Function at 0x401570
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Get common file path
Inject thread
Resume thread
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
sub esp, 0x724
mov eax, dword [0x4436f0]
xor eax, esp
mov dword [esp + 0x720], eax
push esi
push edi
push 0x3c
lea eax, [esp + 0x24]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x28], 0
call fcn.00421af0
push 0x2c4
lea ecx, [esp + 0x74]
push 0
push ecx
mov dword [esp + 0x74], 0x10007
mov dword [esp + 0x78], 0
call fcn.00421af0
add esp, 0x18
lea edx, [esp + 0x528]
push edx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x501
call fcn.0040216e
add esp, 4
mov esi, eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
push 0
push 4
push 0
push 0
push 0
push 0x447790
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401814
push 0x200
lea edx, [esp + 0x32c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec eax
test eax, eax
jle 0x40164a
mov cl, 0x5c
cmp byte [esp + eax + 0x328], cl
je 0x401642
dec eax
test eax, eax
jg 0x401632
jmp 0x40164a
mov byte [esp + eax + 0x328], 0
push ebp
push str.xxxxxx.dll
lea eax, [esp + 0x330]
push 0x200
push eax
call fcn.00420ab0
mov ecx, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add esp, 0xc
push 0x40
push 0x3000
push 0x500
push 0
push ecx
call ebp
mov edi, eax
test edi, edi
je 0x401799
mov edx, dword [esp + 0xc]
push 0x40
push 0x3000
push 0x50
push 0
push edx
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x60]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x110]
lea edx, [esp + 0x60]
push edx
push eax
mov dword [esp + 0x118], edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x401799
push 0x500
push 0
push esi
call fcn.00421af0
push 0x400
push 0x4449f0
push 0x500
push esi
call fcn.0042078f
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [method.CApp.virtual_40], edi
mov dword [0x444e01], ecx
mov dword [method.CApp.virtual_40], edi
mov dword [esi + 0x29], eax
mov dword [esi + 0x4b], eax
lea eax, [esp + 0x348]
mov dword [esi + 0xd], edx
add esp, 0x1c
mov dword [esi + 0x61], ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401730
sub eax, edx
lea ecx, [esp + 0x32c]
push ecx
inc eax
push eax
lea edx, [esi + 0x6b]
push edx
call fcn.0042080c
push str.InitGameWindow
lea eax, [esi + 0x200]
push 0xf
push eax
call fcn.0042080c
push str.ProcMain
lea ecx, [esi + 0x250]
push 9
push ecx
call fcn.0042080c
mov edx, dword [esp + 0x30]
add esp, 0x24
push 0
push 0x500
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4017b4
push eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x720]
xor ecx, esp
call fcn.004205f1
add esp, 0x724
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
add edi, 0x300
push edi
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop ebp
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x720]
xor ecx, esp
call fcn.004205f1
add esp, 0x724
ret
push esi
call fcn.00402163
mov ecx, dword [esp + 0x72c]
add esp, 4
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004205f1
add esp, 0x724
ret