Function at 0x401040
Capabilities:
Create process on windows
Create thread
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x401cf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x298
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.00401880
xor eax, eax
mov ecx, 0x1f
mov dword [esp + 0x11], eax
lea edi, [esp + 0x25]
mov dword [esp + 0x15], eax
mov byte [esp + 0xa4], 0
mov byte [esp + 0x19], al
mov byte [esp + 0x24], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0x1a4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1a5]
push str.._etc_TraceCli.ini
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.ExeNum
push str.EXEINFO
lea ecx, [esp + 0x18]
mov dword [esp + 0x2b8], 0
mov byte [esp + 0x1c], 0
stosb byte es:[edi], al
call fcn.004018c0
mov edi, eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], edi
call fcn.00401710
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
mov byte [esp + 0x2b0], 1
call ebx
mov esi, 1
cmp edi, esi
jl 0x40128c
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14], ecx
lea edi, [esp + 0x28]
mov dword [esp + 0x18], ecx
push esi
mov word [esp + 0x20], cx
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0xac]
lea edx, [esp + 0x18]
push str.ExePath_d
rep stosd dword es:[edi], eax
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x14]
push eax
push str.._etc_TraceCli.ini
push ecx
push str.EXEINFO
lea ecx, [esp + 0x20]
call fcn.004019a0
push esi
lea edx, [esp + 0x18]
push str.ExeName_d
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x28]
lea ecx, [esp + 0x14]
push eax
push str.._etc_TraceCli.ini
push ecx
push str.EXEINFO
lea ecx, [esp + 0x20]
call fcn.004019a0
push esi
lea edx, [esp + 0x18]
push str.ExeUnName_d
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x1a8]
lea ecx, [esp + 0x14]
push eax
push str.._etc_TraceCli.ini
push ecx
push str.EXEINFO
lea ecx, [esp + 0x20]
call fcn.004019a0
push esi
lea edx, [esp + 0x18]
push str.ExeType_d
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push str.._etc_TraceCli.ini
push eax
push str.EXEINFO
call fcn.004018c0
push esi
lea ecx, [esp + 0x18]
push str.ExeDog_d
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push str.._etc_TraceCli.ini
push edx
push str.EXEINFO
call fcn.004018c0
push 0
push 0
push 0
lea eax, [esp + 0x1b4]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x7d0
call ebx
lea ecx, [esp + 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [esp + 0x28]
push 0x4031cc
push edx
lea ecx, [esp + 0x28]
call fcn.00401750
cmp eax, 1
je 0x40127e
lea eax, [esp + 0xa8]
push 0
push eax
call fcn.00401660
add esp, 8
mov eax, dword [esp + 0x24]
inc esi
cmp esi, eax
jle 0x40111d
pop ebp
push 0
push 0
push 0
push 0x4012f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2ac], 0
call fcn.00401740
lea ecx, [esp + 0xc]
mov dword [esp + 0x2ac], 0xffffffff
call fcn.004018b0
mov ecx, dword [esp + 0x2a4]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x2a4
ret