Function at 0x401b00
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Parse pe header
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1040
call fcn.00411450
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x103c], eax
mov ebx, ecx
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x1030], eax
lea eax, [ebp - 0x1020]
push eax
push 0x28
push 0xffffffffffffffff
mov dword [ebp - 0x1034], ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401ba3
push 0
push 0
push 0
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x101c], 1
push eax
push 0
push dword [ebp - 0x1020]
mov dword [ebp - 0x1010], 2
mov dword [ebp - 0x1018], 0x14
mov dword [ebp - 0x1014], 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x1020]
call edi
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x401bc3
mov eax, str.Error:_Invalid_executable_image.
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + 0x3c]
add esi, ebx
mov dword [ebp - 0x1028], esi
cmp dword [esi], 0x4550
je 0x401bec
mov eax, str.Error:_Invalid_PE_header.
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
mov eax, 0x2000
test word [esi + 0x16], ax
jne 0x401c0d
mov eax, str.Error:_The_image_is_not_DLL.
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x401c3c
push eax
call edi
mov eax, str.Error:_Unable_to_open_target_process
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
push 0x40
push 0x3000
push dword [esi + 0x50]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x1038], esi
test esi, esi
jne 0x401c74
push ebx
call edi
mov eax, str.Error:_Unable_to_allocate_memory_for_the_GUI
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1028]
push 0
push dword [eax + 0x54]
push dword [ebp - 0x1034]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401cb8
push 0x8000
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebx
call edi
mov eax, str.Error:_Unable_to_copy_headers_to_target_process
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1028]
xor ecx, ecx
mov dword [ebp - 0x1024], 0
cmp cx, word [eax + 6]
jae 0x401d15
lea edi, [eax + 0x10c]
mov eax, dword [edi]
add eax, dword [ebp - 0x1034]
push 0
push dword [edi - 4]
push eax
mov eax, dword [edi - 8]
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x1028]
lea edi, [edi + 0x28]
mov ecx, dword [ebp - 0x1024]
inc ecx
mov dword [ebp - 0x1024], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jb 0x401cd6
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push 0x3000
push dword [ebp - 0x1030]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x1024], eax
test eax, eax
jne 0x401d5c
push 0x8000
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebx
call edi
mov eax, str.Error:_Unable_to_allocate_memory_for_the_DLL
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x1030]
push dword [ebp - 0x102c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401db5
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push eax
mov eax, dword [ebp - 0x1024]
push eax
push ebx
call esi
push 0x8000
push 0
push dword [ebp - 0x1038]
push ebx
call esi
push ebx
call edi
mov eax, str.Error:_Unable_to_copy_data_for_the_DLL
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
push 0x40
push 0x3000
push 0x1000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x102c], eax
test eax, eax
jne 0x401e13
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push eax
mov eax, dword [ebp - 0x1024]
push eax
push ebx
call esi
push 0x8000
push 0
push dword [ebp - 0x1038]
push ebx
call esi
push ebx
call edi
mov eax, str.Error:_Unable_to_allocate_memory_for_the_loader_code
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x100c], esi
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0x1030]
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0x1034]
push 0x417bd0
push edi
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x1028]
add ecx, esi
mov dword [ebp - 0x1008], ecx
mov ecx, dword [eax + 0xa0]
add ecx, esi
mov dword [ebp - 0x1004], ecx
mov eax, dword [eax + 0x80]
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1000], eax
call esi
push 0x417da0
push edi
mov dword [ebp - 0xffc], eax
call esi
push 0x417db0
push edi
mov dword [ebp - 0xff8], eax
call esi
push dword [ebp - 0x103c]
mov dword [ebp - 0xff4], eax
lea eax, [ebp - 0xfe8]
push 0x104
push eax
call fcn.004055b9
mov esi, dword [ebp - 0x102c]
lea eax, [ebp - 0x100c]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add esp, 0xc
push 0
push 0x22c
push eax
push esi
push ebx
call edi
push 0
mov eax, fcn.00401af0
add esi, 0x22c
sub eax, 0x4019c0
push eax
push 0x4019c0
push esi
push ebx
call edi
mov edi, dword [ebp - 0x102c]
push 0
push 0
push edi
push esi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
push str.ME.12:_X
call fcn.00401090
add esp, 8
test esi, esi
jne 0x401f6f
push 0x8000
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
push ebx
call esi
push 0x8000
push 0
push dword [ebp - 0x1038]
push ebx
call esi
push 0x8000
push 0
push dword [ebp - 0x1024]
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
mov eax, str.Error:_Unable_to_execute_loader_code
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401f9b
mov esp, ebp
pop ebp
ret
push str.ME.13
call fcn.00401090
add esp, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401f9b
mov esp, ebp
pop ebp
ret