Function at 0x401260
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x29c
mov eax, dword [0x411004]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push ebp
push esi
push edi
push 0x7f
lea eax, [esp + 0xa9]
push 0
push eax
mov byte [esp + 0xb0], 0
call fcn.004020c0
push 0x103
lea ecx, [esp + 0x1b5]
push 0
push ecx
mov byte [esp + 0x1bc], 0
call fcn.004020c0
push 0x1f4
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0x1f4
call fcn.004022a5
add esp, 0x1c
mov ebp, eax
push str.psapi.dll
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov dword [esp + 0x1c], edi
je 0x401513
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EnumProcesses
push edi
call esi
test eax, eax
je 0x40150c
lea edx, [esp + 0x10]
push edx
push 0x1f4
push ebp
call eax
test eax, eax
je 0x40150c
shr dword [esp + 0x10], 2
push str.GetModuleFileNameExA
push edi
call esi
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x20], ebx
je 0x40150c
push 0x7f
lea eax, [esp + 0x29]
push 0
push eax
mov byte [esp + 0x30], 0
call fcn.004020c0
push 0x7f
lea ecx, [esp + 0x135]
push 0
push ecx
mov byte [esp + 0x13c], 0
call fcn.004020c0
add esp, 0x18
mov esi, 0x412100
lea edx, [esi - 0x80]
push 0x40e204
push edx
call fcn.0040d01a
add esp, 8
test eax, eax
jne 0x4013ba
lea eax, [esp + 0x24]
push 0x80
push eax
call fcn.0040205b
push esi
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xb4]
push str._s_s
push edx
call fcn.00401e74
push esi
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x144]
push str.__s_s_
push ecx
call fcn.00401e74
add esp, 0x28
add esi, 0x100
cmp esi, 0x412500
jl 0x401363
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
jbe 0x401444
mov edx, dword [ebp + edi*4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40142b
push 0x104
lea eax, [esp + 0x1a8]
push eax
push 0
push esi
call ebx
test eax, eax
je 0x401424
lea ecx, [esp + 0x1a4]
push ecx
call fcn.0040d641
push str.WATCHDOG.EXE
push eax
call fcn.004021d0
add esp, 0xc
test eax, eax
je 0x401424
add dword [esp + 0x14], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
add edi, 1
cmp edi, eax
jb 0x4013d2
cmp dword [esp + 0x14], 1
jle 0x401444
push 0
call fcn.00401c4c
xor ebx, ebx
test eax, eax
jbe 0x401508
mov edi, edi
mov edx, dword [ebp + ebx*4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4014f5
push 0x104
lea eax, [esp + 0x1a8]
push eax
push 0
push esi
call dword [esp + 0x30]
test eax, eax
je 0x4014ee
lea ecx, [esp + 0xa4]
push ecx
call fcn.0040d641
lea edx, [esp + 0x1a8]
push edx
mov edi, eax
call fcn.0040d641
mov ebp, eax
push edi
push ebp
call fcn.004021d0
add esp, 0x10
test eax, eax
jne 0x401504
push edi
push ebp
call fcn.004021d0
add esp, 8
test eax, eax
jne 0x4014ea
mov eax, dword [esp + 0x10]
add eax, 0xffffffff
cmp ebx, eax
jne 0x4014ea
push 0
push 0x40e1e1
push 0x40e1e1
lea ecx, [esp + 0x130]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 1
cmp ebx, dword [esp + 0x10]
jb 0x401450
jmp 0x401508
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call fcn.0040213a
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x2a8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004020a4
add esp, 0x29c
ret