Function at 0x4036a0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Resume thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x48b088]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x230], 0x37e7ea5e
mov edi, edx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x254], esi
je 0x4036fa
mov dword [ebp - 0x238], 0x46ca10
mov eax, 0x284
mov dword [ebp - 0x230], 0
jmp 0x403713
mov dword [ebp - 0x238], 0x46c760
mov eax, 0x2af
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x234], eax
add eax, 3
and eax, 0xfffffffc
push 0x226
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.00434d70
push edi
lea eax, [ebp - 0x22c]
push 0x104
push eax
call fcn.00437237
mov eax, dword [ebp - 0x23c]
lea edi, [ebp - 0x24]
mov ecx, 6
add esp, 0x18
rep movsd dword es:[edi], dword [esi]
push 0x40
push 0x3000
add eax, 0x226
push eax
push 0
movsw word es:[edi], word [esi]
push ebx
mov dword [ebp - 0xa], 1
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x258], esi
test esi, esi
je 0x4038fa
mov edi, dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push eax
push edi
push dword [ebp - 0x238]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4038ce
cmp dword [ebp - 0x244], edi
jne 0x4038ce
mov edi, dword [ebp - 0x23c]
lea eax, [ebp - 0x248]
push eax
push 0x226
lea eax, [ebp - 0x22c]
add edi, esi
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x4038ce
cmp dword [ebp - 0x248], 0x226
jne 0x4038ce
cmp dword [ebp - 0x230], 0
je 0x403831
lea eax, [ebp - 0x24c]
mov edx, esi
push eax
push edi
mov ecx, ebx
call fcn.00403a10
add esp, 8
test eax, eax
je 0x4038c7
mov ebx, dword [ebp - 0x24c]
push ebx
mov dword [ebp - 0x230], ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40384a
push 0
push 0
push edi
push esi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
mov dword [ebp - 0x230], ebx
test ebx, ebx
je 0x4038c7
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x250]
push eax
push 0x226
lea eax, [ebp - 0x22c]
push eax
push edi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4038b4
cmp dword [ebp - 0x250], 0x226
jne 0x4038b4
mov ebx, dword [ebp - 0xa]
test ebx, ebx
jne 0x4038b9
mov edi, dword [ebp - 0x254]
lea esi, [ebp - 0x24]
push dword [ebp - 0x230]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4038d3
mov ebx, 0x3ec
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4038d3
mov ebx, 0x3eb
jmp 0x4038d3
mov ebx, 0x3ea
push 0x8000
push 0
push esi
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431ac5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x3e9
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00431ac5
mov esp, ebp
pop ebp
ret