Function at 0x40dab0
Capabilities:
Allocate or change rwx memory
Enumerate threads
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcfc
push ebx
push esi
push edi
lea edi, [ebp - 0x93c]
mov ecx, 0x24f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
cmp esi, esp
call fcn.00415080
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00409120
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2f4], 0x10007
push 0x2c8
push 0
lea eax, [ebp - 0x2f0]
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, 1
test eax, eax
je 0x40dc94
xor eax, eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x318], 0x1c
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [ebp - 0x324]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x40dc64
mov eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 8]
jne 0x40dc47
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x14]
jne 0x40dc47
mov esi, esp
mov eax, dword [ebp - 0x310]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.00415080
mov dword [ebp - 0x20], eax
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.00415080
mov dword [ebp - 0x5f8], 0x10007
push 0x2c8
push 0
lea eax, [ebp - 0x5f4]
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x5f8]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp esi, esp
call fcn.00415080
push 0x2cc
lea eax, [ebp - 0x5f8]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
call sub.VCRUNTIME140D.dll_memcpy
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00415080
jmp 0x40dc94
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [ebp - 0x324]
push ecx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x40db87
jmp 0x40dc79
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00415080
mov dword [ebp - 0x604], eax
mov esi, esp
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00415080
jmp 0x40db1a
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.00415080
mov dword [ebp - 0x610], eax
mov byte [ebp - 0x638], 0x68
mov byte [ebp - 0x637], 0
mov byte [ebp - 0x636], 0
mov byte [ebp - 0x635], 0
mov byte [ebp - 0x634], 0
mov byte [ebp - 0x633], 0xb8
mov byte [ebp - 0x632], 0
mov byte [ebp - 0x631], 0
mov byte [ebp - 0x630], 0
mov byte [ebp - 0x62f], 0
mov byte [ebp - 0x62e], 0xff
mov byte [ebp - 0x62d], 0xd0
mov byte [ebp - 0x62c], 0xb8
mov byte [ebp - 0x62b], 0xff
mov byte [ebp - 0x62a], 0xff
mov byte [ebp - 0x629], 0xff
mov byte [ebp - 0x628], 0xff
mov byte [ebp - 0x627], 0x83
mov byte [ebp - 0x626], 0x78
mov byte [ebp - 0x625], 0x20
mov byte [ebp - 0x624], 0
mov byte [ebp - 0x623], 0x75
mov byte [ebp - 0x622], 4
mov byte [ebp - 0x621], 0x90
mov byte [ebp - 0x620], 0x90
mov byte [ebp - 0x61f], 0xeb
mov byte [ebp - 0x61e], 0xf6
mov byte [ebp - 0x61d], 0x90
mov byte [ebp - 0x61c], 0x90
mov byte [ebp - 0x61b], 0xeb
mov byte [ebp - 0x61a], 0xfc
mov eax, 1
shl eax, 0
mov ecx, dword [ebp + 0x14]
mov dword [ebp + eax - 0x638], ecx
mov eax, 1
imul ecx, eax, 6
mov edx, dword [ebp + 0xc]
mov dword [ebp + ecx - 0x638], edx
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp + 0x14]
mov dword [ebp + ecx - 0x638], edx
mov esi, esp
push 0
push 0x1f
lea eax, [ebp - 0x638]
push eax
mov ecx, dword [ebp - 0x610]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.00415080
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x23c], eax
mov esi, esp
push 0x40e360
mov ecx, dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.00415080
push 0x419b84
push eax
call fcn.00401230
add esp, 8
mov dword [ebp - 0xcec], eax
mov esi, esp
push 0x40e250
mov ecx, dword [ebp - 0xcec]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.00415080
push str.OK
push eax
call fcn.00401230
add esp, 8
mov dword [ebp - 0xcf0], eax
mov esi, esp
push 0x40e360
mov ecx, dword [ebp - 0xcf0]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.00415080
push 0x419b78
push eax
call fcn.00401230
add esp, 8
push str.Allocated_Thread_shellcode__0x1000_bytes_at_0x
push eax
call fcn.00401230
add esp, 8
mov dword [ebp - 0xcf4], eax
mov esi, esp
push 0x40e2b0
mov ecx, dword [ebp - 0xcf4]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
cmp esi, esp
call fcn.00415080
mov dword [ebp - 0xcf8], eax
mov esi, esp
mov eax, dword [ebp - 0x610]
push eax
mov ecx, dword [ebp - 0xcf8]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
cmp esi, esp
call fcn.00415080
push 0x419b48
push eax
call fcn.00401230
add esp, 8
mov dword [ebp - 0xcfc], eax
mov esi, esp
push 0x402f50
mov ecx, dword [ebp - 0xcfc]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.00415080
mov esi, esp
lea eax, [ebp - 0x2f4]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
cmp esi, esp
call fcn.00415080
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.00415080
mov esi, esp
push 0x40e360
mov ecx, dword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.00415080
push 0x419b84
push eax
call fcn.00401230
add esp, 8
mov dword [ebp - 0xcec], eax
mov esi, esp
push 0x40e250
mov ecx, dword [ebp - 0xcec]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.00415080
push str.OK
push eax
call fcn.00401230
add esp, 8
mov dword [ebp - 0xcf0], eax
mov esi, esp
push 0x40e360
mov ecx, dword [ebp - 0xcf0]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.00415080
push 0x419b78
push eax
call fcn.00401230
add esp, 8
push str.Waiting_for_entry_point_to_return...
push eax
call fcn.00401230
add esp, 8
mov dword [ebp - 0xcf4], eax
mov esi, esp
push 0x402f50
mov ecx, dword [ebp - 0xcf4]
call dword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp esi, esp
call fcn.00415080
mov eax, 1
test eax, eax
je 0x40e060
mov dword [ebp - 0x918], 0x10007
push 0x2c8
push 0
lea eax, [ebp - 0x914]
push eax
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x918]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp esi, esp
call fcn.00415080
mov eax, dword [ebp - 0x610]
add eax, 0x1b
mov ecx, dword [ebp - 0x860]
sub ecx, eax
mov dword [ebp - 0x924], ecx
cmp dword [ebp - 0x924], 5
jae 0x40e04d
jmp 0x40e060
mov esi, esp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00415080
jmp 0x40dfe8
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.00415080
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x23c], eax
mov esi, esp
lea eax, [ebp - 0x2f4]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
cmp esi, esp
call fcn.00415080
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.00415080
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00415080
mov esi, esp
push 0x8000
push 0
mov eax, dword [ebp - 0x610]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp esi, esp
call fcn.00415080
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x40e108]
call fcn.00415020
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcfc
cmp ebp, esp
call fcn.00415080
mov esp, ebp
pop ebp
ret