Function at 0x4134d7
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
sub esp, 0x1424
push ebp
push 0x40e370
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebp, ebp
cmp dword [0x41c6ec], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
jbe 0x41376b
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [0x41c6e4]
mov ecx, dword [0x41c704]
shl edi, 2
mov eax, dword [edi + eax]
imul eax, eax, 0x1810
add ecx, eax
cmp byte [0x41b6c8], 1
mov eax, dword [ecx]
jne 0x413565
cmp eax, 0xffffffff
jne 0x413537
push dword [ecx + 0x804]
jmp 0x413545
mov ecx, dword [esp + 0x1438]
shl eax, 4
push dword [eax + ecx + 4]
push ebp
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
je 0x413754
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x413701
cmp eax, 0xffffffff
jne 0x413704
push dword [ecx + 0x804]
push ebp
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
je 0x413754
mov ecx, dword [0x41c704]
push 0x400
lea eax, [esp + 0xc38]
push eax
mov eax, dword [0x41c6e4]
mov eax, dword [edi + eax]
imul eax, eax, 0x1810
push dword [eax + ecx + 0x180c]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [esp + 0xc34]
push 0x40e3c0
push eax
call fcn.004116f6
test al, al
pop ecx
pop ecx
je 0x413701
push 0x40
push 0x1000
mov edi, 0x4123e4
sub edi, 0x41235f
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
cmp ebx, ebp
je 0x413701
lea eax, [esp + 0x18]
push eax
push edi
push 0x41235f
push ebx
push esi
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x40
push 0x1000
push 0xc10
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
cmp edi, ebp
je 0x4136f3
cmp dword [esp + 0x10], ebp
je 0x413680
push 0x40e3b4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e3a0
push dword [esp + 0x14]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e330
push dword [esp + 0x14]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40e390
push dword [esp + 0x14]
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x30], eax
push 0x40e37c
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xc34]
push eax
lea eax, [esp + 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x18]
push eax
push 0xc10
lea eax, [esp + 0x2c]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebp
push ebp
push edi
push ebx
push ebp
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, ebp
mov dword [esp + 0x1c], eax
je 0x4136db
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
jmp 0x41374e
mov ecx, dword [esp + 0x1438]
shl eax, 4
lea esi, [eax + ecx + 4]
push dword [esi]
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebp
je 0x413754
push 1
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
movzx eax, word [esi + 6]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41374d
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [0x41c6ec]
jb 0x413502
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x1424
ret