Function at 0x401e60
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f241
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1b8
mov eax, dword [0x417024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c0], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1a0], 0x44
xor eax, eax
movlpd qword [ebp - 0x19c], xmm0
mov word [ebp - 0x15e], ax
mov word [ebp - 0x170], ax
mov eax, dword fs:[0x2c]
movlpd qword [ebp - 0x194], xmm0
movlpd qword [ebp - 0x18c], xmm0
movlpd qword [ebp - 0x184], xmm0
mov edi, dword [eax]
movlpd qword [ebp - 0x17c], xmm0
movlpd qword [ebp - 0x16e], xmm0
movlpd qword [ebp - 0x166], xmm0
mov eax, dword [edi + 0x21c]
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x124], 0xc8803fba
mov dword [ebp - 0x120], 0xaefede7c
mov dword [ebp - 0x11c], 0x8b8d7ba7
mov dword [ebp - 0x1bc], edi
movups xmmword [ebp - 0x1b0], xmm0
movaps xmm0, xmmword [0x414e30]
movups xmmword [ebp - 0x154], xmm0
movaps xmm0, xmmword [0x414df0]
movups xmmword [ebp - 0x144], xmm0
movaps xmm0, xmmword [0x414e00]
movups xmmword [ebp - 0x134], xmm0
test al, 1
jne 0x401fc8
or eax, 1
mov dword [edi + 0x21c], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x1b8], xmm0
mov edx, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1b8]
mov byte [edi + 0x148], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x154]
mov byte [ecx + edi + 0x10c], al
add ecx, 1
adc edx, 0
jne 0x401fbb
cmp ecx, 0x3c
jb 0x401fa0
push 0x40f360
call fcn.00403004
add esp, 4
cmp byte [edi + 0x148], 0
lea esi, [edi + 0x10c]
je 0x40202c
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c8], xmm0
mov eax, dword [ebp - 0x1c4]
mov edi, dword [ebp - 0x1c8]
mov dword [ebp - 0x1b4], eax
mov ecx, edi
mov eax, 0x8bad1fc9
and ecx, 7
mov edx, 0xcf93b313
shl ecx, 3
call fcn.0040ec80
xor byte [edi + esi], al
add edi, 1
adc dword [ebp - 0x1b4], 0
jne 0x40201f
cmp edi, 0x3c
jb 0x401ff4
mov eax, dword [ebp - 0x1bc]
mov byte [eax + 0x148], 0
lea ecx, [ebp - 0x118]
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x402034
mov edx, dword [ebp - 0x1c0]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x402050
lea edi, [ebp - 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402060
mov ecx, edx
lea eax, [ebp - 0x1b0]
shr ecx, 2
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1a0]
mov ecx, edx
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4020c7
push 0xffffffffffffffff
push dword [ebp - 0x1b0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1b0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1ac]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402f33
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret