Function at 0x4234fd
Capabilities:
Accept command line arguments
Get disk information
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd44
mov eax, dword [0x427004]
xor eax, esp
mov dword [esp + 0xd40], eax
push ebx
push esi
xor esi, esi
push edi
xor eax, eax
cmp eax, 0x18a
jne 0x423537
mov ecx, dword [0x4287b0]
add ecx, 0x9e49
mov dword [0x437094], ecx
cmp dword [0x437094], 0x141
jne 0x423554
or dword [0x4293ac], 0xffffffff
mov dword [0x4293a8], 0xec58acac
inc eax
cmp eax, 0x1237750
jl 0x42351e
xor edi, edi
cmp edi, 0x565415
jne 0x423570
mov eax, dword [0x427fe8]
mov dword [0x4371c4], eax
cmp dword [0x437094], 0x3c
jne 0x42358e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
inc edi
cmp edi, 0x5f1e54
jl 0x42355e
cmp dword [0x437094], 0x7c
jne 0x42367b
push esi
lea eax, [esp + 0x54c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push esi
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x154]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push esi
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x2e
lea eax, [esp + 0x6c]
push esi
push eax
mov dword [esp + 0x70], esi
call fcn.00406980
add esp, 0xc
push esi
lea eax, [esp + 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
cmp dword [0x437094], 0x54
jne 0x42366d
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call edi
push str.emuritowuwep
call edi
push esi
call fcn.004011e9
push esi
call fcn.004011ff
pop ecx
pop ecx
xor edi, edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCommMask]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call sub.KERNEL32.dll_GetSystemTimes
cmp edi, 0x25932
jg 0x4236b2
inc edi
cmp edi, 0xead1d
jl 0x42367d
jmp 0x4236c6
cmp dword [0x437094], 0xa
jne 0x4236c6
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
cmp dword [0x437094], 0x2a
jne 0x42374d
push esi
push esi
push esi
mov dword [0x437088], esi
mov dword [0x43708c], esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
push esi
push esi
lea eax, [esp + 0x550]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ebx, 0x425494
push ebx
push str.0__f
mov edi, 0x429320
push edi
call fcn.00401093
push esi
call fcn.004010ad
push esi
push esi
call fcn.0040113b
push ebx
push str._s__c
push edi
call fcn.0040120a
call fcn.0040740d
push esi
push esi
call fcn.0040113b
push esi
push esi
call fcn.0040117b
push esi
push esi
call fcn.0040113b
add esp, 0x3c
push dword [0x437094]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x437094]
xor edi, edi
mov dword [0x436edc], eax
cmp ecx, esi
jbe 0x423792
mov edx, dword [0x4371c4]
mov dl, byte [edx + edi + 0x9e49]
mov byte [eax + edi], dl
cmp ecx, 0x5ab
jne 0x42378d
mov dword [0x436ee0], 0x19b0
inc edi
cmp edi, ecx
jb 0x42376b
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.0042320f
call fcn.004231f1
call fcn.0042346a
xor eax, eax
cmp eax, 0xd606b
jne 0x4237ba
call fcn.004231e6
inc eax
cmp eax, 0x24e87d
jl 0x4237ae
mov dword [0x436ee4], 0x8e46a6f0
cmp esi, 0x408e
jle 0x4237de
cmp dword [esp + 0x44], 0xf5bed7
jne 0x4237e7
inc esi
cmp esi, 0x687ed2
jl 0x4237cc
mov ecx, dword [esp + 0xd4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401006
mov esp, ebp
pop ebp
ret