Function at 0x402370
Capabilities:
Create process on windows
Create process suspended
Inject apc
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd3c
mov eax, dword [0x4607a0]
xor eax, ebp
mov dword [ebp - 0x64], eax
xor eax, eax
mov word [ebp - 0xb20], ax
push 0x206
push 0
lea ecx, [ebp - 0xb1e]
push ecx
call fcn.0043f140
add esp, 0xc
xor edx, edx
mov word [ebp - 0xe8], dx
push 0x7e
push 0
lea eax, [ebp - 0xe6]
push eax
call fcn.0043f140
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0xb20]
push edx
call fcn.00403200
lea eax, [ebp - 0xb20]
push eax
call fcn.00413300
add esp, 4
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0x90c], 0
jne 0x402401
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0xffffffff
xor eax, eax
jmp 0x402675
mov edx, dword [ebp - 0x90c]
push edx
push 0x40
lea eax, [ebp - 0xe8]
push eax
call fcn.00403200
xor ecx, ecx
mov edx, dword [ebp - 0x90c]
mov word [edx], cx
push 0x820
push 0
lea eax, [ebp - 0x908]
push eax
call fcn.0043f140
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x402460
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x453630
push 0x410
lea eax, [ebp - 0x908]
push eax
call fcn.004032b0
add esp, 0x14
jmp 0x40247d
mov ecx, dword [ebp + 8]
push ecx
push 0x453640
push 0x410
lea edx, [ebp - 0x908]
push edx
call fcn.004032b0
add esp, 0x10
xor eax, eax
mov word [ebp - 0xd30], ax
push 0x206
push 0
lea ecx, [ebp - 0xd2e]
push ecx
call fcn.0043f140
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x4024d2
lea edx, [ebp - 0xb20]
push edx
push 0x104
lea eax, [ebp - 0xd30]
push eax
call fcn.00403200
push 0x45364c
push 0x104
lea ecx, [ebp - 0xd30]
push ecx
call fcn.00403250
jmp 0x4024e7
mov edx, dword [ebp + 0x10]
push edx
push 0x104
lea eax, [ebp - 0xd30]
push eax
call fcn.00403200
mov dword [ebp - 0x50], 0
push 0x40
push 0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0043f140
add esp, 0xc
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x60], 0
xor edx, edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [ebp - 0x908]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 0
jne 0x40255c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x910]
jmp 0x402675
lea ecx, [ebp - 0xd30]
push ecx
call fcn.0043f226
add esp, 4
lea edx, [eax + eax + 2]
mov dword [ebp - 0x914], edx
push 4
push 0x1000
mov eax, dword [ebp - 0x914]
push eax
push 0
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xb24], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0xb24], 0
je 0x40262b
mov dword [ebp - 0xd34], 0
lea edx, [ebp - 0xd34]
push edx
mov eax, dword [ebp - 0x914]
push eax
lea ecx, [ebp - 0xd30]
push ecx
mov edx, dword [ebp - 0xb24]
push edx
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 0
jne 0x4025f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402629
mov ecx, dword [ebp - 0xb24]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov dword [ebp - 0xd38], eax
cmp dword [ebp - 0xd38], 0
jne 0x40261e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402629
mov dword [ebp - 4], 1
xor ecx, ecx
jne 0x4025a9
jmp 0x402631
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], 1
jne 0x402643
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40265e
mov dword [ebp - 0xd3c], 0
mov eax, dword [ebp - 0xd3c]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.0043ec15
mov esp, ebp
pop ebp
ret