Function at 0x401380
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Get common file path
Inject thread
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
sub esp, 0x440
mov eax, dword [0x405014]
xor eax, esp
mov dword [esp + 0x43c], eax
push ebx
mov ebx, dword [esp + 0x448]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x450]
push esi
xor esi, esi
mov dword [esp + 0x14], eax
push edi
test ebx, ebx
jle 0x401504
nop word [eax + eax]
lea edi, [esi*4]
mov ecx, str.__pid
mov eax, dword [edi + ebp]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4013f0
test dl, dl
je 0x4013ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4013f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4013d0
xor eax, eax
jmp 0x4013f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x40140c
inc esi
cmp esi, ebx
jl 0x4013c0
xor esi, esi
mov dword [esp + 0x10], 0
xor eax, eax
jmp 0x401429
push 0xa
push 0
push dword [edi + ebp + 4]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
xor ecx, ecx
mov dword [esp + 0x24], eax
add esp, 0xc
mov dword [esp + 0x10], ecx
xor esi, esi
push eax
push str.Process_ID:__lu_n
call fcn.004017d0
add esp, 8
nop word [eax + eax]
lea edi, [esi*4]
mov ecx, 0x40319c
mov eax, dword [edi + ebp]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401470
test dl, dl
je 0x40146c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401470
add eax, 2
add ecx, 2
test dl, dl
jne 0x401450
xor eax, eax
jmp 0x401475
sbb eax, eax
or eax, 1
test eax, eax
je 0x401480
inc esi
cmp esi, ebx
jl 0x401440
jmp 0x401488
mov ecx, dword [edi + ebp + 4]
mov dword [esp + 0x10], ecx
xor eax, eax
xor esi, esi
mov dword [esp + 0x14], eax
lea edi, [esi*4]
mov ecx, 0x4031a0
mov eax, dword [edi + ebp]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4014c0
test dl, dl
je 0x4014bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4014c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4014a0
xor eax, eax
jmp 0x4014c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4014d2
inc esi
cmp esi, ebx
jl 0x401490
xor edi, edi
jmp 0x4014da
mov edi, dword [edi + ebp + 4]
mov dword [esp + 0x14], edi
mov ebp, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
test ebp, ebp
je 0x401527
push ebp
push 0
push 0x1fffff
call esi
test eax, eax
je 0x401527
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
jmp 0x401618
push 0
push str.Process_ID:__lu_n
call fcn.004017d0
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
add esp, 8
mov dword [esp + 0x14], edi
xor ebp, ebp
xor ecx, ecx
mov dword [esp + 0x10], ecx
push ebp
push 0
push 0x1fffff
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401543
push eax
call ebx
mov eax, 1
push eax
push str.No_valid_process_ID_was_given__getting_process_ID_from_process_name...__X_n
call fcn.004017d0
add esp, 8
mov dword [esp + 0x20], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40157b
lea eax, [esp + 0x20]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4015c0
push esi
call ebx
push str.Process_not_found
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call section..text
add esp, 8
mov ecx, eax
push 0x4011e0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, 1
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401816
add esp, 0x440
ret
mov eax, str.Wow.exe
lea ecx, [esp + 0x44]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4015f0
test dl, dl
je 0x4015ec
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4015f0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4015d0
xor eax, eax
jmp 0x4015f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x401609
lea eax, [esp + 0x20]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
jmp 0x401574
push esi
call ebx
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x40157b
push ebp
push str.PID:__lu_n
call fcn.004017d0
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x4017ae
test edi, edi
je 0x4017ae
push eax
push str.Logging_in_as__s_n
call fcn.004017d0
add esp, 8
lea eax, [esp + 0x348]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [esp + 0x348]
push 0x403254
push 0x104
push eax
call esi
push str.AutoLogin.dll
lea eax, [esp + 0x358]
push 0x104
push eax
call esi
lea esi, [esp + 0x360]
add esp, 0x18
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401696
sub esi, ecx
push str.Kernel32
inc esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.LoadLibraryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push 0
push 0x1fffff
mov edi, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x40
push 0x3000
push esi
mov ebp, eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
mov ebx, eax
lea eax, [esp + 0x34c]
push esi
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0
push 0
push ebp
call edi
push 0x200
lea eax, [esp + 0x14c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x154]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
push ecx
push 0x100
push eax
call esi
mov eax, dword [esp + 0x2c]
push eax
lea eax, [esp + 0x264]
push 0x100
push eax
call esi
add esp, 0x24
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipe_autologin
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [esp + 0x1c]
push 0
push eax
push 0x200
lea eax, [esp + 0x154]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebp
call esi
push 0
push 0
push ebx
push dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push ebp
call edi
xor eax, eax
jmp 0x4015a0
push str.No_username_or_password_was_given._n
call fcn.004017d0
add esp, 4
xor eax, eax
jmp 0x4015a0