Function at 0x401340
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get hostname
Packed with generic packer
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421380
push 0x41f040
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ax, word [0x4274f0]
dec ax
mov word [0x4274fc], ax
movsx ecx, byte [0x4274d8]
push ecx
movsx edx, word [0x4274ec]
push edx
call fcn.0040c720
mov word [0x4274f4], ax
movsx eax, word [0x427500]
push eax
movsx ecx, word [0x4274ec]
push ecx
call fcn.0040c7f0
mov dword [0x427510], eax
mov edx, dword [0x427520]
push edx
push 0xf393ffff
call fcn.0040c8e0
mov dword [0x427520], eax
mov al, byte [0x427514]
mov byte [0x4274da], al
movsx ecx, word [0x4274ec]
push ecx
movsx edx, word [0x4274e8]
push edx
call fcn.0040c7b0
add esp, 0x20
mov dword [0x427518], eax
movsx eax, byte [0x4274d9]
and eax, 0x45c5ffff
mov dword [0x42750c], eax
mov eax, dword [0x4274a4]
xor ebx, ebx
cmp eax, ebx
jne 0x401ef7
cmp dword [0x42751c], ebx
setne cl
mov byte [0x4274df], cl
push 0x20b1ffff
push 0x7431ffff
call fcn.0040c6e0
add esp, 8
mov word [0x427504], ax
mov word [0x4274f8], bx
mov dword [ebp - 4], ebx
push 0x5629ffff
push 0xa121ffff
call fcn.0040c760
mov word [0x4274f4], ax
movsx edx, word [0x4274e8]
push edx
push 0xed0fffff
call fcn.0040c870
mov word [0x4274ec], ax
mov eax, 0xcc8fffff
sub eax, dword [0x427524]
mov dword [0x42750c], eax
mov byte [ebp - 0x174], bl
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x173]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
mov dword [ebp - 0x20], esi
push 0x95bdffff
movsx ecx, byte [0x4274de]
push ecx
call fcn.0040c7f0
add esp, 0x18
mov byte [0x4274dd], al
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x174]
push eax
call dword [0x42796c]
xor ecx, ecx
mov cx, word [0x4274e4]
xor edx, edx
mov dx, word [0x4274e8]
or ecx, edx
mov word [0x4274fc], cx
xor eax, eax
mov ax, word [0x4274f8]
movsx ecx, byte [0x4274da]
sub ecx, eax
mov word [0x427504], cx
movsx edx, word [0x4274f0]
push edx
mov eax, dword [0x42752c]
push eax
call fcn.0040c7b0
mov byte [0x4274e0], al
push 0x883bffff
push 0x6191ffff
call fcn.0040c8e0
add esp, 0x10
mov word [0x4274f8], ax
lea ecx, [ebp - 0x174]
push ecx
call fcn.00401030
neg al
sbb eax, eax
and eax, 5
mov dword [ebp - 0x1c], eax
jne 0x401658
push 0x26b7ffff
movsx edx, byte [0x4274dd]
push edx
call fcn.0040c7b0
mov word [0x4274e4], ax
mov eax, dword [0x427514]
push eax
push 0xbebfffff
call fcn.0040c6e0
mov byte [0x4274db], al
push 0xe75fffff
push 0x9cd5ffff
call fcn.0040c7b0
mov word [0x4274fc], ax
mov dword [ebp - 0x20], esi
mov ecx, dword [0x42752c]
push ecx
movsx edx, word [0x4274ec]
push edx
call fcn.0040c7f0
mov word [0x4274e8], ax
xor eax, eax
mov al, byte [0x4274d9]
and eax, dword [0x427524]
mov byte [0x4274dc], al
xor ecx, ecx
mov cl, byte [0x4274df]
sub ecx, 0x242dffff
mov byte [0x4274dc], cl
push 0xb1dbffff
push 0x6c1fffff
call fcn.0040c870
add esp, 0x28
mov word [0x4274e4], ax
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
movsx ecx, word [0x4274e8]
add ecx, 0x654dffff
mov dword [0x427528], ecx
mov edx, dword [0x427510]
or edx, 0xa701ffff
mov dword [0x427520], edx
lea eax, [ebp - 0x174]
push eax
call fcn.00401030
neg al
sbb eax, eax
and eax, 6
mov dword [ebp - 0x1c], eax
movsx ecx, byte [0x4274df]
push ecx
push 0xe2c1ffff
call fcn.0040c8e0
add esp, 8
mov byte [0x4274d8], al
xor edx, edx
mov dl, byte [0x4274d9]
imul edx, edx, 0xae2dffff
mov byte [0x4274de], dl
push 0x500bffff
movsx eax, byte [0x4274db]
push eax
call fcn.0040c720
add esp, 8
mov dword [0x427528], eax
mov ecx, dword [0x42751c]
or ecx, 0xdba1ffff
mov byte [0x4274d8], cl
mov byte [0x4274df], 0xfe
cmp dword [ebp - 0x1c], ebx
jne 0x401e44
push 0x32ddffff
push 0x8ddfffff
call fcn.0040c720
mov byte [0x4274d9], al
push 0xb40fffff
push 0xc745ffff
call fcn.0040c830
mov word [0x427500], ax
mov dword [ebp - 0x1c], 7
push 0xa73ffff
movsx edx, word [0x4274fc]
push edx
call fcn.0040c830
mov byte [0x4274d9], al
mov dword [ebp - 0x24], ebx
push 0x18b7ffff
push 0x3de7ffff
call fcn.0040c830
add esp, 0x20
mov dword [0x427518], eax
mov edi, 1
mov dword [ebp - 4], edi
or eax, 0xffffffff
mov word [0x4274e8], ax
mov word [0x4274f0], ax
mov word [0x4274fc], di
mov byte [0x4274da], bl
call dword [sym.imp.KERNEL32.DLL_GetVersion]
test eax, eax
jns 0x401777
mov eax, dword [0x427528]
push eax
push 0x726dffff
call fcn.0040c7b0
add esp, 8
mov word [0x4274e8], ax
mov eax, dword fs:[0x20]
mov dword [ebp - 0x24], eax
movsx ecx, byte [0x4274dc]
or ecx, 0xba43ffff
mov word [0x4274f8], cx
push 0x628dffff
mov edx, dword [0x42750c]
push edx
call fcn.0040c760
add esp, 8
mov dword [0x42751c], eax
mov dword [ebp - 4], ebx
jmp 0x4017f5
push 0xe5f9ffff
push 0xc5ebffff
call fcn.0040c8e0
mov word [0x4274ec], ax
movsx eax, byte [0x4274df]
push eax
mov ecx, dword [0x42750c]
push ecx
call fcn.0040c760
add esp, 0x10
mov dword [0x42750c], eax
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
movzx eax, al
mov dword [ebp - 0x24], eax
mov byte [0x4274d8], 0xfe
movsx edx, byte [0x4274dd]
add edx, dword [0x42751c]
mov word [0x4274e8], dx
mov dword [ebp - 4], ebx
jmp 0x4017f5
movsx eax, byte [0x4274dc]
imul eax, eax, 0x4d23ffff
mov word [0x427500], ax
mov esi, 0xfffffffe
mov word [0x4274f4], si
push 0x4319ffff
movsx eax, ax
push eax
call fcn.0040c6e0
add esp, 8
mov byte [0x4274e0], al
cmp dword [ebp - 0x24], ebx
jne 0x401e44
mov dword [ebp - 0x1c], 0xa
xor ecx, ecx
mov cl, byte [0x4274db]
sub ecx, 0x157fffff
mov byte [0x4274dd], cl
push 0x4c5dffff
movsx edx, word [0x4274f8]
push edx
call fcn.0040c7b0
mov byte [0x4274dd], al
mov byte [0x4274da], bl
push 0x39e5ffff
movsx eax, word [0x4274f0]
push eax
call fcn.0040c830
add esp, 0x10
mov byte [0x4274dc], al
mov word [0x4274ec], si
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
lea eax, [ebp - 0x70]
mov edx, str.Q_6_:
call section..text
push eax
call dword [0x4279cc]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 0xffffffff
jne 0x401e59
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
lea eax, [ebp - 0x70]
mov edx, str.Q16_:
call section..text
push eax
call dword [0x4279cc]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 0xffffffff
jne 0x401e59
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
lea eax, [ebp - 0x70]
mov edx, str.Q_6__6____
call section..text
push eax
call dword [0x4279cc]
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 0xffffffff
jne 0x401e59
movsx ecx, word [0x4274e4]
push ecx
push 0x3115ffff
call fcn.0040c7f0
mov byte [0x4274e0], al
mov edx, dword [0x427528]
add edx, 0x416dffff
mov byte [0x4274d8], dl
push 0x55f7ffff
movsx eax, word [0x4274ec]
push eax
call fcn.0040c830
mov byte [0x4274dd], al
mov dword [ebp - 0x1c], 8
push 0x612bffff
push 0x8a39ffff
call fcn.0040c8e0
add esp, 0x18
mov word [0x4274f8], ax
lea eax, [ebp - 0x70]
mov edx, 0x42134c
call section..text
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov dword [ebp - 0x30], esi
mov ecx, 0xf913ffff
sub ecx, dword [0x42752c]
mov word [0x4274f0], cx
movsx edx, word [0x4274f8]
push edx
movsx eax, byte [0x4274d8]
push eax
call fcn.0040c830
add esp, 8
mov word [0x427504], ax
mov cl, byte [0x4274db]
mov byte [0x4274e0], cl
movsx edx, byte [0x4274df]
movsx eax, word [0x4274f0]
sub eax, edx
mov dword [0x427524], eax
lea eax, [ebp - 0x70]
mov edx, 0x421330
call section..text
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
movzx ecx, byte [eax]
cmp ecx, 0xffffffcc
jne 0x401a52
mov edx, dword [0x42750c]
push edx
movsx eax, word [0x427500]
push eax
call fcn.0040c720
mov word [0x4274f4], ax
mov ecx, dword [0x427524]
push ecx
mov edx, dword [0x427528]
push edx
call fcn.0040c6e0
add esp, 0x10
mov dword [0x42752c], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
mov dword [0x4274a4], edx
jmp 0x401efa
movsx eax, byte [0x4274d8]
shl eax, 1
mov dword [0x427524], eax
xor eax, eax
cmp byte [0x4274dc], bl
setne al
mov dword [0x427520], eax
mov ecx, dword [0x427528]
push ecx
push 0x8ed1ffff
call fcn.0040c8a0
mov byte [0x4274de], al
mov dword [ebp - 0x1c], edi
movsx edx, word [0x4274ec]
push edx
mov eax, dword [0x42752c]
push eax
call fcn.0040c7f0
mov dword [0x427528], eax
movsx ecx, word [0x427504]
push ecx
movsx edx, byte [0x4274dc]
push edx
call fcn.0040c7b0
add esp, 0x18
mov dword [0x427514], eax
mov dword [ebp - 4], 2
movsx eax, byte [0x4274dd]
push eax
push 0xd23fffff
call fcn.0040c8a0
mov dword [0x42750c], eax
mov ecx, dword [0x427528]
push ecx
movsx edx, byte [0x4274da]
push edx
call fcn.0040c6e0
mov byte [0x4274de], al
movsx eax, byte [0x4274df]
push eax
movsx ecx, byte [0x4274e0]
push ecx
call fcn.0040c760
add esp, 0x18
mov dword [0x427518], eax
xor ebx, ebx
mov ecx, 0xa
mov eax, 0x564d5868
mov dx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete al
movzx eax, al
mov dword [ebp - 0x24], eax
movsx edx, byte [0x4274e0]
push edx
mov eax, dword [0x427520]
push eax
call fcn.0040c7b0
mov byte [0x4274d8], al
movsx ecx, byte [0x4274da]
push ecx
push 0x3621ffff
call fcn.0040c6e0
mov dword [0x427524], eax
movsx edx, word [0x427500]
push edx
push eax
call fcn.0040c8a0
mov word [0x427504], ax
push 0xc61ffff
push 0x1879ffff
call fcn.0040c720
add esp, 0x20
jmp 0x401ba7
mov word [0x4274f4], ax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x401e42
push 0xd62bffff
movsx ecx, word [0x4274f8]
push ecx
call fcn.0040c8e0
mov byte [0x4274d9], al
mov dword [ebp - 0x1c], 2
mov edx, dword [0x427518]
add edx, 0x8d9c0001
mov byte [0x4274dd], dl
movsx eax, byte [0x4274d8]
push eax
push 0x5dffffff
call fcn.0040c720
add esp, 0x10
mov word [0x4274ec], ax
xor ebx, ebx
cmp word [0x427504], bx
setne al
mov byte [0x4274de], al
push pe_nt_image_headers32
push 0x1000
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
mov dword [ebp - 0x2c], esi
movsx ecx, byte [0x4274de]
push ecx
push 0xdd27ffff
call fcn.0040c830
mov word [0x4274f8], ax
mov byte [esi], 0xf
mov byte [esi + 1], 0x3f
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], 0xc3
push 0x24afffff
mov edx, dword [0x427520]
push edx
call fcn.0040c830
mov word [0x4274ec], ax
movsx eax, byte [0x4274df]
push eax
push 0x2733ffff
call fcn.0040c7f0
mov word [0x4274f0], ax
push 0x20fbffff
movsx ecx, word [0x4274e4]
push ecx
call fcn.0040c720
add esp, 0x20
mov byte [0x4274dc], al
mov dword [ebp - 4], 3
movsx edx, byte [0x4274d8]
push edx
push 0x835fffff
call fcn.0040c8e0
mov word [0x4274f8], ax
movsx eax, word [0x4274fc]
push eax
push 0xc4a1ffff
call fcn.0040c8e0
mov word [0x4274e4], ax
push 0x283bffff
movsx ecx, word [0x4274f4]
push ecx
call fcn.0040c8e0
mov word [0x4274f8], ax
mov edx, dword [0x42751c]
push edx
movsx eax, byte [0x4274da]
push eax
call fcn.0040c8e0
add esp, 0x20
mov dword [0x42752c], eax
pushal
mov eax, dword [ebp - 0x2c]
call eax
popal
inc dword [ebp - 0x24]
movsx ecx, byte [0x4274df]
push ecx
push 0x19d5ffff
call fcn.0040c7f0
mov dword [0x427528], eax
xor ebx, ebx
mov byte [0x4274da], bl
movsx edx, word [0x4274e8]
push edx
push 0x5d6bffff
call fcn.0040c8e0
add esp, 0x10
mov byte [0x4274df], al
mov eax, dword [0x427518]
imul eax, eax, 0xd5abffff
mov word [0x4274e8], ax
mov dword [ebp - 4], ebx
jmp 0x401dc1
mov word [0x427504], 0xfffe
push 0x383dffff
push 0xfffffffffffffffe
call fcn.0040c6e0
add esp, 8
mov word [0x4274e4], ax
push 0x8000
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
movsx edx, byte [0x4274db]
push edx
movsx eax, word [0x4274f0]
push eax
call fcn.0040c830
add esp, 8
mov byte [0x4274dd], al
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x401e42
mov dword [ebp - 0x1c], 3
call fcn.004012b0
test al, al
jne 0x401e42
movsx ecx, byte [0x4274e0]
push ecx
mov edx, dword [0x427528]
push edx
call fcn.0040c6e0
add esp, 8
mov word [0x4274f0], ax
int3
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
mov dword [0x4274a4], edx
jmp 0x401efa
xor eax, eax
mov ax, word [0x4274e8]
sub eax, 0x6d53ffff
mov byte [0x4274df], al
push 0x2a29ffff
movsx ecx, word [0x4274ec]
push ecx
call fcn.0040c830
add esp, 8
mov byte [0x4274db], al
xor eax, eax
cmp word [0x4274f8], bx
setne al
mov word [0x4274e4], ax
mov word [0x427504], bx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x401e44
mov dword [ebp - 0x1c], eax
mov eax, dword [0x427514]
push eax
push 0xabc7ffff
call fcn.0040c8a0
mov dword [0x42752c], eax
push 0xb12fffff
movsx ecx, word [0x4274fc]
push ecx
call fcn.0040c830
add esp, 0x10
mov byte [0x4274e0], al
cmp dword [ebp - 0x1c], ebx
jne 0x401f3d
call fcn.00401120
neg al
sbb eax, eax
and eax, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [0x427518]
and edx, dword [0x427528]
mov word [0x4274f4], dx
mov eax, dword [0x42752c]
push eax
push 0x35bbffff
call fcn.0040c720
add esp, 8
mov dword [0x427510], eax
mov byte [0x4274df], 0xff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret