Function at 0x401015
Capabilities:
Create process on windows
Create thread
Get common file path
Resume thread
Suspend thread

Disassembly:
sub esp, 0x10
mov dword [0x40ba40], 0x10
push ebx
push ebp
push esi
push edi
push 0x11
call fcn.00403960
mov dword [0x40ba30], eax
mov eax, dword [0x40ba40]
add eax, 2
push eax
call fcn.00403960
push str.ShohdiBrink2_MFC
mov dword [0x40ba58], eax
push dword [0x40ba30]
call fcn.00403870
mov edi, 0x40ba38
push 0x40b054
push edi
call fcn.00403870
push 0x40b050
push 0x40ba3c
call fcn.00403870
push dword [0x40ba30]
push dword [0x40ba58]
call fcn.00403870
push 0x40b04c
push dword [0x40ba58]
call fcn.00403880
mov eax, dword [esp + 0x54]
mov esi, 0x12c
push esi
mov dword [0x40ba34], eax
call fcn.00403960
push esi
mov dword [0x40ba50], eax
call fcn.00403960
push esi
mov dword [0x40ba48], eax
call fcn.00403960
push esi
mov dword [0x40ba4c], eax
call fcn.00403960
add esp, 0x40
mov dword [0x40ba54], eax
push dword [0x40ba48]
push dword [0x40ba50]
call fcn.00401c8b
push dword [0x40ba50]
call fcn.004037f0
mov ecx, eax
mov eax, dword [0x40ba50]
add esp, 0xc
xor ebx, ebx
cmp byte [ecx + eax - 1], 0x22
jne 0x401112
push eax
call fcn.004037f0
pop ecx
mov ecx, dword [0x40ba50]
mov byte [eax + ecx - 1], bl
push dword [0x40ba48]
call fcn.004037f0
pop ecx
mov ecx, eax
mov eax, dword [0x40ba48]
cmp byte [ecx + eax - 1], 0x22
jne 0x40113d
push eax
call fcn.004037f0
pop ecx
mov ecx, dword [0x40ba48]
mov byte [eax + ecx - 1], bl
push esi
push dword [0x40ba4c]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push dword [0x40ba54]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x3e8
call fcn.00403960
push dword [0x40ba50]
mov esi, eax
push esi
call fcn.00403870
add esp, 0xc
push edi
push esi
call fcn.004037f0
pop ecx
lea eax, [eax + esi - 3]
push eax
call fcn.00403870
push esi
call fcn.004037f0
add eax, dword [0x40ba48]
push eax
push esi
call fcn.00403880
push dword [0x40ba50]
call fcn.00401787
add esp, 0x18
push 1
pop ebp
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
push dword [0x40ba30]
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebp
push ebp
push ebx
call esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4011d9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
push dword [0x40ba58]
push ebp
push ebp
push ebx
call esi
push 0x1f4
mov dword [esp + 0x1c], eax
call fcn.00403960
push dword [0x40ba50]
mov edi, eax
call fcn.00401900
push dword [0x40ba4c]
mov byte [esp + 0x30], al
push edi
call fcn.00403870
push 0x40b048
push edi
call fcn.00403880
push dword [0x40ba30]
push edi
call fcn.00403880
push 0x40b040
push edi
call fcn.00403880
push 0x3c
call fcn.00403960
add esp, 0x2c
cmp eax, ebx
mov esi, 0x80
je 0x401258
push ebp
mov ecx, eax
push dword [0x409128]
push esi
push edi
call fcn.0040272e
mov ebp, eax
jmp 0x40125a
xor ebp, ebp
push 0x40
call fcn.00403960
cmp eax, ebx
pop ecx
je 0x401280
push 1
mov ecx, eax
push dword [0x409128]
push esi
push dword [0x40ba50]
call fcn.00402823
mov esi, eax
jmp 0x401282
xor esi, esi
cmp byte [esp + 0x24], bl
push 2
push 0xfffffffffffffff8
je 0x4012b2
pop eax
mov ecx, esi
sub eax, dword [0x40ba40]
push eax
call fcn.004029fe
lea eax, [esp + 0x10]
push 4
push eax
mov ecx, esi
call fcn.004029bd
push ebx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff8
push eax
mov ecx, esi
call fcn.004029fe
lea eax, [esp + 0x10]
push 4
push eax
mov ecx, esi
call fcn.004029bd
lea eax, [esp + 0x14]
push 4
push eax
mov ecx, esi
call fcn.004029bd
push ebx
mov ecx, esi
push dword [esp + 0x14]
call fcn.004029fe
mov eax, dword [esp + 0x14]
inc eax
push eax
call fcn.00403960
pop ecx
mov dword [esp + 0x24], eax
push dword [esp + 0x14]
mov ecx, esi
push eax
call fcn.004029bd
mov ecx, ebp
push dword [esp + 0x14]
push dword [esp + 0x28]
call fcn.0040297a
mov ecx, esi
call fcn.00402929
mov ecx, ebp
call fcn.00402929
cmp esi, ebx
je 0x40132d
mov eax, dword [esi]
push 1
mov eax, dword [eax + 4]
lea ecx, [eax + esi]
mov eax, dword [eax + esi]
call dword [eax]
cmp ebp, ebx
je 0x401341
mov eax, dword [ebp]
push 1
mov eax, dword [eax + 4]
lea ecx, [eax + ebp]
mov eax, dword [eax + ebp]
call dword [eax]
push dword [esp + 0x24]
call fcn.004037de
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ecx
push ebx
push dword [esp + 0x1c]
call ebp
test eax, eax
jne 0x401365
push 1
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push edi
call fcn.004037de
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x40175c
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push ebx
push esi
call ebp
test eax, eax
je 0x401372
push 0x64
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x384
call edi
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x40138c