Function at 0x401910
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Resume thread
Suspend thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov byte [ebp - 0x48], 0xee
mov byte [ebp - 0x84], 0xf5
mov byte [ebp - 0x83], 0xa6
mov byte [ebp - 0x82], 7
mov byte [ebp - 0x81], 0x35
mov byte [ebp - 0x80], 0xd1
mov byte [ebp - 0x7f], 0xdc
mov byte [ebp - 0x7e], 0xf6
mov byte [ebp - 0x7d], 0xac
mov byte [ebp - 0x7c], 0x15
mov byte [ebp - 0x7b], 0x7a
mov byte [ebp - 0x7a], 0x89
mov byte [ebp - 0x79], 0x5f
mov byte [ebp - 0x78], 0xf4
mov byte [ebp - 0x77], 0xa8
mov byte [ebp - 0x76], 0x1c
mov byte [ebp - 0x75], 0x46
mov byte [ebp - 0x74], 0xc1
mov byte [ebp - 0x73], 0xc0
mov byte [ebp - 0x72], 0xb9
mov byte [ebp - 0x71], 0xce
mov byte [ebp - 0x70], 0xe1
mov byte [ebp - 0x6f], 0x8d
mov byte [ebp - 0x6e], 0x56
mov byte [ebp - 0x6d], 0x96
mov byte [ebp - 0x6c], 0x97
mov byte [ebp - 0x6b], 0x51
mov byte [ebp - 0x6a], 0xed
mov byte [ebp - 0x69], 0x9c
mov byte [ebp - 0x68], 6
mov byte [ebp - 0x67], 0xba
mov byte [ebp - 0x66], 9
mov byte [ebp - 0x65], 0x2b
mov byte [ebp - 0x64], 0xf7
mov byte [ebp - 0x63], 0xa4
mov byte [ebp - 0x62], 0x1f
mov byte [ebp - 0x61], 0x45
mov byte [ebp - 0x60], 0xbd
mov byte [ebp - 0x5f], 0xad
mov byte [ebp - 0x5e], 0x86
mov byte [ebp - 0x5d], 0
mov eax, dword [0x4010e0]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x4010e4]
mov dword [ebp - 0x58], ecx
mov dx, word [0x4010e8]
mov word [ebp - 0x54], dx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc8]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push 0x4010ec
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x401a49
push 0
push 0x4010f8
push 0x401100
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.00401c30
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x700
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp dword [ebp - 0x4c], 0xc8
jae 0x401c0c
lea eax, [ebp - 0xcc]
push eax
push 0x40
push 1
push 0xe3dd7e
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x401beb
lea edx, [ebp - 0xd0]
push edx
push 1
lea eax, [ebp - 0x44]
push eax
push 0xe3dd7e
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x44]
and edx, 0xff
test edx, edx
je 0x401beb
lea eax, [ebp - 0xd0]
push eax
push 1
lea ecx, [ebp - 0x48]
push ecx
push 0xe3dd7e
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0xcc]
push eax
push 0x40
push 0x27
push 0xe3dd54
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x401beb
lea edx, [ebp - 0xd0]
push edx
push 0x27
lea eax, [ebp - 0x44]
push eax
push 0xe3dd54
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x44]
and edx, 0xff
test edx, edx
je 0x401beb
lea eax, [ebp - 0xd0]
push eax
push 0x27
lea ecx, [ebp - 0x84]
push ecx
push 0xe3dd54
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0xcc]
push eax
push 0x40
push 9
push 0x3930000
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x401beb
lea edx, [ebp - 0xd0]
push edx
push 9
lea eax, [ebp - 0x44]
push eax
push 0x3930000
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x44]
and edx, 0xff
test edx, edx
je 0x401beb
lea eax, [ebp - 0xd0]
push eax
push 9
lea ecx, [ebp - 0x5c]
push ecx
push 0x3930000
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x401c0c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x401a78
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10