Function at 0x401417
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push 0x104
push 0x44a750
call fcn.00401080
push 0x449ac2
push str.VirtualProtect
push 0x449acd
call fcn.00401055
push 0x449ac6
push str.OpenMutexA
push 0x449aec
call fcn.00401055
mov dword [ebp - 0x10], 0x449b08
push dword [ebp - 0x10]
push str.Open_File_...
push dword [0x44a1c0]
push 0
call fcn.00401e80
mov dword [ebp - 4], eax
cmp byte [eax], 0
je 0x401713
mov byte [0x44a750], 0x22
push dword [ebp - 4]
push 0x44a750
call sub.kernel32.dll_lstrcatA
push str.__REGISTER
push 0x44a750
call sub.kernel32.dll_lstrcatA
mov dword [0x44aad8], 0
mov dword [0x44aadc], 0
push 0x44aadc
push 0x44aad8
push dword [ebp - 4]
call fcn.00401ef0
mov ecx, dword [0x44aadc]
mov eax, dword [0x44aad8]
mov dword [0x44a3dc], eax
mov dword [0x44a3e4], ecx
or eax, eax
je 0x401713
mov edx, dword [0x44a3dc]
add edx, dword [edx + 0x3c]
mov eax, dword [edx + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [edx + 0x34]
mov dword [ebp - 0xc], eax
add eax, dword [edx + 0x50]
mov dword [ebp - 0x28], eax
push dword [0x44a3dc]
call sub.kernel32.dll_GlobalFree
mov dword [0x44a414], 0x44
mov dword [0x44a440], 1
mov word [0x44a444], 5
push 0x44a458
push 0x44a414
push 0
push 0
push 4
push 0
push 0
push 0
push 0x44a750
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x401713
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
add eax, ebx
push eax
call fcn.004011b3
push dword [0x449ac6]
call fcn.004011b3
mov ebx, dword [0x44a52c]
push 0
push 4
push 0x44aa54
push ebx
push dword [0x44a458]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44aa54]
call fcn.004011b3
mov dword [0x44a518], 1
push 0x44a468
push dword [0x44a45c]
call sub.kernel32.dll_SetThreadContext
push dword [0x449ac6]
call fcn.0040126e
cmp eax, 1
je 0x401623
mov ebx, dword [0x44a52c]
push 0
push 4
push 0x44aa54
push ebx
push dword [0x44a458]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44a734]
push 4
push 0x449961
push dword [0x44aa54]
push dword [0x44a458]
call sub.kernel32.dll_WriteProcessMemory
mov ebx, dword [0x44a52c]
push 0
push 4
push 0x44aa54
push ebx
push dword [0x44a458]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44aa54]
call fcn.004011b3
push dword [0x449ac2]
call fcn.004011b3
mov ebx, dword [0x44a52c]
push 0
push 4
push 0x44aa54
push ebx
push dword [0x44a458]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x44aa54]
cmp eax, dword [ebp - 0xc]
jb 0x4015f2
cmp eax, dword [ebp - 0x28]
ja 0x4015f2
mov eax, dword [0x44a52c]
add eax, 4
lea ebx, [ebp - 0x18]
push 0
push 4
push ebx
push eax
push dword [0x44a458]
call sub.kernel32.dll_ReadProcessMemory
mov eax, dword [0x44a52c]
add eax, 8
lea ebx, [ebp - 0x1c]
push 0
push 4
push ebx
push eax
push dword [0x44a458]
call sub.kernel32.dll_ReadProcessMemory
push 4
push 0x1000
push dword [ebp - 0x1c]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [0x44a458]
call sub.kernel32.dll_ReadProcessMemory
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.8B0881E1008000000F95C2
call fcn.00401097
or eax, eax
je 0x4016cb
add eax, dword [ebp - 0x18]
add eax, 0xb
jmp 0x4016de
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push str.888E____00008B00C1E8112401
call fcn.00401097
add eax, dword [ebp - 0x18]
push eax
call fcn.004011b3
mov dword [0x44a514], 1
mov dword [0x44a510], 1
push 0x44a468
push dword [0x44a45c]
call sub.kernel32.dll_SetThreadContext
push dword [0x44a45c]
call sub.kernel32.dll_ResumeThread
leave
ret 4