Function at 0x401160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xb8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
push edi
push str.LOCALAPPDATA
call fcn.004048e9
mov edi, eax
xorps xmm0, xmm0
mov esi, edi
mov dword [esp + 0x10], edi
add esp, 4
movaps xmmword [esp + 0x20], xmm0
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4011a0
sub esi, ecx
cmp esi, 0x7fffffff
ja 0x4013ef
cmp esi, 0xf
ja 0x4011dc
push esi
lea eax, [esp + 0x24]
mov dword [esp + 0x34], esi
push edi
push eax
mov dword [esp + 0x40], 0xf
call fcn.00403ed0
mov byte [esp + esi + 0x2c], 0
jmp 0x401269
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x401214
mov ecx, 0x80000000
mov edi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.00401624
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4013f9
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x401246
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x401235
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4013f4
jmp 0x4011f6
test eax, eax
je 0x401244
push eax
call fcn.00401624
add esp, 4
jmp 0x401246
xor eax, eax
push esi
push dword [esp + 0x10]
mov dword [esp + 0x10], eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], edi
call fcn.00403ed0
mov eax, dword [esp + 0x14]
mov byte [eax + esi], 0
add esp, 0xc
lea edx, [esp + 0x20]
lea ecx, [esp + 0x58]
push str.CommonData
call fcn.00401400
add esp, 4
lea edx, [esp + 0x58]
lea ecx, [esp + 0x40]
push str.PhoneExperienceHostService.exe
call fcn.00401400
add esp, 4
mov dword [esp + 0x70], 0x44
cmp dword [esp + 0x54], 0xf
lea ecx, [esp + 0x10]
xorps xmm0, xmm0
lea eax, [esp + 0x40]
cmova eax, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x74]
movlpd qword [esp + 0x78], xmm0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
movlpd qword [esp + 0xa4], xmm0
movlpd qword [esp + 0xac], xmm0
movlpd qword [esp + 0xb4], xmm0
movlpd qword [esp + 0xbc], xmm0
movlpd qword [esp + 0xc4], xmm0
movlpd qword [esp + 0xcc], xmm0
movlpd qword [esp + 0xd4], xmm0
movaps xmmword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
mov ecx, dword [esp + 0x54]
cmp ecx, 0xf
jbe 0x401360
mov edx, dword [esp + 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401356
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4013f9
push ecx
push edx
call fcn.00401654
add esp, 8
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0xf
mov byte [esp + 0x40], 0
cmp ecx, 0xf
jbe 0x4013a7
mov edx, dword [esp + 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40139d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4013f9
push ecx
push edx
call fcn.00401654
add esp, 8
mov ecx, dword [esp + 0x34]
cmp ecx, 0xf
jbe 0x4013d9
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4013cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4013f9
push ecx
push edx
call fcn.00401654
add esp, 8
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
xor ecx, esp
call fcn.00401616
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401150
call fcn.004010b0
call fcn.004047ac
int3