Function at 0x41f5a8
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x41c70c
call fcn.0040beec
xor eax, eax
push ebp
push 0x41fc04
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [0x427d4c]
push eax
call sub.user32.dll_WaitForInputIdle
mov eax, 0x41fc10
mov dword [0x427da0], eax
mov eax, 0x427d4c
xor ecx, ecx
mov edx, 0x10
call fcn.00404978
mov eax, 0x427d5c
xor ecx, ecx
mov edx, 0x44
call fcn.00404978
mov dword [0x427d5c], 0x44
push 0x427d4c
push 0x427d5c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x427da0]
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x41f64b
push 4
push 0x3000
push 4
push 0
mov eax, dword [0x427dac]
push eax
call sub.kernel32.dll_VirtualAllocEx
push 0x427da8
push 0x40
push 1
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
call sub.kernel32.dll_VirtualProtect
push 0xffffffffffffffff
mov eax, dword [0x427d4c]
push eax
call sub.user32.dll_WaitForInputIdle
lea eax, [ebp - 0x14]
mov edx, dword [0x427da0]
call fcn.00407048
mov edx, dword [ebp - 0x14]
mov eax, dword [0x427d54]
call fcn.0041c500
mov dword [0x427d40], eax
cmp dword [0x427d40], 0
jne 0x41f6aa
mov eax, dword [0x427d54]
call fcn.0041c6d4
jmp 0x41fbec
push 0xffffffffffffffff
mov eax, dword [0x427d4c]
push eax
call sub.user32.dll_WaitForInputIdle
mov dword [0x427d48], 0x39eb48
mov byte [0x427d44], 0xeb
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x32d98e
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x32d98f
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x32d990
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x32d991
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x32d992
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x32d993
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x334f63
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x334f64
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x334f6f
mov byte [0x427d44], 0xeb
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37600d
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37600e
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37602d
mov byte [0x427d44], 0xe9
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37602e
mov byte [0x427d44], 0x63
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37602f
mov byte [0x427d44], 1
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x376030
mov byte [0x427d44], 0
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x376032
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37c2a8
mov byte [0x427d44], 0xeb
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37c2b9
mov byte [0x427d44], 0xe9
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37c2ba
mov byte [0x427d44], 0x25
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37c2bb
mov byte [0x427d44], 2
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37c2bc
mov byte [0x427d44], 0
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37c2be
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37c2da
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [0x427d48], 0x37c2db
mov byte [0x427d44], 0x90
push 0x427da4
push 1
push 0x427d44
mov eax, dword [0x427d40]
add eax, dword [0x427d48]
push eax
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov eax, dword [0x427d50]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [0x427d50]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x427d4c]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fc0b
lea eax, [ebp - 0x14]
call fcn.00406abc
pop eax
jmp eax