Function at 0x402040
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create thread
Inject dll
Inject thread
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4087b2
mov eax, dword fs:[0]
push eax
sub esp, 0x574
mov eax, dword [0x40d04c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x46c], 0
cmp edi, 3
jge 0x40208a
or eax, 0xffffffff
jmp 0x4026ef
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov byte [ebp - 0x448], 0
push 0x40
mov byte [ebp - 4], 1
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
call fcn.0040790c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
lea eax, [ebp - 0x468]
mov dword [ebp - 4], 2
push eax
mov eax, dword [esi + 4]
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x18], eax
mov ecx, eax
mov dword [edx], 0
lea eax, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov dword [ebp - 0x46c], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402160
sub ecx, dword [ebp - 0x46c]
push ecx
push dword [ebp - 0x18]
mov ecx, edx
call fcn.00401a30
call fcn.00405e70
add esp, 0x1c
test al, al
jne 0x4021b3
push 0x4012d0
push str.Failed_to_load_data.
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call section..text
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 0x46c], 0
jmp 0x402493
lea ecx, [ebp - 0x4d4]
mov dword [ebp - 0x53c], 0x4092ac
mov dword [ebp - 0x52c], 0x4092b4
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
lea eax, [ebp - 0x524]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x46c], 1
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char____]
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 4], 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x53c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x540], eax
lea ecx, [ebp - 0x524]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4e8], 0
movzx eax, byte [ebp - 0x448]
push str._0_0
push eax
push str._sro_client.exe_0__
push dword [esi + 4]
lea eax, [ebp - 0x52c]
mov byte [ebp - 4], 5
push eax
call section..text
add esp, 8
push eax
call section..text
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
push eax
call section..text
xorps xmm0, xmm0
mov dword [ebp - 0x580], 0x44
add esp, 8
movlpd qword [ebp - 0x57c], xmm0
movlpd qword [ebp - 0x574], xmm0
movlpd qword [ebp - 0x56c], xmm0
movlpd qword [ebp - 0x564], xmm0
movlpd qword [ebp - 0x55c], xmm0
movlpd qword [ebp - 0x554], xmm0
movlpd qword [ebp - 0x54c], xmm0
movlpd qword [ebp - 0x544], xmm0
movups xmmword [ebp - 0x480], xmm0
mov edx, dword [ebp - 0x4e8]
mov eax, edx
and al, 0x22
mov dword [ebp - 0x430], 0
mov byte [ebp - 4], 6
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0xf
mov byte [ebp - 0x430], 0
mov dword [ebp - 0x46c], 5
movq qword [ebp - 0x48c], xmm0
mov dword [ebp - 0x484], 0
cmp al, 2
je 0x40235c
mov eax, dword [ebp - 0x504]
mov ecx, dword [eax]
test ecx, ecx
je 0x40235c
mov eax, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0x4ec]
cmovb ecx, dword [ebp - 0x4ec]
mov edx, dword [eax]
sub ecx, edx
jmp 0x40238d
test dl, 4
jne 0x402381
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax]
test ecx, ecx
je 0x402381
mov eax, dword [ebp - 0x518]
mov edx, dword [eax]
sub ecx, edx
mov eax, dword [ebp - 0x4f8]
add ecx, dword [eax]
jmp 0x40238d
mov ecx, dword [ebp - 0x488]
mov edx, dword [ebp - 0x48c]
test edx, edx
je 0x40239e
push ecx
push edx
lea ecx, [ebp - 0x430]
call fcn.00401a30
cmp dword [ebp - 0x41c], 0x10
lea ecx, [ebp - 0x480]
push ecx
lea ecx, [ebp - 0x580]
push ecx
push dword [esi + 4]
lea eax, [ebp - 0x430]
cmovae eax, dword [ebp - 0x430]
push 0
push 4
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 0x41c]
test eax, eax
setne al
mov byte [ebp - 0x46d], al
cmp ecx, 0x10
jb 0x402423
mov edx, dword [ebp - 0x430]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402413
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402413
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040793c
mov al, byte [ebp - 0x46d]
add esp, 8
test al, al
jne 0x402587
push 0x10
push str.Fatal_Error
push str.Could_not_start__sro_client.exe_.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x53c]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x53c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x540], eax
lea ecx, [ebp - 0x524]
call fcn.004014c0
lea ecx, [ebp - 0x51c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x4d4]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [ebp - 0x438]
push dword [eax + 4]
lea eax, [ebp - 0x438]
push eax
mov ecx, eax
call fcn.004011f0
push 0x40
push dword [ebp - 0x438]
call fcn.0040793c
mov esi, dword [ebp - 0x444]
add esp, 8
test esi, esi
je 0x402549
mov edi, dword [ebp - 0x440]
cmp esi, edi
je 0x4024e8
push 0
mov ecx, esi
call fcn.00401840
add esi, 0x24
cmp esi, edi
jne 0x4024d2
mov esi, dword [ebp - 0x444]
mov ecx, dword [ebp - 0x43c]
mov eax, 0x38e38e39
sub ecx, esi
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*8]
mov eax, esi
shl ecx, 2
cmp ecx, 0x1000
jb 0x402521
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402581
push ecx
push esi
call fcn.0040793c
add esp, 8
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov ecx, dword [ebp - 0x454]
cmp ecx, 0x10
jb 0x4026e9
mov edx, dword [ebp - 0x468]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4026df
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4026df
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
cmp edi, 4
jne 0x4025a9
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push 0
mov byte [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
lea eax, [ebp - 0x418]
push eax
push 0x400
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x40243f
push dword [ebp - 0x478]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40243f
push str.LoadLibraryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40243f
lea ecx, [ebp - 0x418]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402610
push 4
push 0x3000
sub ecx, edx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x40243f
lea ecx, [ebp - 0x418]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402640
push 0
sub ecx, edx
lea eax, [ebp - 0x418]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40243f
push 0
push 0
push esi
push dword [ebp - 0x18]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40243f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x418]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402693
push 0x8000
sub ecx, edx
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
push dword [ebp - 0x47c]
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
call esi
push dword [ebp - 0x480]
call esi
mov esi, dword [ebp - 0x478]
mov dword [ebp - 0x46c], esi
jmp 0x402449
push ecx
push edx
call fcn.0040793c
add esp, 8
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040794a
mov esp, ebp
pop ebp
ret