Function at 0x411ea1
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004f8af0
mov eax, dword [0x5498f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor ecx, ecx
xor ebx, ebx
push edi
mov word [ebp - 0x3ec], cx
mov edi, 0x1f4
cmp eax, ebx
je 0x411efc
cmp dword [ebp + 0xc], ebx
jl 0x411efc
push edi
lea ecx, [ebp - 0x3ec]
push ecx
push 0x12
push dword [ebp + 0xc]
push eax
call fcn.004037cb
add esp, 0x14
cmp word [ebp - 0x3ec], bx
jne 0x411f12
mov eax, dword [0x55adcc]
mov eax, dword [eax + 0x44]
push edi
add eax, 0x14
push eax
lea eax, [ebp - 0x3ec]
push eax
call esi
push edi
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0xfa4]
push eax
call esi
lea eax, [ebp - 0xfa4]
push 0x5c
push eax
call fcn.004f83b4
pop ecx
pop ecx
cmp eax, ebx
je 0x412270
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0xfb8], ebx
lea edi, [ebp - 0xfb4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xfb8]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0xfa4]
push eax
push ebx
push 4
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3ec]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x412270
mov eax, dword [0x55adcc]
mov eax, dword [eax + 0x44]
cmp dword [eax + 0x5fc], ebx
jne 0x4120f3
xor eax, eax
mov edi, 0x3e6
push edi
mov word [ebp - 0x7d4], ax
lea eax, [ebp - 0x7d2]
push ebx
push eax
call fcn.004f8f00
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x7d4]
push 0x531880
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x40
lea esi, [eax + eax + 4]
push 0x1000
lea eax, [esi + 0x14]
push eax
push ebx
push dword [ebp - 0xfb8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xfc0], eax
cmp eax, ebx
je 0x4120f3
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [ebp - 0x7d4]
push ecx
push eax
push dword [ebp - 0xfb8]
call esi
test eax, eax
je 0x4120f3
xor eax, eax
push edi
mov word [ebp - 0xbbc], ax
lea eax, [ebp - 0xbba]
push ebx
push eax
call fcn.004f8f00
mov eax, dword [0x55adcc]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x830]
add esp, 0xc
mov dword [ebp - 0xfa8], eax
cmp eax, ebx
je 0x4120ca
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebx
push 4
lea eax, [ebp - 0xfa8]
push eax
push eax
push dword [ebp - 0xfb8]
call edi
test eax, eax
je 0x4120ca
cmp dword [ebp - 0xfa8], ebx
je 0x4120ca
push ebx
push 0x1f3
lea eax, [ebp - 0xbbc]
push eax
push dword [ebp - 0xfa8]
push dword [ebp - 0xfb8]
call edi
test eax, eax
je 0x4120ca
cmp word [ebp - 0xbbc], bx
je 0x4120ca
jmp 0x4120b3
lea eax, [ebp - 0xbbc]
push str.XAJHElementClient_Multiple_Instance_Tag_Name
push eax
call fcn.004f83e2
pop ecx
pop ecx
test eax, eax
jne 0x4120cf
xor eax, eax
inc eax
jmp 0x4120d1
mov eax, ebx
push ebx
push 4
lea ecx, [ebp - 0xfc0]
push ecx
mov ecx, dword [0x55adcc]
mov ecx, dword [ecx + 0x40]
push dword [ecx + eax*4 + 0x830]
push dword [ebp - 0xfb8]
call esi
push dword [ebp - 0xfb4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x55adcc]
mov eax, dword [eax + 0x3c]
mov edi, dword [ebp - 0xfb8]
add eax, 0x1388
push eax
call fcn.004028e4
mov esi, eax
pop ecx
mov dword [ebp - 0xfbc], esi
cmp esi, ebx
je 0x41224d
push dword [ebp - 0xfb0]
lea eax, [ebp - 0x7d4]
push 0x531d84
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x7d4]
push 0x3f40
push eax
call fcn.0040166a
add esp, 0x14
cmp eax, ebx
je 0x412248
mov edi, dword [eax + 4]
mov esi, dword [ebp + 0xc]
push ebx
mov dword [edi + 0x3f4], eax
mov dword [edi + 4], esi
call fcn.004f8821
mov dword [edi + 0x428], eax
pop ecx
lea eax, [edi + 0x430]
push eax
mov dword [edi + 0x42c], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [edi + 0x43c]
push eax
movzx eax, word [edi + 0x43a]
push eax
movzx eax, word [edi + 0x438]
push eax
movzx eax, word [edi + 0x436]
push eax
push str._02d__02d:_02d:_02d
lea eax, [edi + 0x440]
push 0x64
push eax
call fcn.004f7833
mov eax, dword [ebp - 0xfb8]
mov dword [edi + 0x408], eax
mov eax, dword [ebp - 0xfb4]
mov dword [edi + 0x40c], eax
mov eax, dword [ebp - 0xfb0]
mov dword [edi + 0x410], eax
mov eax, dword [0x55adcc]
mov ecx, dword [eax + 0x34]
mov ecx, dword [ecx]
add esp, 0x1c
mov dword [edi + 0x400], ecx
cmp esi, ebx
jl 0x41220f
mov eax, dword [eax + 0x48]
mov edx, dword [eax + 8]
lea ecx, [edi + 0x968]
push ecx
mov ecx, esi
call fcn.004108bc
pop ecx
cmp byte [edi + 0x1280], bl
jne 0x412224
lea eax, [edi + 0x3ce4]
push eax
call fcn.0040e600
pop ecx
mov esi, dword [ebp - 0xfbc]
push 0x2710
push dword [esi + 8]
call fcn.00402382
pop ecx
pop ecx
call fcn.0040299e
mov dword [edi], 1
mov eax, edi
jmp 0x412272
call fcn.0040299e
push ebx
push dword [ebp - 0xfb8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0xfb4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xfb8]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f7824
leave
ret