Function at 0x401250
Capabilities:
Create process on windows
Create process suspended
Get file size
Link many functions at runtime
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x3b8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x401328
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtUnmapViewOfSection
push edi
call esi
push str.NtAllocateVirtualMemory
push edi
mov dword [0x44d9f4], eax
call esi
push str.NtWriteVirtualMemory
push edi
mov dword [0x44d9e4], eax
call esi
push str.NtProtectVirtualMemory
push edi
mov dword [0x44d9f0], eax
call esi
push str.NtResumeThread
push edi
mov dword [0x44d9ec], eax
call esi
push str.NtQueryInformationProcess
push edi
mov dword [0x44d9f8], eax
call esi
push str.NtReadVirtualMemory
push edi
mov dword [0x44d9e0], eax
call esi
cmp dword [0x44d9f4], 0
mov dword [0x44d9e8], eax
je 0x401328
cmp dword [0x44d9e4], 0
je 0x401328
cmp dword [0x44d9f0], 0
je 0x401328
cmp dword [0x44d9ec], 0
je 0x401328
cmp dword [0x44d9f8], 0
je 0x401328
cmp dword [0x44d9e0], 0
je 0x401328
test eax, eax
jne 0x40133a
push str.____Error_loading_functions_from_NTDLL..._n
call fcn.00401010
add esp, 4
call fcn.00412ff0
push 0
call fcn.00412c40
add esp, 4
mov dword [ebp - 0x38c], edx
push eax
call fcn.00406900
add esp, 4
xor esi, esi
call fcn.004068c0
test al, 1
je 0x401363
call fcn.004068c0
inc esi
cmp esi, 0xa
jb 0x401355
xorps xmm0, xmm0
movaps xmmword [ebp - 0x3b0], xmm0
mov dword [ebp - 0x394], esp
lea esp, [ebp - 0x3b0]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push str.C:UsersJohn_source_reposConsoleApplication19ReleaseXXX.exe
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
jne 0x4013ad
xor esi, esi
jmp 0x401427
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
jne 0x4013cc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x401427
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x4013eb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401427
push 0
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x114]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
test eax, eax
jne 0x401421
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x401427
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x401434
cmp dword [ebp - 0x114], 0
jne 0x401446
push str.____Error_reading_PE_file_from_disk..._n
call fcn.00401010
add esp, 4
call fcn.00412ff0
mov eax, 0x5a4d
cmp word [esi], ax
je 0x401462
push str.____Sanity_check_fail_MZ_HEADER..._n
call fcn.00401010
add esp, 4
call fcn.00412ff0
mov edi, dword [esi + 0x3c]
mov eax, 0x14c
add edi, esi
cmp word [edi + 4], ax
je 0x401484
push str.____Only_support_x86_PE_files..._n
call fcn.00401010
add esp, 4
call fcn.00412ff0
cmp dword [edi + 0xc4], 0
je 0x40149f
push str.____Does_not_support_files_already_with_TLS_section..._n
call fcn.00401010
add esp, 4
call fcn.00412ff0
cmp dword [edi + 0xa4], 0
je 0x4014ba
push str.____WARN:_Injection_does_not_work_when_image_is_not_loaded_at_preferred_imagebase..._n
call fcn.00401010
add esp, 4
call fcn.00412ff0
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44
lea eax, [ebp - 0x170]
xorps xmm0, xmm0
push 0
push eax
movaps xmmword [ebp - 0x360], xmm0
call fcn.004033f0
add esp, 0xc
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x170]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401531
push str.____CreateProcess_failed..._n
call fcn.00401010
add esp, 4
call fcn.00412ff0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0
push eax
push 0x18
lea eax, [ebp - 0x380]
xorps xmm0, xmm0
push eax
push 0
push dword [ebp - 0x360]
movaps xmmword [ebp - 0x380], xmm0
movq qword [ebp - 0x370], xmm0
call dword [0x44d9e0]
push 0x1d8
lea eax, [ebp - 0x348]
push 0
push eax
call fcn.004033f0
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x1d8
lea eax, [ebp - 0x348]
push eax
push dword [ebp - 0x37c]
push dword [ebp - 0x360]
call dword [0x44d9e8]
mov eax, dword [edi + 0x34]
mov ecx, esi
mov dword [ebp - 0x34c], eax
mov edx, dword [edi + 0x28]
add edx, eax
call fcn.00401050
mov esi, eax
mov dword [ebp - 0x388], esi
mov edi, dword [esi + 0x3c]
add edi, esi
mov ecx, dword [edi + 0x50]
lea eax, [edi + 0x34]
mov dword [ebp - 0x124], ecx
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x38c], eax
cmp ecx, dword [eax]
jne 0x4015f1
push ecx
push dword [ebp - 0x360]
call dword [0x44d9f4]
push 4
push 0x3000
lea eax, [ebp - 0x124]
push eax
push 0
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x360]
call dword [0x44d9e4]
push 0
push dword [edi + 0x54]
push esi
push dword [ebp - 0x34c]
push dword [ebp - 0x360]
call dword [0x44d9f0]
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x120], 0
mov eax, dword [edi + 0x54]
mov ecx, dword [edi + 0x38]
dec eax
add eax, ecx
neg ecx
and eax, ecx
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x120]
push eax
push 2
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x350]
push eax
push dword [ebp - 0x360]
call dword [0x44d9ec]
movzx esi, word [edi + 0x14]
xor eax, eax
add esi, 0x24
mov dword [ebp - 0x384], 0
cmp ax, word [edi + 6]
jae 0x40174e
add esi, edi
nop word [eax + eax]
mov eax, dword [esi + 8]
add eax, dword [ebp - 0x388]
push 0
push dword [esi + 4]
push eax
mov eax, dword [esi]
add eax, dword [ebp - 0x34c]
push eax
push dword [ebp - 0x360]
call dword [0x44d9f0]
mov eax, dword [esi]
add eax, dword [ebp - 0x34c]
mov dword [ebp - 0x350], eax
mov eax, dword [esi - 4]
mov dword [ebp - 0x118], eax
mov edx, dword [esi + 0x18]
mov ecx, edx
shr ecx, 0x1d
mov eax, edx
shr eax, 0x1e
and ecx, 1
and eax, 1
lea ecx, [eax + ecx*2]
mov eax, edx
shr eax, 0x1f
lea eax, [eax + ecx*2]
mov ecx, dword [eax*4 + 0x44a888]
lea eax, [ebp - 0x120]
push eax
mov eax, ecx
or eax, 0x200
test edx, 0x4000000
cmove eax, ecx
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x350]
push eax
push dword [ebp - 0x360]
call dword [0x44d9ec]
mov ecx, dword [ebp - 0x384]
lea esi, [esi + 0x28]
movzx eax, word [edi + 6]
inc ecx
mov dword [ebp - 0x384], ecx
cmp ecx, eax
jb 0x4016a0
mov eax, dword [ebp - 0x37c]
push 0
push 4
push dword [ebp - 0x38c]
add eax, 8
push eax
push dword [ebp - 0x360]
call dword [0x44d9f0]
push 0
push dword [ebp - 0x35c]
call dword [0x44d9f8]
mov esp, dword [ebp - 0x394]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004017a0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret