Function at 0x403ece
Capabilities:
Get common file path
Get hostname
Manipulate console buffer

Disassembly:
mov eax, 0x42e420
call fcn.0042d6cc
mov eax, 0x2c38
call fcn.0040e1f0
push ebx
push esi
xor ebx, ebx
cmp dword [0x2aa57f8], 0x5b1
push edi
jne 0x403f8f
push ebx
push ebx
lea eax, [ebp - 0x1844]
push eax
push ebx
push ebx
call sub.USER32.dll_DdeQueryStringW
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x844]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
push 0x4037b8
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
lea eax, [ebp - 0x44]
call fcn.00404262
push ebx
mov dword [ebp - 4], ebx
call fcn.00404c4d
pop ecx
lea esi, [ebp - 0x28]
call fcn.00403a80
mov ecx, esi
call fcn.00403aa0
push ebx
push ebx
call fcn.00404846
push ebx
call fcn.00404817
add esp, 0xc
push ebx
call fcn.00404cc9
mov dword [esp], ebx
call fcn.00403b15
fstp st(0)
push ebx
call fcn.00404f79
add dword [0x2aa57f8], 0x1134b
push dword [0x2aa57f8]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x2aa4748], eax
call fcn.00403e19
xor esi, esi
cmp dword [0x2aa57f8], ebx
jbe 0x403feb
cmp dword [0x2aa57f8], 0xa8
mov eax, dword [0x2aa57fc]
mov al, byte [eax + esi + 0x1134b]
mov ecx, dword [0x2aa4748]
mov byte [ecx + esi], al
jne 0x403fe2
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
inc esi
cmp esi, dword [0x2aa57f8]
jb 0x403fba
xor esi, esi
mov eax, dword [0x2aa57f8]
add eax, esi
cmp eax, 0xe
jne 0x40404e
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
push ebx
lea eax, [ebp - 0x444]
push eax
push ebx
push 0x4037d8
push ebx
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push ebx
lea eax, [ebp - 0x1444]
push eax
push ebx
push 0x4037ec
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push ebx
push ebx
lea eax, [ebp - 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
inc esi
cmp esi, 0x39621
jl 0x403fed
call fcn.00403d13
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x26
jne 0x40406e
call fcn.00403dff
inc esi
cmp esi, 0x6753f
jl 0x40405e
push 0x7b
pop esi
cmp dword [0x2aa57f8], 0x86
jne 0x4040bb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2444]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push ebx
lea eax, [ebp - 0x2044]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push ebx
lea eax, [ebp - 0x2c44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [0x2aa57f8], 0xf
jne 0x4040ca
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
dec esi
jne 0x40407a
push 0x4037f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret