Function at 0x401120
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Read file on windows
Resolve function by parsing pe exports
Resume thread
Suspend thread
Terminate process
Use process replacement

Disassembly:
sub esp, 0x5bc
mov eax, dword [0x4164c8]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], eax
call fcn.004010a0
mov ecx, dword [0x419940]
push ecx
call fcn.00401000
add esp, 4
lea edx, [esp + 0x18]
push eax
push 0x4164c4
push edx
call fcn.0040bc31
mov eax, dword [0x4164c8]
add esp, 0xc
lea ecx, [esp + 0x54]
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
call fcn.0040bcc9
push 0
push 0x4164c0
lea ecx, [esp + 0x20]
call fcn.0040b8b9
mov esi, eax
xor edi, edi
cmp esi, 0xffffffff
je 0x4011d2
mov eax, esi
lea ecx, [esp + 0x10]
sub eax, edi
push eax
push edi
push ecx
lea ecx, [esp + 0x24]
call fcn.0040b823
push eax
lea ecx, [esp + 0x58]
mov edx, dword [esp + 0x60]
push edx
call fcn.0040bea5
lea ecx, [esp + 0x10]
call fcn.0040c4e5
lea edi, [esi + 1]
lea ecx, [esp + 0x18]
push edi
push 0x4164c0
call fcn.0040b8b9
mov esi, eax
cmp esi, 0xffffffff
jne 0x40118d
mov eax, dword [esp + 0x18]
cmp edi, dword [eax - 8]
jg 0x401202
lea ecx, [esp + 0x10]
push edi
push ecx
lea ecx, [esp + 0x20]
call fcn.0040b800
push eax
lea ecx, [esp + 0x58]
mov edx, dword [esp + 0x60]
push edx
call fcn.0040bea5
lea ecx, [esp + 0x10]
call fcn.0040c4e5
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x5c]
call fcn.004016b0
push eax
lea ecx, [esp + 0x24]
call fcn.0040c5d2
lea ecx, [esp + 0x10]
call fcn.0040c4e5
lea ecx, [esp + 0x10]
push 1
push ecx
lea ecx, [esp + 0x5c]
call fcn.004016b0
push eax
lea ecx, [esp + 0x34]
call fcn.0040c5d2
lea ecx, [esp + 0x10]
call fcn.0040c4e5
lea edx, [esp + 0x10]
push 2
push edx
lea ecx, [esp + 0x5c]
call fcn.004016b0
push eax
lea ecx, [esp + 0x2c]
call fcn.0040c5d2
lea ecx, [esp + 0x10]
call fcn.0040c4e5
lea eax, [esp + 0x50]
push 3
push eax
lea ecx, [esp + 0x5c]
call fcn.004016b0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 1
mov edx, dword [esp + 0x50]
push ecx
push 0x4164bc
push edx
call fcn.004021da
mov eax, dword [esp + 0x2c]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x68]
push 0
push ecx
lea edx, [esp + 0x8c]
mov esi, eax
push 0x40
push edx
push esi
call edi
push 0
push 0
mov eax, dword [esp + 0xc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x68]
push 0
push ecx
lea edx, [esp + 0x210]
push 0xf8
push edx
push esi
call edi
push esi
mov eax, dword [esp + 0x234]
mov ecx, dword [esp + 0x240]
lea ebp, [eax + ecx]
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xc4]
mov dword [esp + 0x38], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], edx
lea eax, [esp + 0x38]
lea ecx, [esp + 0xc4]
mov dword [esp + 0x40], edx
push eax
push ecx
push edx
push edx
push 4
push edx
push edx
push edx
mov dword [esp + 0x64], edx
push edx
mov edx, dword [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40137a
push 0x10
push 0x41fd48
push str.Not_Find_File_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x40]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
lea ecx, [esp + 0x80]
push 2
mov esi, eax
push ecx
push ebp
push esi
mov byte [esp + 0x2a], 0xeb
mov byte [esp + 0x2b], 0xfe
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
lea edx, [esp + 0x1a]
push 2
push edx
push ebp
push esi
call ebx
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x300], 0x10007
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x300]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp dword [esp + 0x3b8], ebp
jne 0x4013d7
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
push 0
lea eax, [esp + 0x4c]
push 2
push eax
push ebp
push esi
mov dword [esp + 0x88], ebp
call edi
push 0
lea ecx, [esp + 0x1a]
push 2
push ecx
push ebp
push esi
call ebx
push 0
lea edx, [esp + 0x80]
mov eax, dword [esp + 0x14]
push 2
push edx
push eax
push esi
call ebx
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, 1
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x300]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp dword [esp + 0x3b8], ebp
jne 0x40145c
cmp edi, dword [esp + 0x4c]
je 0x4014a3
push 0
lea ecx, [esp + 0x4c]
push 2
push ecx
push ebp
push esi
call ebx
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [esp + 0x1a]
push 2
push edx
push ebp
push esi
call ebx
inc edi
jmp 0x40145c
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x5c]
mov edx, dword [0x4164c8]
stosw word es:[edi], ax
mov eax, 3
mov dword [esp + 0x1c], edx
cmp ecx, eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edx
jle 0x401622
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x108]
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24]
stosw word es:[edi], ax
inc ecx
push ecx
push edx
lea ecx, [esp + 0x5c]
stosb byte es:[edi], al
call fcn.004016b0
push eax
lea ecx, [esp + 0x20]
call fcn.0040c5d2
lea ecx, [esp + 0x6c]
call fcn.0040c4e5
mov eax, dword [esp + 0x1c]
xor edi, edi
mov ebp, dword [eax - 8]
test ebp, ebp
jle 0x401599
lea ebx, [esp + 0x108]
push 2
lea ecx, [esp + 0x74]
push edi
push ecx
lea ecx, [esp + 0x28]
call fcn.0040b823
push eax
lea ecx, [esp + 0x30]
call fcn.0040c5d2
lea ecx, [esp + 0x70]
call fcn.0040c4e5
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
push str._02x
push eax
mov dword [esp + 0x1c], 0
call fcn.004021da
mov cl, byte [esp + 0x1c]
add esp, 0xc
mov byte [ebx], cl
add edi, 2
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
inc ebx
call fcn.0040c6d9
cmp edi, ebp
jl 0x40153d
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x78]
push edx
push eax
lea ecx, [esp + 0x5c]
call fcn.004016b0
push eax
lea ecx, [esp + 0x38]
call fcn.0040c5d2
lea ecx, [esp + 0x78]
call fcn.0040c4e5
mov ecx, dword [esp + 0x34]
push 0x10
push 0
push ecx
call fcn.00401fbe
mov ebx, eax
mov eax, ebp
cdq
sub eax, edx
add esp, 0xc
mov edi, eax
lea edx, [esp + 0x80]
sar edi, 1
push edx
push 0x40
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
lea eax, [esp + 0x10c]
push edi
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x5c]
add eax, 2
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x4014ef
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, dword [esp + 0x74]
push 0
lea ecx, [esp + 0x4c]
push 2
push ecx
push ebp
push esi
call ebx
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]