Function at 0x4013b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4053f0
push 0x405400
push 0
push 0
push 4
push 1
xorps xmm0, xmm0
mov dword [0x405400], 0x44
push 0
push 0
push 0
push str..ADV.EXE
movlpd qword [0x405404], xmm0
movlpd qword [0x40540c], xmm0
movlpd qword [0x405414], xmm0
movlpd qword [0x40541c], xmm0
movlpd qword [0x405424], xmm0
movlpd qword [0x40542c], xmm0
movlpd qword [0x405434], xmm0
movlpd qword [0x40543c], xmm0
movups xmmword [0x4053f0], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401454
push eax
push eax
push str.Get_Start_Failed__
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push esi
push edi
push 0x2c8
lea eax, [ebp - 0x328]
mov dword [ebp - 0x58], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x32c], 0x1003f
lea eax, [ebp - 0x32c]
push eax
push dword [0x4053f4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0
push 4
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x288]
add eax, 8
push eax
push dword [0x4053f0]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x4014ca
push 0
push 0
push str.Get_BaseImage_Failed__
push 0
call esi
xor edi, edi
jmp 0x4014cd
mov edi, dword [ebp - 0x58]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x50], 0xcda3b6b6
push ecx
push 0x40
push 0x2f
lea eax, [edi + 0x74984]
mov dword [ebp - 0x4c], 0xecd5d0c4
push eax
push dword [0x4053f0]
mov dword [ebp - 0x48], 0xaad2bdcc
mov dword [ebp - 0x44], 0xcbc1a5c8
mov dword [ebp - 0x40], 0xaba1b3a3
mov dword [ebp - 0x3c], 0xc4b5e3c4
mov dword [ebp - 0x38], 0xf8a3f8a3
mov dword [ebp - 0x34], 0xd2ceaca3
mov dword [ebp - 0x30], 0xc2cffeb0
mov dword [ebp - 0x2c], 0xaba1a9bf
mov dword [ebp - 0x28], 0xa1a1a1a1
mov word [ebp - 0x24], 0xa1a1
mov byte [ebp - 0x22], 0x20
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
test eax, eax
jne 0x401554
push 0
push str.VirtualProtectEx_Failed__
jmp 0x401574
push 0x2f
lea eax, [ebp - 0x50]
push eax
lea eax, [edi + 0x74984]
push eax
push dword [0x4053f0]
call ebx
test eax, eax
jne 0x401578
push eax
push eax
push str.WriteProcessMemory_Failed__
push 0
call esi
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x20], 0xadbce0b1
push ecx
push 0x40
lea eax, [edi + 0x74484]
mov dword [ebp - 0x1c], 0xdbc2c0c6
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0x1c
push eax
push dword [0x4053f0]
mov dword [ebp - 0x18], 0xeed7a8a3
mov dword [ebp - 0x14], 0xabc8f3b4
mov dword [ebp - 0x10], 0x6425c7bd
mov dword [ebp - 0xc], 0xfbb7d6d7
mov dword [ebp - 8], 0xa1a1a9a3
mov dword [ebp - 0x5c], eax
call edi
push 0
test eax, eax
jne 0x4015d7
push eax
push str.VirtualProtectEx_Failed__
jmp 0x4015f3
push 0x1c
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x5c]
push dword [0x4053f0]
call ebx
test eax, eax
jne 0x4015f7
push eax
push eax
push str.WriteProcessMemory_Failed__
push 0
call esi
lea eax, [ebp - 0x60]
mov byte [ebp - 0x51], 0x86
push eax
push 0x40
push 1
push 0x42184e
push dword [0x4053f0]
call edi
push 0
test eax, eax
jne 0x40161e
push eax
push str.VirtualProtectEx_Failed__
jmp 0x40163c
push 1
lea eax, [ebp - 0x51]
push eax
push 0x42184e
push dword [0x4053f0]
call ebx
test eax, eax
jne 0x401640
push eax
push eax
push str.WriteProcessMemory_Failed__
push 0
call esi
lea eax, [ebp - 0x60]
mov byte [ebp - 0x52], 0xeb
push eax
push 0x40
push 1
push 0x4067f3
push dword [0x4053f0]
call edi
push 0
test eax, eax
jne 0x401667
push eax
push str.VirtualProtectEx_Failed__
jmp 0x401685
push 1
lea eax, [ebp - 0x52]
push eax
push 0x4067f3
push dword [0x4053f0]
call ebx
test eax, eax
jne 0x401689
push eax
push eax
push str.WriteProcessMemory_Failed__
push 0
call esi
push ecx
call fcn.00401150
add esp, 4
push dword [0x4053f4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [0x4053f0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x4053f4]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004016c7
mov esp, ebp
pop ebp
ret