Function at 0x401940
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403740
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc8
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
push esi
mov dword [ebp - 0x6c], esi
call dword [sym.imp.USER32.dll_GetWindowDC]
push 0
push str.XP_Error.exe
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea eax, [ebp - 0x60]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x38]
mov esi, dword [ebp - 0x54]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
mov eax, esi
cdq
and edx, 3
mov dword [ebp - 0x68], esi
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], 0
lea edi, [edx + eax]
sar edi, 2
movd xmm1, edi
cvtdq2pd xmm1, xmm1
call fcn.004011c0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
movsd xmm4, qword [0x4043f0]
movd xmm3, eax
cvtdq2pd xmm3, xmm3
cmp ecx, edx
je 0x401a58
movd xmm2, esi
movaps xmm1, xmm3
cvtdq2pd xmm2, xmm2
mulsd xmm1, xmm4
mulsd xmm2, xmm4
nop dword [eax]
movsx eax, word [ecx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
cvttsd2si eax, xmm0
mov word [ecx], ax
movsx eax, word [ecx + 2]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm2
cvttsd2si eax, xmm0
mov word [ecx + 2], ax
add ecx, 4
cmp ecx, edx
jne 0x401a20
mov eax, dword [ebp - 0x1c]
movsd xmm1, qword [0x404400]
add eax, 0xfffffe40
mulsd xmm3, xmm4
mov dword [ebp - 0x50], 0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x78], xmm3
mulsd xmm0, xmm4
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_pow_precise
movsd xmm1, qword [0x404400]
lea eax, [esi - 0xc7]
movsd qword [ebp - 0x98], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x4043f0]
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_pow_precise
addsd xmm0, qword [ebp - 0x98]
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x401ac8
sqrtsd xmm0, xmm0
jmp 0x401acd
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
movsd xmm1, qword [ebp - 0x78]
subsd xmm1, qword [0x404428]
divsd xmm0, qword [0x404418]
divsd xmm1, qword [0x404420]
mulsd xmm0, qword [0x404410]
subsd xmm1, qword [0x4043f8]
mulsd xmm1, qword [0x404408]
addsd xmm0, xmm1
addsd xmm0, qword [0x404430]
addsd xmm0, qword [0x404430]
call fcn.004035f0
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
mov ecx, 0x406018
xchg byte [ecx], al
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x4c]
push eax
movups xmmword [ebp - 0x4c], xmm0
call fcn.004021c0
lea eax, [ebp - 0x50]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xa8], eax
mov eax, ecx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xac], ecx
lea ecx, [ebp - 0x90]
push eax
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xd0], 0x14
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xc0], 0x14
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], 0x14
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], 0x14
mov byte [ebp - 0x16], 1
call fcn.004021c0
mov eax, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x16]
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], eax
push 0x18
mov byte [ebp - 4], 2
call fcn.0040288e
mov esi, dword [ebp - 0x88]
add esp, 4
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x1c], eax
mov dword [eax + 8], esi
mov esi, dword [ebp - 0x1c]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x40]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x16]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
call fcn.004022a0
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
push eax
push 0
push esi
push 0x402540
push 0
push 0
call edi
add esp, 0x18
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x401ed0
mov byte [ebp - 4], 5
xor esi, esi
push 4
mov byte [ebp - 0x15], 1
call fcn.0040288e
lea ecx, [ebp - 0x15]
mov dword [ebp - 0x1c], eax
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
push ecx
push esi
push eax
push 0x402620
push esi
push esi
call edi
add esp, 0x18
mov dword [ebp - 0x24], eax
test eax, eax
je 0x401ec1
mov byte [ebp - 4], 7
cmp byte [ebp - 0x15], 0
mov ecx, dword [sym.imp.USER32.dll_LoadIconW]
je 0x401d5b
movd xmm0, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x4043f0]
cvttsd2si eax, xmm0
mov dword [ebp - 0x1c], eax
inc esi
mov eax, esi
cmp esi, 3
jle 0x401d09
xor esi, esi
mov edi, 0x7f04
jmp case.default.0x401d10
mov esi, eax
cmp eax, 3
ja case.default.0x401d10
jmp dword [eax*4 + 0x401ee0]
mov edi, 0x7f03
jmp 0x401d2a
mov edi, 0x7f01
jmp 0x401d2a
mov edi, 0x7f02
mov esi, eax
push edi
push 0
call ecx
push eax
cvttsd2si eax, qword [ebp - 0x78]
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_DrawIcon]
lea ecx, [ebp - 0xd8]
call 0x401ef0
cmp byte [ebp - 0x15], 0
mov ecx, dword [sym.imp.USER32.dll_LoadIconW]
jne 0x401cf8
push 0x7f00
push 0
call ecx
movd xmm0, dword [ebp - 0x68]
cvtdq2pd xmm0, xmm0
push eax
mulsd xmm0, qword [0x4043f0]
cvttsd2si eax, xmm0
push eax
cvttsd2si eax, qword [ebp - 0x78]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_DrawIcon]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x64]
push dword [ebp - 0x6c]
call dword [sym.imp.USER32.dll_ReleaseDC]
xor al, al
lea ecx, [ebp - 0x16]
xchg byte [ecx], al
cmp dword [ebp - 0x20], 0
je 0x401eb9
mov esi, dword [sym.imp.MSVCP140.dll__Thrd_id]
call esi
mov ecx, dword [ebp - 0x20]
cmp ecx, eax
je 0x401eb1
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_join]
push 0
push ecx
push dword [ebp - 0x24]
call edi
add esp, 0xc
test eax, eax
jne 0x401ea9
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
cmp dword [ebp - 0x28], eax
je 0x401eb9
call esi
mov ecx, dword [ebp - 0x28]
cmp ecx, eax
je 0x401eb1
push 0
push ecx
push dword [ebp - 0x2c]
call edi
add esp, 0xc
test eax, eax
jne 0x401ea9
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
cmp dword [ebp - 0x20], eax
je 0x401e1f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov edx, dword [ebp - 0x4c]
test edx, edx
je 0x401e52
mov ecx, dword [ebp - 0x44]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x401e48
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401e7b
push ecx
push edx
call fcn.004028be
add esp, 8
mov edx, dword [ebp - 0x38]
test edx, edx
je 0x401e8b
mov ecx, dword [ebp - 0x30]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x401e81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401e81
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004028be
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402880
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 2
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x20], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x28], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
add bl, byte [0x1d170040]
inc eax
add byte [esi], bl
sbb eax, 0x1d250040
inc eax
add byte [ebx - 0x75], dl
fadd qword [ebx - 0x1b7cf714]
clc
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4037b5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x10
call fcn.0040288e
movups xmm0, xmmword [esi]
add esp, 4
mov dword [ebp - 0x18], eax
movups xmmword [eax], xmm0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
push ecx
push 0
push eax
push 0x402330
push 0
push 0
call edi
add esp, 0x18
mov dword [ebp - 0x30], eax
test eax, eax
je 0x402136
push 0x10
mov dword [ebp - 4], 1
call fcn.0040288e
movups xmm0, xmmword [esi + 0x10]
add esp, 4
mov dword [ebp - 0x18], eax
movups xmmword [eax], xmm0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x4023b0
push 0
push 0
call edi
add esp, 0x18
mov dword [ebp - 0x28], eax
test eax, eax
je 0x402127
push 0x10
mov byte [ebp - 4], 3
call fcn.0040288e
movups xmm0, xmmword [esi + 0x20]
add esp, 4
mov dword [ebp - 0x18], eax
movups xmmword [eax], xmm0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
push ecx
push 0
push eax
push 0x402440
push 0
push 0
call edi
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
je 0x402118
push 0x10
mov byte [ebp - 4], 5
call fcn.0040288e
movups xmm0, xmmword [esi + 0x30]
add esp, 4
mov dword [ebp - 0x18], eax
movups xmmword [eax], xmm0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 6
push ecx
push 0
push eax
push 0x4024c0
push 0
push 0
call edi
add esp, 0x18
mov dword [ebp - 0x38], eax
test eax, eax
je 0x402109
mov byte [ebp - 4], 7
cmp dword [ebp - 0x2c], 0
je 0x402101
mov esi, dword [sym.imp.MSVCP140.dll__Thrd_id]
call esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, eax
je 0x4020f9
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_join]
push 0
push ecx
push dword [ebp - 0x30]
call edi
add esp, 0xc
test eax, eax
jne 0x4020f1
xorps xmm0, xmm0
movlpd qword [ebp - 0x30], xmm0
cmp dword [ebp - 0x24], eax
je 0x402101
call esi
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
je 0x4020f9
push 0
push ecx
push dword [ebp - 0x28]
call edi
add esp, 0xc
test eax, eax
jne 0x4020f1
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
cmp dword [ebp - 0x1c], eax
je 0x402101
call esi
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
je 0x4020f9
push 0
push ecx
push dword [ebp - 0x20]
call edi
add esp, 0xc
test eax, eax
jne 0x4020f1
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
cmp dword [ebp - 0x34], eax
je 0x402101
call esi
mov ecx, dword [ebp - 0x34]
cmp ecx, eax
je 0x4020f9
push 0
push ecx
push dword [ebp - 0x38]
call edi
add esp, 0xc
test eax, eax
jne 0x4020f1
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
cmp dword [ebp - 0x1c], eax
jne 0x4020eb
cmp dword [ebp - 0x24], eax
jne 0x4020eb
cmp dword [ebp - 0x2c], eax
je 0x402145
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 2
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x34], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x1c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x24], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x2c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402880
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret