Function at 0x401670
Capabilities:
Create process on windows
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x1c8
mov rax, qword [0x00405660]
mov qword [rsp + 0x198], rax
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov rdi, rcx
mov qword [0x00405e28], rcx
lea rcx, [0x00405d60]
mov dword [0x00405d60], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.004012a0
xor ebp, ebp
test rax, rax
je 0x40199a
lea r9d, [rbp + 0xa]
lea r8, [rsp + 0x188]
lea edx, [rbp + 3]
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringA]
lea rcx, [rsp + 0x188]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
mov rsi, rax
je 0x40199a
lea r9d, [rbp + 0xa]
lea r8, [rsp + 0x178]
lea edx, [rbp + 2]
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringA]
lea rcx, [rsp + 0x178]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x40199a
lea rcx, str.Kernel32.dll
mov qword [rsp + 0x1c0], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x40176f
lea rdx, str.SetProcessShutdownParameters
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x401766
xor edx, edx
mov ecx, 0x101
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp word [rsp + 0x130], bp
mov rbx, qword [rsp + 0x1c0]
je 0x4017e7
lea rax, [rsp + 0x160]
lea rcx, str.Apntex.exe
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x28], 0x8000030
mov word [rsp + 0x130], bp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40199a
lea rax, [0x00401470]
mov edx, 0xa
mov rcx, rdi
mov dword [rsp + 0x70], 3
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x84], ebp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rdi
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa0], 6
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x178]
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x40199a
mov rax, qword [0x00405e28]
mov qword [rsp + 0x58], rbp
lea r8, [rsp + 0x178]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
lea rdx, [rsp + 0x178]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
test rax, rax
je 0x40199a
lea rax, [rsp + 0x60]
lea r8, [0x00401050]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x00405690], rax
je 0x401994
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
lea rcx, [0x00401410]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401986
nop
nop
nop
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401950
call fcn.004013e0
mov eax, dword [rsp + 0xd0]
jmp 0x4019b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x00405e08]
test rcx, rcx
je 0x4019b3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x00405e08], rbp
xor eax, eax
mov rdi, qword [rsp + 0x1a8]
mov rsi, qword [rsp + 0x1b0]
mov rbp, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x198]
call fcn.00403080
add rsp, 0x1c8
ret