Function at 0x401417
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push 0x104
push 0x449370
call fcn.00401080
push 0x4486d9
push str.VirtualProtect
push 0x4486e4
call fcn.00401055
push 0x4486dd
push str.OpenMutexA
push 0x448704
call fcn.00401055
mov dword [ebp - 0x10], 0x448720
push dword [ebp - 0x10]
push str.Open_File_...
push dword [0x448de0]
push 0
call fcn.00401e80
mov dword [ebp - 4], eax
cmp byte [eax], 0
je 0x401713
mov byte [0x449370], 0x22
push dword [ebp - 4]
push 0x449370
call sub.kernel32.dll_lstrcatA
push str.__REGISTER
push 0x449370
call sub.kernel32.dll_lstrcatA
mov dword [0x4496f8], 0
mov dword [0x4496fc], 0
push 0x4496fc
push 0x4496f8
push dword [ebp - 4]
call fcn.00401ef0
mov ecx, dword [0x4496fc]
mov eax, dword [0x4496f8]
mov dword [0x448ffc], eax
mov dword [0x449004], ecx
or eax, eax
je 0x401713
mov edx, dword [0x448ffc]
add edx, dword [edx + 0x3c]
mov eax, dword [edx + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x34]
mov dword [ebp - 0xc], eax
add eax, dword [edx + 0x50]
mov dword [ebp - 0x28], eax
push dword [0x448ffc]
call sub.kernel32.dll_GlobalFree
mov dword [0x449034], 0x44
mov dword [0x449060], 1
mov word [0x449064], 5
push 0x449078
push 0x449034
push 0
push 0
push 4
push 0
push 0
push 0
push 0x449370
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x401713
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
add eax, ebx
push eax
call fcn.004011b3
push dword [0x4486dd]
call fcn.004011b3
mov ebx, dword [0x44914c]
push 0
push 4
push 0x449674
push ebx
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x449674]
call fcn.004011b3
mov dword [0x449138], 1
push 0x449088
push dword [0x44907c]
call sub.kernel32.dll_SetThreadContext
push dword [0x4486dd]
call fcn.0040126e
cmp eax, 1
je 0x401623
mov ebx, dword [0x44914c]
push 0
push 4
push 0x449674
push ebx
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x449354]
push 4
push 0x448578
push dword [0x449674]
push dword [0x449078]
call sub.kernel32.dll_WriteProcessMemory
mov ebx, dword [0x44914c]
push 0
push 4
push 0x449674
push ebx
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x449674]
call fcn.004011b3
push dword [0x4486d9]
call fcn.004011b3
mov ebx, dword [0x44914c]
push 0
push 4
push 0x449674
push ebx
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x449674]
cmp eax, dword [ebp - 0xc]
jb 0x4015f2
cmp eax, dword [ebp - 0x28]
ja 0x4015f2
mov eax, dword [0x44914c]
add eax, 4
lea ebx, [ebp - 0x18]
push 0
push 4
push ebx
push eax
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x44914c]
add eax, 8
lea ebx, [ebp - 0x1c]
push 0
push 4
push ebx
push eax
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
push 4
push 0x1000
push dword [ebp - 0x1c]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [0x449078]
call sub.kernel32.dll_ReadProcessMemory
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.8B0881E1008000000F95C2
call fcn.00401097
or eax, eax
je 0x4016cb
add eax, dword [ebp - 0x18]
add eax, 0xb
jmp 0x4016de
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.888E____00008B00C1E8112401
call fcn.00401097
add eax, dword [ebp - 0x18]
push eax
call fcn.004011b3
mov dword [0x449134], 1
mov dword [0x449130], 1
push 0x449088
push dword [0x44907c]
call sub.kernel32.dll_SetThreadContext
push dword [0x44907c]
call sub.kernel32.dll_ResumeThread
leave
ret 4