Function at 0x401417
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push 0x104
push 0x44a060
call fcn.00401080
push 0x4493ce
push str.VirtualProtect
push 0x4493d9
call fcn.00401055
push 0x4493d2
push str.OpenMutexA
push 0x4493f8
call fcn.00401055
mov dword [ebp - 0x10], 0x449414
push dword [ebp - 0x10]
push str.Open_File_...
push dword [0x449ad0]
push 0
call fcn.00401e80
mov dword [ebp - 4], eax
cmp byte [eax], 0
je 0x401713
mov byte [0x44a060], 0x22
push dword [ebp - 4]
push 0x44a060
call sub.kernel32.dll_lstrcatA
push str.__REGISTER
push 0x44a060
call sub.kernel32.dll_lstrcatA
mov dword [0x44a3e8], 0
mov dword [0x44a3ec], 0
push 0x44a3ec
push 0x44a3e8
push dword [ebp - 4]
call fcn.00401ef0
mov ecx, dword [0x44a3ec]
mov eax, dword [0x44a3e8]
mov dword [0x449cec], eax
mov dword [0x449cf4], ecx
or eax, eax
je 0x401713
mov edx, dword [0x449cec]
add edx, dword [edx + 0x3c]
mov eax, dword [edx + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x34]
mov dword [ebp - 0xc], eax
add eax, dword [edx + 0x50]
mov dword [ebp - 0x28], eax
push dword [0x449cec]
call sub.kernel32.dll_GlobalFree
mov dword [0x449d24], 0x44
mov dword [0x449d50], 1
mov word [0x449d54], 5
push 0x449d68
push 0x449d24
push 0
push 0
push 4
push 0
push 0
push 0
push 0x44a060
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x401713
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
add eax, ebx
push eax
call fcn.004011b3
push dword [0x4493d2]
call fcn.004011b3
mov ebx, dword [0x449e3c]
push 0
push 4
push 0x44a364
push ebx
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a364]
call fcn.004011b3
mov dword [0x449e28], 1
push 0x449d78
push dword [0x449d6c]
call sub.kernel32.dll_SetThreadContext
push dword [0x4493d2]
call fcn.0040126e
cmp eax, 1
je 0x401623
mov ebx, dword [0x449e3c]
push 0
push 4
push 0x44a364
push ebx
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a044]
push 4
push 0x44926d
push dword [0x44a364]
push dword [0x449d68]
call sub.kernel32.dll_WriteProcessMemory
mov ebx, dword [0x449e3c]
push 0
push 4
push 0x44a364
push ebx
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a364]
call fcn.004011b3
push dword [0x4493ce]
call fcn.004011b3
mov ebx, dword [0x449e3c]
push 0
push 4
push 0x44a364
push ebx
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x44a364]
cmp eax, dword [ebp - 0xc]
jb 0x4015f2
cmp eax, dword [ebp - 0x28]
ja 0x4015f2
mov eax, dword [0x449e3c]
add eax, 4
lea ebx, [ebp - 0x18]
push 0
push 4
push ebx
push eax
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x449e3c]
add eax, 8
lea ebx, [ebp - 0x1c]
push 0
push 4
push ebx
push eax
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
push 4
push 0x1000
push dword [ebp - 0x1c]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [0x449d68]
call sub.kernel32.dll_ReadProcessMemory
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.8B0881E1008000000F95C2
call fcn.00401097
or eax, eax
je 0x4016cb
add eax, dword [ebp - 0x18]
add eax, 0xb
jmp 0x4016de
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.888E____00008B00C1E8112401
call fcn.00401097
add eax, dword [ebp - 0x18]
push eax
call fcn.004011b3
mov dword [0x449e24], 1
mov dword [0x449e20], 1
push 0x449d78
push dword [0x449d6c]
call sub.kernel32.dll_SetThreadContext
push dword [0x449d6c]
call sub.kernel32.dll_ResumeThread
leave
ret 4