Function at 0x401230
Capabilities:
Create process on windows
Enumerate process modules
Resume thread
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402d4b
mov eax, dword fs:[0]
push eax
mov eax, 0x1130
call fcn.00402c50
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x112c], 0x1ad13d4a
mov dword [ebp - 0x1128], 0x173480e2
mov dword [ebp - 0x1124], 0x1edb3c21
mov edi, dword [eax]
mov byte [ebp - 0x1120], 0x95
mov eax, dword [edi + 0xe8]
test al, 1
jne 0x4012ff
or eax, 1
mov dword [edi + 0xe8], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x111c], xmm0
mov edx, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x111c]
mov byte [edi + 0x135], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x112c]
mov byte [ecx + edi + 0x128], al
add ecx, 1
adc edx, 0
jne 0x4012eb
cmp ecx, 0xd
jb 0x4012d0
push 0x402f70
call fcn.00401d94
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [edi + 0x128]
mov ecx, esi
call fcn.00401c20
push 0x405464
push 0x405028
push 0
push 0
push 0x100430
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4013da
movaps xmm0, xmmword [0x403210]
mov eax, dword [edi + 0xa0]
mov dword [ebp - 0x1128], 0x4a7b0b5b
mov dword [ebp - 0x1124], 0x90e2489e
mov word [ebp - 0x1120], 0x7b55
movups xmmword [ebp - 0x1138], xmm0
test al, 1
jne 0x4013c8
or eax, 1
mov dword [edi + 0xa0], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x111c], xmm0
mov edx, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x111c]
mov byte [edi + 0xd2], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x1138]
mov byte [ecx + edi + 0xb8], al
add ecx, 1
adc edx, 0
jne 0x4013bb
cmp ecx, 0x1a
jb 0x4013a0
push 0x402f30
call fcn.00401d94
add esp, 4
lea esi, [edi + 0xb8]
mov ecx, esi
call fcn.00401bc0
jmp 0x4018b5
push 0xffffffffffffffff
push dword [0x405464]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [0x405468]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [edi + 0x124]
mov dword [ebp - 0x112c], 0xc20f7b96
mov dword [ebp - 0x1128], 0x852ebcca
mov dword [ebp - 0x1124], 0xc6057afd
mov byte [ebp - 0x1120], 0xbd
test al, 1
jne 0x401480
or eax, 1
mov dword [edi + 0x124], eax
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movlpd qword [ebp - 0x111c], xmm0
mov edx, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x111c]
mov byte [edi + 0xb1], 1
mov al, byte [ebp + ecx - 0x112c]
mov byte [ecx + edi + 0xa4], al
add ecx, 1
adc edx, 0
jne 0x40146c
cmp ecx, 0xd
jb 0x401451
push 0x402ef0
call fcn.00401d94
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ebx, [edi + 0xa4]
mov ecx, ebx
call fcn.00401b60
lea eax, [ebp - 0x1118]
push eax
push 0x1000
lea eax, [ebp - 0x1114]
push eax
push dword [0x405464]
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x401564
xor esi, esi
test dword [ebp - 0x1118], 0xfffffffc
jbe 0x401564
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp + esi*4 - 0x1114]
push dword [0x405464]
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x401552
push 0x104
call fcn.00401d0e
lea eax, [ebp - 0x114]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
inc eax
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 0x14
test eax, eax
jne 0x401552
push 0xc
lea eax, [ebp - 0x112c]
push eax
push dword [ebp + esi*4 - 0x1114]
push dword [0x405464]
call dword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x401564
mov eax, dword [ebp - 0x112c]
mov dword [0x405478], eax
mov eax, dword [ebp - 0x1128]
mov dword [0x405474], eax
mov eax, dword [ebp - 0x1118]
inc esi
shr eax, 2
cmp esi, eax
jb 0x4014d0
cmp dword [0x405478], 0
jne 0x40162a
push 0
push dword [0x405464]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
movaps xmm0, xmmword [0x403220]
mov eax, dword [edi + 0x10c]
mov dword [ebp - 0x112c], 0x5314f091
mov dword [ebp - 0x1128], 0xefea97fc
mov dword [ebp - 0x1124], 0x5208fcd3
mov word [ebp - 0x1120], 0xfba7
movups xmmword [ebp - 0x113c], xmm0
test al, 1
jne 0x401618
or eax, 1
mov dword [edi + 0x10c], eax
mov dword [ebp - 4], 3
xorps xmm0, xmm0
movlpd qword [ebp - 0x111c], xmm0
mov edx, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x111c]
mov byte [edi + 0x10a], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x113c]
mov byte [ecx + edi + 0xec], al
add ecx, 1
adc edx, 0
jne 0x40160b
cmp ecx, 0x1e
jb 0x4015f0
push 0x402eb0
call fcn.00401d94
add esp, 4
lea esi, [edi + 0xec]
mov ecx, esi
call fcn.00401b00
jmp 0x4018b5
push 5
call fcn.00401d0e
mov ecx, dword [0x405478]
add esp, 4
mov esi, eax
add ecx, 0x998413
push 0
push 5
push esi
push ecx
push dword [0x405464]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x401824
mov edx, esi
xor ecx, ecx
sub edx, 0x405020
nop word [eax + eax]
mov al, byte [ecx + edx + 0x405020]
cmp al, byte [ecx + 0x405020]
jne 0x40181b
inc ecx
cmp ecx, 5
jb 0x401670
push esi
call fcn.00401d09
add esp, 4
call fcn.004018f0
mov esi, eax
mov ecx, esi
call fcn.00401a40
mov ecx, esi
call section..text
test eax, eax
jne 0x401760
movaps xmm0, xmmword [0x403230]
mov eax, dword [edi + 0x9c]
mov word [ebp - 0x1124], 0x4bb3
mov byte [ebp - 0x1122], 0x79
movups xmmword [ebp - 0x1134], xmm0
test al, 1
jne 0x401738
or eax, 1
mov dword [edi + 0x9c], eax
mov dword [ebp - 4], 5
xorps xmm0, xmm0
movlpd qword [ebp - 0x111c], xmm0
mov edx, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x111c]
mov byte [edi + 0xe7], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x1134]
mov byte [ecx + edi + 0xd4], al
add ecx, 1
adc edx, 0
jne 0x40172b
cmp ecx, 0x13
jb 0x401710
push 0x402df0
call fcn.00401d94
add esp, 4
lea esi, [edi + 0xd4]
mov ecx, esi
call fcn.004019e0
push 0x30
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push dword [0x405464]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x405478]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add eax, 0x2b7cc6
push 0
push 1
push 0x40501f
push eax
push dword [0x405464]
call esi
mov eax, dword [0x405478]
push 0
push 7
push 0x405018
add eax, 0x3dbad2
push eax
push dword [0x405464]
call esi
mov eax, dword [0x405478]
push 0
push 7
push 0x40506c
add eax, 0x4e4982
push eax
push dword [0x405464]
call esi
mov eax, dword [0x405478]
push 0
push 1
push 0x405025
add eax, 0x54c538
push eax
push dword [0x405464]
call esi
mov eax, dword [0x405478]
push 0
push 2
push 0x405074
add eax, 0x54c725
push eax
push dword [0x405464]
call esi
push dword [0x405468]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [0x405464]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x405468]
call esi
xor eax, eax
jmp 0x4018c7
push esi
call fcn.00401d09
add esp, 4
push 0
push dword [0x405464]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
movaps xmm0, xmmword [0x403260]
mov eax, dword [edi + 0x98]
mov byte [ebp - 0x1120], 0x19
movups xmmword [ebp - 0x1130], xmm0
test al, 1
jne 0x4018a8
or eax, 1
mov dword [edi + 0x98], eax
mov dword [ebp - 4], 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x111c], xmm0
mov edx, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x111c]
mov byte [edi + 0x121], 1
nop
mov al, byte [ebp + ecx - 0x1130]
mov byte [ecx + edi + 0x110], al
add ecx, 1
adc edx, 0
jne 0x40189b
cmp ecx, 0x11
jb 0x401880
push 0x402e70
call fcn.00401d94
add esp, 4
lea esi, [edi + 0x110]
mov ecx, esi
call fcn.00401aa0
push 0x30
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401cfb
mov esp, ebp
pop ebp
ret