Function at 0x402a10
Capabilities:
Create process on windows
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1074
call fcn.0040c2b0
mov eax, dword [0x41203c]
xor eax, esp
mov dword [esp + 0x106c], eax
cmp byte [0x413f86], 0
mov eax, dword [esp + 0x107c]
push ebx
push ebp
mov ebp, dword [esp + 0x1080]
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
je 0x402abc
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402a56
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
add esp, 4
mov dword [0x413f78], eax
mov ecx, ebx
mov edx, eax
jmp 0x402a90
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x402a90
xor al, al
mov ecx, dword [esp + 0x107c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403536
add esp, 0x1074
ret
cmp dword [0x413f78], 0
jne 0x402aa1
lea eax, [esp + 0x1c]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push ecx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x402aea
call fcn.00402490
mov al, 1
jmp 0x402aa3
mov edi, dword [esp + 0x1c]
shr edi, 2
xor esi, esi
test edi, edi
je 0x402b11
mov edx, dword [esp + esi*4 + 0x78]
test edx, edx
je 0x402b0c
push ebp
call fcn.00402fa0
add esp, 4
test al, al
jne 0x402ae1
inc esi
cmp esi, edi
jb 0x402af7
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402b16
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, ebp
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402b30
sub eax, esi
sar eax, 1
lea eax, [eax + edx + 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
mov ebp, eax
mov eax, 0x41029c
mov edx, ebp
add esp, 4
sub edx, eax
jmp 0x402b70
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402b70
mov eax, ebx
mov edx, ebx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402b83
sub eax, edx
lea edi, [ebp - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x402b93
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 2]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402bb2
mov ecx, dword [0x4103fc]
mov dword [eax], ecx
mov dx, word [0x410400]
mov word [eax + 4], dx
mov eax, dword [esp + 0x10]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402bd7
sub eax, edx
lea edi, [ebp - 2]
jmp 0x402bf0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x402bf0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x413f74]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402c14
sub eax, edx
sar eax, 1
xor ecx, ecx
add eax, 6
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
mov ebx, eax
mov eax, 0x41029c
mov edx, ebx
add esp, 4
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402c50
mov eax, dword [0x413f74]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402c66
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x402c76
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebx - 2]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402c95
mov ecx, dword [0x4103fc]
mov dword [eax], ecx
mov dx, word [0x410400]
mov word [eax + 4], dx
push ebx
mov eax, ebp
call fcn.004017e0
add esp, 4
test ebp, ebp
je 0x402ccc
push ebp
call fcn.00403545
add esp, 4
test ebx, ebx
je 0x402cd9
push ebx
call fcn.00403545
add esp, 4
mov eax, dword [0x413f74]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402ce1
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [esp + 0x10]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402d00
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [esp + 0x18]
lea edx, [eax + 2]
jmp 0x402d20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402d20
mov ebp, dword [esp + 0x14]
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, ebp
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402d40
sub eax, esi
sar eax, 1
lea eax, [eax + ebx*2]
add eax, edx
xor ecx, ecx
lea eax, [eax + edi + 0x25]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040352b
mov ebx, eax
mov eax, 0x41029c
mov ecx, ebx
add esp, 4
sub ecx, eax
lea esp, [esp]
movzx edx, word [eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x402d80
mov eax, dword [0x413f74]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402d96
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x402da6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402dc5
mov eax, dword [0x410368]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402de0
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x402df0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebx - 2]
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402e10
mov ecx, dword [0x4103b4]
mov dword [eax], ecx
mov dx, word [0x4103b8]
mov word [eax + 4], dx
mov eax, dword [esp + 0x18]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402e35
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x402e45
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402e64
mov ecx, 7
mov esi, str.__launchdir__
mov eax, ebp
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402e80
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x402e90
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402eb0
mov ecx, 8
mov esi, str.___usetempdir__
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x413f74]
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402ed0
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x402ee0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402f00
mov eax, dword [0x41029c]
push 0x44
lea ecx, [esp + 0x34]
push 0
push ecx
mov dword [edi], eax
call fcn.00408e60
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push ebx
mov edx, 5
push 0
mov dword [esp + 0x58], 0x44
mov dword [esp + 0x84], 1
mov word [esp + 0x88], dx
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x402f84
mov edx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
test ebx, ebx
je 0x402f91
push ebx
call fcn.00403545
add esp, 4
mov al, 1
jmp 0x402aa3