Function at 0x406690
Capabilities:
Allocate or change rwx memory
Delete file
Enumerate process modules
Enumerate processes
Execute command
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x874
mov eax, dword [0x45b008]
xor eax, esp
mov dword [esp + 0x870], eax
push ebx
push esi
push edi
call fcn.004044d0
test eax, eax
je 0x406a6e
call fcn.00402440
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x406a6e
push dword [0x45b9f0]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x18], 0x428
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x406720
push str.dxgi.dll
lea eax, [esp + 0x3c]
push eax
call esi
test eax, eax
je 0x4067dc
lea eax, [esp + 0x18]
push eax
push ebx
call edi
test eax, eax
jne 0x406700
mov dword [esp + 0x440], 0
push dword [0x45b9f0]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x450], 0x428
lea eax, [esp + 0x450]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x406782
nop dword [eax]
push str.module.dll
lea eax, [esp + 0x474]
push eax
call esi
test eax, eax
je 0x406789
lea eax, [esp + 0x450]
push eax
push ebx
call edi
test eax, eax
jne 0x406760
cmp byte [esp + 0x13], 0
je 0x4067ec
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x402c10
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Library_already_injected
call fcn.004027e0
push 0x402c10
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x870]
xor ecx, esp
call fcn.00407d04
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x440], eax
jmp 0x40672b
mov ebx, dword [esp + 0x440]
mov edx, 0x45b088
mov ecx, dword [0x45b9ec]
push 0x45ba10
sub esp, 8
lea esi, [ebx + 0xfffff]
push esi
push ebx
push 0x28
call fcn.004063c0
mov eax, dword [0x45ba14]
add esp, 0x18
sub eax, dword [0x45ba10]
test eax, 0xfffffffc
jne 0x406849
mov ecx, dword [0x45b9ec]
mov edx, 0x45b0e0
push 0x45ba10
sub esp, 8
push esi
push ebx
push 0x30
call fcn.004063c0
add esp, 0x18
xor esi, esi
xor ebx, ebx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x4068ed
lea eax, [esp + 0x450]
mov dword [esp + 0x450], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4068e6
nop
mov eax, str.aow_exe.exe
lea ecx, [esp + 0x474]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4068b6
test dx, dx
je 0x4068b2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4068b6
add ecx, 4
add eax, 4
test dx, dx
jne 0x406890
xor eax, eax
jmp 0x4068bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4068d3
mov eax, dword [esp + 0x464]
cmp eax, esi
jbe 0x4068d3
mov ebx, dword [esp + 0x458]
mov esi, eax
lea eax, [esp + 0x450]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x406880
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x45ba04
sub esp, 8
mov dword [0x45b9e8], eax
mov edx, 0x45b0b0
mov ecx, eax
push 0x60000000
push 0x30000000
push 0x30
call fcn.004063c0
mov eax, dword [0x45ba14]
add esp, 0x18
mov ecx, dword [0x45ba10]
sub eax, ecx
sar eax, 2
test eax, eax
je 0x406a02
mov eax, dword [0x45ba08]
sub eax, dword [0x45ba04]
sar eax, 2
test eax, eax
je 0x406a02
mov eax, dword [ecx]
mov esi, dword [esp + 0x440]
mov edi, dword [0x45b9ec]
add esi, 0x300
mov dword [esp + 0x444], eax
lea eax, [esp + 0x448]
push eax
push 0x40
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x444]
push 0
push 4
push eax
push esi
push edi
call ebx
push 0
push dword [esp + 0x44c]
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [0x45ba04]
mov esi, dword [esp + 0x440]
mov edi, dword [0x45b9ec]
add esi, 0x304
mov eax, dword [eax]
mov dword [esp + 0x44c], eax
lea eax, [esp + 0x440]
push eax
push 0x40
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [esp + 0x454]
push eax
push esi
push edi
call ebx
push 0
push dword [esp + 0x444]
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push dword [esp + 0x14]
call fcn.00401f60
test al, al
je 0x406a6e
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xf
movups xmmword [ecx], xmm0
push str.sc_stop_HookDrv
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00401a50
call fcn.004042f0
mov ecx, esp
xorps xmm0, xmm0
push 0x11
push str.sc_delete_HookDrv
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00401a50
call fcn.004042f0
add esp, 0x18
push 0x4570c0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x87c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00407d04
mov esp, ebp
pop ebp
ret