Function at 0x40d9a1
Capabilities:
Get hostname
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c68
call fcn.0040bdc0
mov eax, dword [0x437090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
xor eax, eax
cmp eax, 0x180
jne 0x40d9d6
mov ecx, dword [0x4384c4]
add ecx, 0xa231
mov dword [0x1baf92c], ecx
cmp dword [0x1baf92c], 0x141
jne 0x40d9f3
or dword [0x43945c], 0xffffffff
mov dword [0x439458], 0xec58acac
inc eax
cmp eax, 0x12376ec
jl 0x40d9bd
push esi
xor esi, esi
cmp esi, 0x562d05
jne 0x40da10
mov eax, dword [0x4380b8]
mov dword [0x1baf930], eax
cmp dword [0x1baf92c], 0x3c
jne 0x40da22
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
inc esi
cmp esi, 0x5f6c74
jl 0x40d9fe
cmp dword [0x1baf92c], 0x7c
push edi
jne 0x40db05
push ebx
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1c58]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push ebx
push ebx
lea eax, [ebp - 0x1c04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
xor eax, eax
mov word [ebp - 0x1c50], ax
lea edi, [ebp - 0x1c4e]
stosw word es:[edi], ax
mov word [ebp - 0x1c4c], ax
lea edi, [ebp - 0x1c4a]
stosw word es:[edi], ax
lea eax, [ebp - 0x1c60]
push eax
push dword [ebp - 0x1c4c]
lea eax, [ebp - 0x1c54]
push dword [ebp - 0x1c50]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push ebx
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push str.wajijanicekexamutixorutaz_matilagivule__s__d__f
push ebx
call fcn.00401d8c
push 0x434a74
push 0x4393d0
call fcn.00401b27
push ebx
call fcn.00401f2a
add esp, 0x14
cmp dword [0x1baf92c], 0x110a
jne 0x40dc6d
push ebx
mov dword [0x1baf7f8], ebx
mov dword [0x1baf7fc], ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
lea eax, [ebp - 0x1c4c]
push eax
push ebx
push str.jamigulinekixij
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
lea eax, [ebp - 0x1c54]
push eax
lea eax, [ebp - 0x1c04]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
mov word [ebp - 0x1c68], ax
lea edi, [ebp - 0x1c66]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea eax, [ebp - 0xc04]
push eax
push str.hagiforagaragedakujeriyexi
lea eax, [ebp - 0x1c68]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1404]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push ebx
push ebx
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
fld qword [0x434af0]
push 0x50
push ecx
push ecx
fstp qword [esp]
push 0x434ac0
push str._s__f__c
call fcn.00401da9
push ebx
push ebx
call fcn.00401cc6
add esp, 0x1c
push 7
pop edi
xor eax, eax
push 1
lea esi, [ebp - 0x1c20]
mov dword [ebp - 0x1c08], edi
mov dword [ebp - 0x1c0c], ebx
mov word [ebp - 0x1c1c], ax
call fcn.00401091
push ebx
push ebx
call fcn.00401cc6
xor eax, eax
push ebx
push ebx
mov dword [ebp - 0x1c24], edi
mov dword [ebp - 0x1c28], ebx
mov word [ebp - 0x1c38], ax
call fcn.00401f40
push ebx
push ebx
call fcn.00401cc6
push ebx
push ebx
call fcn.00401f40
push 0x434ad4
push 0x4393d0
call fcn.00401d8c
push ebx
call fcn.00401ef6
add esp, 0x2c
push 1
xor ebx, ebx
lea esi, [ebp - 0x1c3c]
call fcn.0040104c
push 1
lea esi, [ebp - 0x1c20]
call fcn.0040104c
push dword [0x1baf92c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor esi, esi
mov dword [0x1baf64c], eax
pop edi
cmp dword [0x1baf92c], ebx
jbe 0x40dcd9
mov eax, dword [0x1baf930]
mov dword [ebp - 0x1c4c], eax
mov eax, 0xa231
add dword [ebp - 0x1c4c], eax
mov eax, dword [ebp - 0x1c4c]
mov al, byte [eax + esi]
mov ecx, dword [0x1baf64c]
mov byte [ecx + esi], al
cmp dword [0x1baf92c], 0x5ab
jne 0x40dcd0
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov dword [0x1baf650], 0x19b0
inc esi
cmp esi, dword [0x1baf92c]
jb 0x40dc8a
push 0x434ad8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.0040d6cd
call fcn.0040d6af
call fcn.0040d92d
xor eax, eax
cmp eax, 0xd606b
jne 0x40dd01
call fcn.0040d6a4
inc eax
cmp eax, 0x24e87d
jl 0x40dcf5
mov esi, 0x1e4165
cmp dword [0x1baf92c], 0xcc1
jne 0x40dd23
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
cmp dword [0x1baf92c], 0x7c4
mov dword [0x1baf654], 0x8e46a6f0
jne 0x40dd42
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
dec esi
jne 0x40dd0e
pop esi
cmp ebx, 0x408e
jle 0x40dd5a
cmp dword [ebp - 0x1c40], 0xf5bed7
jne 0x40dd63
inc ebx
cmp ebx, 0x687ed2
jl 0x40dd46
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00401abb
leave
ret