe12
jne 0x41baa3
mov ecx, 0x10
mov esi, str.pitimetaxapefeboluyanatupubiwes
lea edi, [ebp - 0x808]
rep movsd dword es:[edi], dword [esi]
push 0x7c0
push 0
lea eax, [ebp - 0x7c8]
push eax
call fcn.00407cc0
add esp, 0xc
lea ecx, [ebp - 8]
mov dword [ebp - 4], ecx
push 0
push 0
call section..text
add esp, 8
cmp dword [0x4b49c4], 0xd75
jne 0x41ba99
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0
call fcn.00401230
add esp, 4
mov edx, dword [0x4265c4]
mov dword [0x4b49c4], edx
mov dword [ebp - 0x80c], 0
jmp 0x41baca
mov eax, dword [ebp - 0x80c]
add eax, 1
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
cdq
mov dword [ebp - 0x88c], eax
mov dword [ebp - 0x888], edx
cmp dword [ebp - 0x888], 1
jg 0x41bb2d
jl 0x41baf4
cmp dword [ebp - 0x88c], 0x19ad02bd
jae 0x41bb2d
cmp dword [ebp - 0x80c], 0x290ba
jne 0x41bb02
jmp 0x41bb2d
cmp dword [0x4b49c4], 0x541
jne 0x41bb2b
lea ecx, [ebp - 0x828]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
jmp 0x41babb
mov dword [ebp - 0x82c], 0
jmp 0x41bb48
mov edx, dword [ebp - 0x82c]
add edx, 1
mov dword [ebp - 0x82c], edx
cmp dword [ebp - 0x82c], 0x25c9f7
jge 0x41bbde
cmp dword [ebp - 0x82c], 0x197
jge 0x41bb7e
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuInfo]
call dword [sym.imp.USER32.dll_GetMessageTime]
cmp dword [0x4b49c4], 0x449
jne 0x41bb92
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
mov dword [0x4b49bc], 0
cmp dword [ebp - 0x82c], 0x1bb81
jle 0x41bbd9
cmp dword [ebp - 0x858], 0x50854379
je 0x41bbd9
cmp dword [ebp - 0x848], 0xd7ea37
je 0x41bbd9
cmp dword [0x4b49c4], 0x1b5
jne 0x41bbd9
lea eax, [ebp - 0x85c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x41bb39
mov dword [ebp - 0x860], 0
jmp 0x41bbf9
mov ecx, dword [ebp - 0x860]
add ecx, 1
mov dword [ebp - 0x860], ecx
cmp dword [ebp - 0x860], 0x496e6f
jge 0x41bc44
cmp dword [ebp - 0x860], 0xff832
jne 0x41bc23
mov edx, dword [0x4b49c4]
add edx, 0x12336
mov dword [0x4b49c4], edx
cmp dword [0x4b49c4], 0x641
jne 0x41bc42
push str.fucudic
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x41bbea
call fcn.0041af20
mov dword [ebp - 0x864], 0
jmp 0x41bc64
mov eax, dword [ebp - 0x864]
add eax, 1
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0x1083a
jge 0x41bcac
cmp dword [0x4b49c4], 0x105
jne 0x41bcaa
lea ecx, [ebp - 0x868]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push str.waxexuwudazayakidezowi
push str.pecujupixezoseyumipibo
push str.tejemevozefiyovov
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
jmp 0x41bc55
mov dword [ebp - 0x86c], 0
jmp 0x41bcc7
mov edx, dword [ebp - 0x86c]
add edx, 1
mov dword [ebp - 0x86c], edx
cmp dword [ebp - 0x86c], 0xe5fbc
jge 0x41bd19
cmp dword [0x4b49c4], 0x9e2
jne 0x41bce7
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [ebp - 0x86c], 0x3b22
jne 0x41bcfd
mov eax, dword [0x425fa8]
mov dword [0x4b50c0], eax
cmp dword [0x4b49c4], 0xdb5
jne 0x41bd17
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x41bcb8
mov dword [ebp - 0x870], 0
jmp 0x41bd34
mov ecx, dword [ebp - 0x870]
add ecx, 1
mov dword [ebp - 0x870], ecx
mov edx, dword [ebp - 0x870]
cmp edx, dword [0x4b49c4]
jae 0x41bdcb
cmp dword [0x4b49c4], 0x932
jne 0x41bd83
push str.hujitigelusaxepasadewebomahulo
push str.nirene
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov ecx, dword [ebp - 0x870]
push ecx
call fcn.0041b040
cmp dword [0x4b49c4], 0xcb6
jne 0x41bdc6
push 0
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
push 0
lea edx, [ebp - 0x878]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
push str.dahov_sujolinigugixevulecilowizavuruv_tuluximojokomobecutomoduw
push str.numuruwusukakelovexoraf
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
jmp 0x41bd25
mov dword [ebp - 0x87c], 0
jmp 0x41bde6
mov eax, dword [ebp - 0x87c]
add eax, 1
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 0xe96350
jge 0x41be2d
cmp dword [0x4b49c4], 0xdda
jne 0x41be2b
push str.fakicizewaxenojedizulewoxawude_rifulimivuyogadifi_loyibucopogevijiz_ganifihowuxesefuwicemaremubo_zakahebesonobucugafecukuxozux
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push str.cuhetecuxavexo_yitah_kucevesivinivuvecogerumu
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
lea ecx, [ebp - 0x880]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
jmp 0x41bdd7
mov dword [ebp - 0x884], 0
jmp 0x41be48
mov edx, dword [ebp - 0x884]
add edx, 1
mov dword [ebp - 0x884], edx
cmp dword [ebp - 0x884], 0x3dc4a3
jge 0x41be64
cmp dword [ebp - 0x884], 0x26
jne 0x41be62
call fcn.0041af40
jmp 0x41be39
call fcn.0041b7b0
cmp dword [0x4b49c4], 0x1d
jne 0x41be95
push str.feniwixicimesuzopeg
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
push 0
push 0
push 0
push str.tuzokogitiwinusefo
push str.lupivesixida
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10