Function at 0x40bcf5
Capabilities:
Get file attributes
Get hostname
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.0040aea0
mov eax, dword [0x433090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
xor eax, eax
cmp eax, 0x180
jne 0x40bd2a
mov ecx, dword [0x4367c4]
add ecx, 0xa231
mov dword [0x1f7e004], ecx
cmp dword [0x1f7e004], 0x141
jne 0x40bd47
or dword [0x43735c], 0xffffffff
mov dword [0x437358], 0xec58acac
inc eax
cmp eax, 0x12376ec
jl 0x40bd11
push esi
xor esi, esi
cmp esi, 0x562d05
jne 0x40bd64
mov eax, dword [0x433fb8]
mov dword [0x1f7e134], eax
cmp dword [0x1f7e004], 0x3c
jne 0x40bd74
push ebx
call dword [sym.imp.KERNEL32.dll_LocalLock]
inc esi
cmp esi, 0x5f6c74
jl 0x40bd52
cmp dword [0x1f7e004], 0x7c
jne 0x40be6b
push edi
lea eax, [ebp - 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [ebp - 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor eax, eax
mov word [ebp - 0x1034], ax
lea edi, [ebp - 0x1032]
stosw word es:[edi], ax
mov word [ebp - 0x1030], ax
lea edi, [ebp - 0x102e]
stosw word es:[edi], ax
lea eax, [ebp - 0x1060]
push eax
push dword [ebp - 0x1030]
lea eax, [ebp - 0x1038]
push dword [ebp - 0x1034]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
xor eax, eax
mov dword [ebp - 0x1058], ebx
lea edi, [ebp - 0x1054]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1058]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFileScatter]
push ebx
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
lea eax, [ebp - 0x1040]
push eax
mov dword [ebp - 0x1040], ebx
mov dword [ebp - 0x103c], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
cmp dword [0x1f7e004], 0x11
pop edi
jne 0x40be53
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetCharWidth32W]
push 0x430ea3
push 0x4372d0
call fcn.00401b21
push ebx
call fcn.00402008
add esp, 0xc
cmp dword [0x1f7e004], 0x110a
jne 0x40bf3c
push ebx
push ebx
mov dword [0x1f7dff8], ebx
mov dword [0x1f7dffc], ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
lea eax, [ebp - 0x1038]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push str.vujahebetunagubidiyuxugacazezon
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc04]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
push ebx
push ebx
call fcn.00401f40
push ebx
push ebx
call fcn.00401f40
add esp, 0x10
xor eax, eax
push 1
lea esi, [ebp - 0x1020]
mov dword [ebp - 0x1008], 7
mov dword [ebp - 0x100c], ebx
mov word [ebp - 0x101c], ax
call fcn.00401091
push ebx
push ebx
call fcn.00401f40
push ebx
call fcn.00401dca
push ebx
push ebx
push ebx
call fcn.00401b21
add esp, 0x18
push 1
xor ebx, ebx
call fcn.0040104c
call fcn.0040ba44
xor ecx, ecx
cmp dword [0x1f7e004], ebx
jbe 0x40bf8e
mov eax, dword [0x1f7e134]
mov dword [ebp - 0x1030], eax
mov eax, 0xa231
add dword [ebp - 0x1030], eax
mov eax, dword [ebp - 0x1030]
mov al, byte [eax + ecx]
mov edx, dword [0x1f7de4c]
mov byte [edx + ecx], al
mov eax, dword [0x1f7e004]
cmp eax, 0x5ab
jne 0x40bf89
mov dword [0x1f7de50], 0x19b0
inc ecx
cmp ecx, eax
jb 0x40bf4b
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.0040ba99
call fcn.0040ba7b
call fcn.0040bc86
xor eax, eax
cmp eax, 0xd606b
jne 0x40bfb6
call fcn.0040ba70
inc eax
cmp eax, 0x24e87d
jl 0x40bfaa
mov esi, 0x1e4165
cmp dword [0x1f7e004], 0xcc1
jne 0x40bfd8
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
cmp dword [0x1f7e004], 0x7c4
mov dword [0x1f7de54], 0x8e46a6f0
jne 0x40bff6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeaps]
dec esi
jne 0x40bfc3
pop esi
cmp ebx, 0x408e
jle 0x40c00e
cmp dword [ebp - 0x1024], 0xf5bed7
jne 0x40c017
inc ebx
cmp ebx, 0x687ed2
jl 0x40bffa
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00401ab5
leave
ret