Function at 0x438b20
Capabilities:
Create directory
Get common file path
Get geographical location
Get hostname
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0xcf4
mov eax, dword [0x44014c]
xor eax, esp
mov dword [esp + 0xcf0], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
jmp 0x438b50
call edi
push 0
call ebx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
cmp esi, 0x176afc
jg 0x438b75
inc esi
cmp esi, 0x365ea5f8
jl 0x438b50
jmp 0x438b88
cmp dword [0x2be8924], 0xa
jne 0x438b88
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
xor ebx, ebx
xor esi, esi
cmp esi, 0x562d05
jne 0x438ba4
mov eax, dword [0x442194]
mov dword [0x2be8928], eax
cmp dword [0x2be8924], 0x3c
jne 0x438bb0
push ebx
call edi
inc esi
cmp esi, 0x5f6c74
jl 0x438b92
cmp dword [0x2be8924], 0x7c
jne 0x438c47
push ebx
call dword [sym.imp.ole32.dll_CreateDataAdviseHolder]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push str.pecanasotapih
call dword [sym.imp.KERNEL32.dll_AddAtomW]
lea edx, [esp + 0x4f8]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
cmp dword [0x2be8924], 0x2d
jne 0x438c29
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x43e070
push 0x442f10
call fcn.0040233a
fldz
fstp qword [esp]
call fcn.00401fd0
fstp st(0)
add esp, 8
cmp dword [0x2be8924], 0x110a
jne 0x438cd2
push ebx
push ebx
lea eax, [esp + 0x50]
push eax
mov dword [0x2be8590], ebx
mov dword [0x2be8594], ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
push ebx
call fcn.004020ed
push ebx
call fcn.0040216c
add esp, 0xc
push ebx
push ebx
call fcn.004020ed
add esp, 8
mov edi, 1
lea esi, [esp + 0x20]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004011b0
push ebx
push ebx
call fcn.004020ed
push ebx
call fcn.00402323
add esp, 0xc
cmp dword [esp + 0x34], 0x10
jb 0x438cd2
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0040249c
add esp, 4
call fcn.004380b0
xor esi, esi
cmp dword [0x2be8924], ebx
jbe 0x438d30
mov edi, dword [sym.imp.KERNEL32.dll_ReplaceFileA]
jmp 0x438cf0
mov edx, dword [0x2be8928]
mov dword [esp + 0xc], edx
mov eax, 0xa231
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov cl, byte [eax + esi]
mov edx, dword [0x2be64a4]
mov byte [edx + esi], cl
cmp dword [0x2be8924], 0x5ab
jne 0x438d27
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call edi
inc esi
cmp esi, dword [0x2be8924]
jb 0x438cf0
call fcn.004389a0
call fcn.004380e0
call fcn.00438a90
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
xor esi, esi
mov ebx, 0x41
lea esp, [esp]
cmp dword [0x2be8924], ebx
jne 0x438d60
push 0
push 0
push 0
call edi
cmp esi, 0xbd9cb
jne 0x438d6d
call fcn.004380d0
inc esi
cmp esi, 0x15a63d
jl 0x438d50
mov ebx, dword [esp + 0x28]
mov edi, dword [sym.imp.USER32.dll_GetClassLongW]
xor esi, esi
push 0
push 0
call edi
cmp esi, 0x1abc7
jle 0x438d98
cmp ebx, 0xf5bed7
jne 0x438da1
inc esi
cmp esi, 0x1ebc2ad2
jl 0x438d82
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov edi, dword [sym.imp.ADVAPI32.dll_AccessCheckByType]
mov dword [esp + 0x10], 0x1519a5
mov ebx, dword [esp + 0x10]
lea esp, [esp]
cmp dword [0x2be8924], 0x3dc
mov dword [0x2be858c], 0x8e46a6f0
jne 0x438e07
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push 0
push 0
push eax
push 0
push 0
push 0
push 0
call edi
dec dword [esp + 0x10]
jne 0x438dc0
mov ecx, dword [esp + 0xcfc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a50
mov esp, ebp
pop ebp
ret