Function at 0x401880
Capabilities:
Allocate or change rwx memory
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push edi
mov dword [0x402c80], 0x10003
push 0x402c80
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x4018b2
xor eax, eax
jmp 0x401acf
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
call fcn.00401570
add esp, 4
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x4018d7
xor eax, eax
jmp 0x401acf
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.00401470
add esp, 0x10
test eax, eax
jne 0x4018fe
xor eax, eax
jmp 0x401acf
push 0x110
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x402f5c], eax
cmp dword [0x402f5c], 0
jne 0x401920
xor eax, eax
jmp 0x401acf
push 0x402f68
push 0x40
push 0x110
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x402f4c
push 0x110
mov ecx, dword [0x402f5c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x40197b
mov edx, dword [0x402f5c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401acf
push 0x40289c
push 0x110
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4019b7
mov ecx, dword [0x402f5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401acf
mov ecx, 0xb3
mov esi, 0x402c80
mov edi, 0x4029b0
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x118]
mov dword [0x402a68], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 0x118]
add edx, 0xa
mov dword [0x402f50], edx
mov dword [0x4025d0], 0x10003
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4025d0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [0x402688]
cmp edx, dword [0x402f50]
jne 0x4019fa
mov eax, dword [0x402680]
mov dword [0x402f58], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x40289c
push 0x110
mov eax, dword [0x402f5c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401a71
mov ecx, dword [0x402f5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x401acf
mov edx, dword [0x402f5c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [0x402f68]
push ecx
push 0x110
mov edx, dword [0x402f60]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, dword [ebp - 0x118]
mov dword [0x402d38], edx
push 0x402c80
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x401aca
xor eax, eax
jmp 0x401acf
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret