Function at 0x4025a0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x450040]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
mov byte [ebp - 6], 0
cmp byte [0x450112], cl
je 0x4025e1
movaps xmm0, xmmword [0x447fa0]
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0x4755
nop
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x11
jb 0x4025d0
push 1
jmp 0x402601
movaps xmm0, xmmword [0x447de0]
movups xmmword [ebp - 0x18], xmm0
mov word [ebp - 8], 0xc1e
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x11
jb 0x4025f2
push 0
lea eax, [ebp - 0x17]
mov byte [ebp - 6], 0
push eax
call fcn.0043ee90
cmp byte [0x450114], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
je 0x40289c
mov cl, 0x71
mov dword [ebp - 0x14], 0x14180771
mov dword [ebp - 0x10], 0x151e1c06
xor eax, eax
mov dword [ebp - 0xc], 0x172e1d14
mov word [ebp - 8], 0x71e
mov byte [ebp - 6], 0
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xd
jae 0x402656
mov cl, byte [ebp - 0x14]
jmp 0x402647
movd xmm0, dword [0x4501a0]
lea eax, [ebp - 0x13]
cvtdq2ps xmm0, xmm0
push eax
mov byte [ebp - 6], 0
movss dword [ebp - 0x34], xmm0
call fcn.0043ea50
xor dword [ebp - 0x34], eax
mov edi, dword [0x4500e0]
push str.NtWriteVirtualMemory
push str.ntdll.dll
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x30]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movaps xmm0, xmmword [0x4480c0]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x63446f
nop word [eax + eax]
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x12
jb 0x4026e0
movd xmm0, dword [0x4501a4]
lea eax, [ebp - 0x17]
cvtdq2ps xmm0, xmm0
push eax
mov byte [ebp - 5], 0
movss dword [ebp - 0x38], xmm0
call fcn.0043ea50
xor dword [ebp - 0x38], eax
mov edi, dword [0x4500e0]
push str.NtWriteVirtualMemory
push str.ntdll.dll
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x38]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x30]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movaps xmm0, xmmword [0x448040]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x7b5d76
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x12
jb 0x402775
movd xmm0, dword [0x4501a8]
lea eax, [ebp - 0x17]
cvtdq2ps xmm0, xmm0
push eax
mov byte [ebp - 5], 0
movss dword [ebp - 0x34], xmm0
call fcn.0043ea50
mov ecx, dword [ebp - 0x34]
mov edi, dword [0x4500e0]
xor ecx, eax
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0x38], ecx
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x38]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x30]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movaps xmm0, xmmword [0x447e50]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x3b1e35
nop
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x12
jb 0x402810
movd xmm0, dword [0x4501ac]
lea eax, [ebp - 0x17]
cvtdq2ps xmm0, xmm0
push eax
mov byte [ebp - 5], 0
movss dword [ebp - 0x34], xmm0
call fcn.0043ea50
mov ecx, dword [ebp - 0x34]
mov edi, dword [0x4500e0]
xor ecx, eax
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0x38], ecx
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x38]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x30]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov byte [ebp - 8], 0
cmp byte [0x450115], cl
je 0x40292d
movaps xmm0, xmmword [0x447dd0]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x401070b
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x4028c0
lea eax, [ebp - 0x1b]
mov byte [ebp - 8], 0
push eax
call fcn.0043ea50
mov edi, dword [0x4500e0]
mov ecx, eax
push str.NtWriteVirtualMemory
xor ecx, 0x3f800000
push str.ntdll.dll
mov dword [ebp - 0x38], ecx
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x38]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x30]
jmp 0x4029a3
movaps xmm0, xmmword [0x447ff0]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x5451575b
nop
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x13
jb 0x402940
lea eax, [ebp - 0x1b]
mov byte [ebp - 8], 0
push eax
call fcn.0043ea50
mov edi, dword [0x4500e0]
push str.NtWriteVirtualMemory
push str.ntdll.dll
mov dword [ebp - 0x3c], eax
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x3c]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x34]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor ecx, ecx
cmp byte [0x450116], cl
je 0x4029e7
movaps xmm0, xmmword [0x447ee0]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x25202433
mov dword [ebp - 0xc], 0x2e29321e
mov word [ebp - 8], 0x36
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x18
jb 0x4029d6
push 3
jmp 0x402a15
movaps xmm0, xmmword [0x447fe0]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x484d495e
mov dword [ebp - 0xc], 0x43445f73
mov word [ebp - 8], 0x5b
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x18
jb 0x402a06
push 0
lea eax, [ebp - 0x1f]
mov byte [ebp - 7], 0
push eax
call fcn.0043ee90
xor ecx, ecx
mov byte [ebp - 6], 0
cmp byte [0x450117], cl
je 0x402b2c
movaps xmm0, xmmword [0x4480a0]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x7e79624e
mov dword [ebp - 0x10], 0x72704e66
mov dword [ebp - 0xc], 0x70636472
mov word [ebp - 8], 0x6872
nop word [eax + eax]
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x1d
jb 0x402a60
push 2
lea eax, [ebp - 0x23]
mov byte [ebp - 6], 0
push eax
call fcn.0043ee90
movaps xmm0, xmmword [0x447ef0]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0xc], 0x20352621
movaps xmm0, xmmword [0x447ed0]
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 8], 0x3a3b3d
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x26
jb 0x402aa2
lea eax, [ebp - 0x2b]
mov byte [ebp - 5], 0
push eax
call fcn.0043ea50
mov edi, dword [0x4500e0]
mov ecx, eax
push str.NtWriteVirtualMemory
xor ecx, 0x3f666666
push str.ntdll.dll
mov dword [ebp - 0x3c], ecx
lea ebx, [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x40
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x3c]
push eax
push ebx
push edi
call esi
push 0
push dword [ebp - 0x34]
push 4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004403ea
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x447e90]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x21263d11
mov dword [ebp - 0x10], 0x2d2f1139
mov dword [ebp - 0xc], 0x2f3c3b2d
mov word [ebp - 8], 0x372d
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x1d
jb 0x402b52
push 0
lea eax, [ebp - 0x23]
mov byte [ebp - 6], 0
push eax
call fcn.0043ee90
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004403ea
mov esp, ebp
pop ebp
ret