Function at 0x401417
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push 0x104
push 0x44a540
call fcn.00401080
push 0x4498b4
push str.VirtualProtect
push 0x4498bf
call fcn.00401055
push 0x4498b8
push str.OpenMutexA
push 0x4498dc
call fcn.00401055
mov dword [ebp - 0x10], 0x4498f8
push dword [ebp - 0x10]
push str.Open_File_...
push dword [0x449fb0]
push 0
call fcn.00401e80
mov dword [ebp - 4], eax
cmp byte [eax], 0
je 0x401713
mov byte [0x44a540], 0x22
push dword [ebp - 4]
push 0x44a540
call sub.kernel32.dll_lstrcatA
push str.__REGISTER
push 0x44a540
call sub.kernel32.dll_lstrcatA
mov dword [0x44a8c8], 0
mov dword [0x44a8cc], 0
push 0x44a8cc
push 0x44a8c8
push dword [ebp - 4]
call fcn.00401ef0
mov ecx, dword [0x44a8cc]
mov eax, dword [0x44a8c8]
mov dword [0x44a1cc], eax
mov dword [0x44a1d4], ecx
or eax, eax
je 0x401713
mov edx, dword [0x44a1cc]
add edx, dword [edx + 0x3c]
mov eax, dword [edx + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x34]
mov dword [ebp - 0xc], eax
add eax, dword [edx + 0x50]
mov dword [ebp - 0x28], eax
push dword [0x44a1cc]
call sub.kernel32.dll_GlobalFree
mov dword [0x44a204], 0x44
mov dword [0x44a230], 1
mov word [0x44a234], 5
push 0x44a248
push 0x44a204
push 0
push 0
push 4
push 0
push 0
push 0
push 0x44a540
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x401713
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
add eax, ebx
push eax
call fcn.004011b3
push dword [0x4498b8]
call fcn.004011b3
mov ebx, dword [0x44a31c]
push 0
push 4
push 0x44a844
push ebx
push dword [0x44a248]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a844]
call fcn.004011b3
mov dword [0x44a308], 1
push 0x44a258
push dword [0x44a24c]
call sub.kernel32.dll_SetThreadContext
push dword [0x4498b8]
call fcn.0040126e
cmp eax, 1
je 0x401623
mov ebx, dword [0x44a31c]
push 0
push 4
push 0x44a844
push ebx
push dword [0x44a248]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a524]
push 4
push 0x449753
push dword [0x44a844]
push dword [0x44a248]
call sub.kernel32.dll_WriteProcessMemory
mov ebx, dword [0x44a31c]
push 0
push 4
push 0x44a844
push ebx
push dword [0x44a248]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a844]
call fcn.004011b3
push dword [0x4498b4]
call fcn.004011b3
mov ebx, dword [0x44a31c]
push 0
push 4
push 0x44a844
push ebx
push dword [0x44a248]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x44a844]
cmp eax, dword [ebp - 0xc]
jb 0x4015f2
cmp eax, dword [ebp - 0x28]
ja 0x4015f2
mov eax, dword [0x44a31c]
add eax, 4
lea ebx, [ebp - 0x18]
push 0
push 4
push ebx
push eax
push dword [0x44a248]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x44a31c]
add eax, 8
lea ebx, [ebp - 0x1c]
push 0
push 4
push ebx
push eax
push dword [0x44a248]
call sub.kernel32.dll_ReadProcessMemory
push 4
push 0x1000
push dword [ebp - 0x1c]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [0x44a248]
call sub.kernel32.dll_ReadProcessMemory
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.8B0881E1008000000F95C2
call fcn.00401097
or eax, eax
je 0x4016cb
add eax, dword [ebp - 0x18]
add eax, 0xb
jmp 0x4016de
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.888E____00008B00C1E8112401
call fcn.00401097
add eax, dword [ebp - 0x18]
push eax
call fcn.004011b3
mov dword [0x44a304], 1
mov dword [0x44a300], 1
push 0x44a258
push dword [0x44a24c]
call sub.kernel32.dll_SetThreadContext
push dword [0x44a24c]
call sub.kernel32.dll_ResumeThread
leave
ret 4