Function at 0x410130
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418513
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x41f040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.0040fd60
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x410204
lea eax, [ebp - 0x278]
mov dword [ebp - 0x278], 0x22c
push eax
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x410248
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop word [eax + eax]
mov ecx, str.Quest.exe
lea eax, [ebp - 0x254]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4101e6
test dx, dx
je 0x4101e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4101e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4101c0
xor eax, eax
jmp 0x4101eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x410242
lea eax, [ebp - 0x278]
push eax
push esi
call edi
test eax, eax
jne 0x4101b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.process_not_found
call fcn.00412b20
push 0x412d40
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00416332
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x270]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x410204
push edi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x294], esi
test esi, esi
je 0x410204
lea ecx, [ebp - 0x28c]
call fcn.0040f470
mov byte [ebp - 4], 1
mov edx, str.got_initial_data__size:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00412b20
push dword [ebp - 0x280]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push 0x412d40
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [ebp - 0x288]
mov edi, dword [ebp - 0x28c]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x290], edi
cmp edi, eax
je 0x4103fa
mov edx, edi
mov ecx, esi
call fcn.0040eb00
mov dword [ebp - 0x298], eax
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x29c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x4103e0
lea edi, [esi + 8]
push edi
lea ecx, [ebp - 0x40]
call fcn.004023c0
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x298]
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0x294]
push eax
mov byte [ebp - 4], 2
call fcn.0040f110
add esp, 4
mov edi, eax
lea eax, [ebp - 0x40]
push eax
test edi, edi
je 0x410636
mov ecx, dword [ebp - 0x290]
lea ecx, [ecx + 0x18]
call fcn.00410750
mov edx, str.__
mov dword [eax], edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00412b20
cmp dword [ebp - 0x2c], 0xf
lea edx, [ebp - 0x40]
push dword [ebp - 0x30]
cmova edx, dword [ebp - 0x40]
mov ecx, eax
call fcn.00414780
add esp, 4
mov edx, 0x41a54c
mov ecx, eax
call fcn.00412b20
push 0x40e4f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push 0x40e510
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push edi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
push 0x412d40
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x4103d3
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4103c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4103c9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00416375
add esp, 8
mov esi, dword [esi]
mov eax, dword [ebp - 0x29c]
jmp 0x4102e1
mov edi, dword [ebp - 0x290]
mov esi, dword [ebp - 0x294]
add edi, 0x38
mov eax, dword [ebp - 0x2a0]
jmp 0x4102b9
push 0x40
push 0x1000
push dword [ebp - 0x280]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x410665
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x44], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x4c]
push eax
mov edx, edi
movq qword [ebp - 0x4c], xmm0
call fcn.0040f860
add esp, 4
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
sub ecx, eax
push 0
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x410686
xor ecx, ecx
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x6828ec83
lea eax, [ebp - 0x23]
mov dword [ebp - 0x3c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0x168
movq qword [ebp - 0x20], xmm0
sub eax, edx
mov dword [ebp - 0x34], 0x6800
mov dword [ebp - 0x30], 0xb80000
mov dword [ebp - 0x2c], 0xff000000
mov dword [ebp - 0x28], 0x28c483d0
mov byte [ebp - 0x24], 0xc3
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x290], eax
je 0x4104ef
push eax
lea ecx, [ebp - 0x20]
call fcn.0040e080
push dword [ebp - 0x290]
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x40]
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x290]
add esp, 0xc
mov ecx, dword [ebp - 0x20]
add eax, esi
mov esi, dword [ebp - 0x294]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 5
mov dword [ecx + 4], 0x1337
mov eax, dword [ebp - 0x20]
push 0
mov dword [eax + 0xe], edi
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x27c]
add eax, edi
mov dword [ecx + 0x13], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4106a7
push 0
push 0
push 0
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.done
call fcn.00412b20
push 0x412d40
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x41059e
mov edx, dword [ebp - 0x18]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x41057f
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4105c4
push edx
push ecx
call fcn.00416375
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x4105e9
mov edx, dword [ebp - 0x44]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4105ca
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4105ca
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00416375
add esp, 8
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x28c]
call fcn.004106d0
xor eax, eax
jmp 0x410226
lea ecx, [ebp - 0x2ec]
call fcn.00412d70
add esp, 4
push eax
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 3
call fcn.0040e3e0
push 0x41d46c
lea eax, [ebp - 0x2b0]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.no_base_
lea ecx, [ebp - 0x2bc]
call fcn.00401270
push 0x41d46c
lea eax, [ebp - 0x2bc]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.unable_to_write_final_binary
lea ecx, [ebp - 0x2c8]
call fcn.00401270
push 0x41d46c
lea eax, [ebp - 0x2c8]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.unable_to_write_shellcode
lea ecx, [ebp - 0x2d4]
call fcn.00401270
push 0x41d46c
lea eax, [ebp - 0x2d4]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3