Function at 0x408643
Capabilities:
Execute shellcode via indirect call
Get disk information
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Parse pe header
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Terminate process

Disassembly:
nop
inc ebp
or eax, 0x9090761a
invalid
sbb dh, byte [esi - 0x70]
hlt
jmp 0x2dd0861d
nop
ret
mov byte [0x28775b4c], al
ja 0x4085a9
mov ecx, dword [esi + 0x32]
movsd dword es:[edi], dword [esi]
popal
lodsb al, byte [esi]
jbe 0x4085c1
push esi
pop edx
pop edx
or ebp, dword [esi]
add byte [ebx - 0x76efdbbc], cl
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
call 0x90d11647
nop
or al, ch
add eax, 0x90909090
pop ebp
add al, 0x89
or al, byte [eax]
nop
push ebp
ja 0x4085d6
fsubr dword [edi]
nop
nop
ja 0x4086b6
lodsd eax, dword [esi]
mov eax, dword [edi + 0x68]
mov dword [ebp - 0x1c], eax
add byte [ebx + 0x14c204c4], al
sbb byte [eax], 0x30
sbb byte [eax], dh
push esp
jbe 0x408699
xor esi, esi
leave
jbe 0x4086b8
jbe 0x40863e
jbe 0x4085fe
add byte [eax - 0x6f6f6f70], dl
pop eax
jge 0x4086cf
pop es
ja 0x408637
jbe 0x408660
nop
adc edx, 0
sbb al, 0x89
nop
nop
add eax, dword [eax]
cwde
inc esi
mov ecx, dword [ebp + 8]
cmp ecx, 0xffffffff
sub al, 0x2e
jbe 0x408622
movsb byte es:[edi], byte [esi]
mov edi, edi
sub byte [esi], ch
adc byte [ebx + 0x46895047], cl
add byte [ebx - 0x7bf00a02], al
add byte [ebx + 0x458d0ce7], al
sbb dh, byte [esi - 0x70]
inc edi
push eax
mov dword [esi], eax
cmp esi, 0xfffffff5
je 0xd2809a7
test byte [eax], al
and edi, 0xc
lea eax, [ebp + 0x1a]
jbe 0x40863c
and dword [esi], 0
nop
add eax, 0x90909090
jbe 0x408674
mov ebp, 0x54fd002c
sub al, 0
std
add ch, bh
push esp
jbe 0x40870d
fadd qword [edx]
nop
jbe 0x408702
mov esi, 0x83660003
nop
jne 0x4086db
ret 0xc
push eax
sub eax, 0x2de27376
push esi
push ebp
and al, 0x2f
nop
jbe 0x40872d
push ecx
ret
nop
nop
nop
nop
lea eax, [ebp - 0xc]
push edi
jbe 0x40867c
hlt
arpl word [ebp - 0x58f589d3], sp
adc byte [ecx], 0x2e
ror byte [edi], 0x85
ror byte cs:[edi], 0x85
nop
mov ebp, esp
add eax, 0x90909090
ja 0x4086a2
ret 4
aad 2
cmp dword [esi], 0xd58a7758
lea eax, [ebp - 0xc]
jne 0x409524
mov eax, dword [edi + 0x60]
sub ebp, dword [esi]
jbe 0x408762
mov esi, dword [ebp + 8]
jbe 0x4086f4
sar ecx, 1
nop
ja 0x4086e2
ror byte [edi], 0x8c
add al, byte [eax]
push es
jbe 0x4086c9
ja 0x4086e8
add byte [eax], al
nop
adc eax, 0x93217759
nop
sub eax, 0x2db67c76
inc ebp
jae 0x408755
pop ebx
mov ebx, 0xf89c775f
or dword [edx], ebx
cmp dword [edi + 4], ebx
jbe 0x40877e
add al, 0x76
je 0x408764
je 0x408764
sub eax, 0x2eb2b876
mov dword [ebp - 0xb0], esi
or byte [eax], al
jmp fcn.004087a8
invalid
dec dword [eax]
add bl, ch
aas
ja 0x4087b6
invalid
nop
inc ebp
ja 0x4087e2
sbb byte [eax + 0x77], 0x77
invalid
call fcn.004047b9
pop ebp
and eax, 0x761a0978
je 0x4096f1
xor eax, eax
add al, 0x89
nop
cmp eax, 0xead8775b
jge 0x40882b
ja 0x408821
cmpsb byte [esi], byte es:[edi]
or ah, byte [edi - 0x58a289d3]
pop edx
or byte [eax + 0x2e850f01], ch
mov dword [edi], eax
mov dword cs:[edi], eax
cld
fild qword [0x57df1a09]
ja 0x408829
add byte [eax], dl
call 0x64401348
je 0x40883d
xchg ebx, eax
cmp byte [edx], al
jmp fcn.00408f31
inc eax
test dword [edi], edx
or al, bl
dec eax
ja 0x4094db
push ebp
add byte [eax - 0x6f6f6f70], dl