Function at 0x401220
Capabilities:
Create thread
Enumerate process modules
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x104
xor edi, edi
mov dword [ebp - 0x334], ecx
lea eax, [ebp - 0x108]
mov ebx, edx
push edi
push eax
mov dword [ebp - 0x330], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x40128f
push str.error___function_GetCurrentDirectory__returns_with_error_n
call fcn.00401010
add esp, 4
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401675
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [ebp - 0x108]
push 0x4031dc
push 0x104
push eax
call esi
push ebx
lea eax, [ebp - 0x108]
push 0x104
push eax
call esi
add esp, 0x18
push dword [ebp - 0x334]
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
test ebx, ebx
jne 0x4012ef
push str.error___function_OpenPCreateToolhelp32Snapshotrocess__returns_with_error_n
call fcn.00401010
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401675
mov esp, ebp
pop ebp
ret
push 0x220
lea eax, [ebp - 0x328]
mov dword [ebp - 0x32c], 0x224
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x32c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x401369
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
nop word [eax + eax]
push dword [ebp - 0x330]
lea eax, [ebp - 0x30c]
push eax
call esi
test eax, eax
je 0x40138c
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x40138c
lea eax, [ebp - 0x32c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x401330
push str.info___library_is_not_loaded_n
call fcn.00401010
add esp, 4
mov eax, 1
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401675
mov esp, ebp
pop ebp
ret
push str.info___library_is_loaded_n
call fcn.00401010
add esp, 4
push dword [ebp - 0x334]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4013d2
push str.error___function_OpenProcess__returns_with_error_n
call fcn.00401010
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401675
mov esp, ebp
pop ebp
ret
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x40140a
push str.error___function_LoadLibrary__returns_with_error_n
call fcn.00401010
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401675
mov esp, ebp
pop ebp
ret
push 0x403370
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push dword [ebp - 0x318]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x330], eax
test eax, eax
jne 0x401445
push str.error___function_CreateRemoteThread__returns_with_error_n
call fcn.00401010
add esp, 4
jmp 0x40145f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x330]
mov edi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00401675
mov esp, ebp
pop ebp
ret