Function at 0x401693
Capabilities:
Enumerate threads
Inject apc

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4016f9
mov dword [esp + 4], str.Failed_to_allocate_memory_in_remote_process.
mov dword [esp], 0xc
call sym._out
mov eax, 0
jmp 0x4019b5
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
test eax, eax
jne 0x401776
mov dword [esp + 4], str.Failed_to_write_DLL_path_to_remote_process.
mov dword [esp], 0xc
call sym._out
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, 0
jmp 0x4019b5
mov dword [esp], str.Kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4017a6
mov dword [esp + 4], str.LoadLibraryA
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
jmp 0x4017ab
mov eax, 0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4017f7
mov dword [esp + 4], str.Failed_to_find_LoadLibraryA_address.
mov dword [esp], 0xc
call sym._out
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, 0
jmp 0x4019b5
mov dword [esp + 4], 0
mov dword [esp], 4
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x40185a
mov dword [esp + 4], str.Failed_to_take_a_snapshot_of_the_threads.
mov dword [esp], 0xc
call sym._out
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, 0
jmp 0x4019b5
mov dword [ebp - 0x3c], 0x1c
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._Thread32First_8
sub esp, 8
mov dword [ebp - 0x10], eax
jmp 0x4018d4
mov ebx, dword [ebp - 0x30]
mov dword [esp], str.Pixel_Gun_3D.exe
call sym._GetProcessID
cmp ebx, eax
jne 0x4018bc
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x10
call sym._OpenThread_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4018dc
lea eax, [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._Thread32Next_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401882
jmp 0x4018dd
nop
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
cmp dword [ebp - 0xc], 0
jne 0x401934
mov dword [esp + 4], str.Failed_to_open_a_thread_in_the_remote_process.
mov dword [esp], 0xc
call sym._out
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, 0
jmp 0x4019b5
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._QueueUserAPC_12
sub esp, 0xc
test eax, eax
jne 0x4019a2
mov dword [esp + 4], str.Failed_to_queue_the_APC_for_DLL_injection.
mov dword [esp], 0xc
call sym._out
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, 0
jmp 0x4019b5
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret