Function at 0x4136a0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub esp, 0x1424
push ebp
push 0x40e2e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebp, ebp
cmp dword [0x41c6ec], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
jbe 0x413934
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [0x41c6e4]
mov ecx, dword [0x41c704]
shl edi, 2
mov eax, dword [edi + eax]
imul eax, eax, 0x1810
add ecx, eax
cmp byte [0x41b6c8], 1
mov eax, dword [ecx]
jne 0x41372e
cmp eax, 0xffffffff
jne 0x413700
push dword [ecx + 0x804]
jmp 0x41370e
mov ecx, dword [esp + 0x1438]
shl eax, 4
push dword [eax + ecx + 4]
push ebp
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
je 0x41391d
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4138ca
cmp eax, 0xffffffff
jne 0x4138cd
push dword [ecx + 0x804]
push ebp
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
je 0x41391d
mov ecx, dword [0x41c704]
push 0x400
lea eax, [esp + 0xc38]
push eax
mov eax, dword [0x41c6e4]
mov eax, dword [edi + eax]
imul eax, eax, 0x1810
push dword [eax + ecx + 0x180c]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [esp + 0xc34]
push 0x40e330
push eax
call fcn.00411670
test al, al
pop ecx
pop ecx
je 0x4138ca
push 0x40
push 0x1000
mov edi, 0x4123f9
sub edi, 0x412374
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
cmp ebx, ebp
je 0x4138ca
lea eax, [esp + 0x18]
push eax
push edi
push 0x412374
push ebx
push esi
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x40
push 0x1000
push 0xc10
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
cmp edi, ebp
je 0x4138bc
cmp dword [esp + 0x10], ebp
je 0x413849
push 0x40e324
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e310
push dword [esp + 0x14]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e2a0
push dword [esp + 0x14]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e300
push dword [esp + 0x14]
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x30], eax
push 0x40e2ec
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xc34]
push eax
lea eax, [esp + 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x18]
push eax
push 0xc10
lea eax, [esp + 0x2c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebp
push ebp
push edi
push ebx
push ebp
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, ebp
mov dword [esp + 0x1c], eax
je 0x4138a4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
jmp 0x413917
mov ecx, dword [esp + 0x1438]
shl eax, 4
lea esi, [eax + ecx + 4]
push dword [esi]
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebp
je 0x41391d
push 1
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
movzx eax, word [esi + 6]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x413916
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [0x41c6ec]
jb 0x4136cb
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x1424
ret