Function at 0x4011b0
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x407e0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x49c
mov eax, dword [0x40ba7c]
push ebx
push ebp
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x4ac], ebx
call fcn.00401850
mov ebp, eax
cmp ebp, ebx
je 0x401436
push esi
push edi
mov ecx, ebp
call fcn.00401a60
test eax, eax
je case.default.0x40127a
lea ecx, [esp + 0x10]
call fcn.00401e80
lea ecx, [esp + 0x8c]
call fcn.00401e80
lea ecx, [esp + 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.00401b40
test eax, eax
jne 0x401256
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00401ac0
test eax, eax
je case.default.0x40127a
mov ecx, ebp
call fcn.00401ca0
mov esi, eax
cmp esi, ebx
jbe case.default.0x40127a
mov ecx, ebp
call fcn.00401c50
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x40127a
jmp dword [eax*4 + 0x40147c]
push esi
push 5
jmp 0x4012a1
push esi
push 4
jmp 0x4012a1
push esi
push 3
jmp 0x4012a1
lea eax, [esi*8]
sub eax, esi
push eax
push 3
jmp 0x4012a1
push esi
push 2
lea ecx, [esp + 0x18]
call fcn.00401ea0
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00402080
xor edx, edx
test eax, eax
setle dl
mov eax, edx
cmp eax, ebx
je case.default.0x40127a
lea eax, [esp + 0x9c]
mov ecx, ebp
push eax
call fcn.00401cf0
lea ecx, [esp + 0x1a0]
push ecx
mov ecx, ebp
call fcn.00401d30
cmp byte [esp + 0x1a0], bl
je 0x40131a
lea edx, [esp + 0x1a0]
lea eax, [esp + 0x9c]
push edx
push eax
lea ecx, [esp + 0x2ac]
push str.__s___s
push ecx
call fcn.0040235f
add esp, 0x10
jmp 0x401345
lea edi, [esp + 0x9c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
lea edx, [esp + 0x38]
mov dword [esp + 0x38], ecx
lea eax, [esp + 0x48]
mov dword [esp + 0x3c], ecx
push edx
mov dword [esp + 0x44], ecx
push eax
push ebx
mov dword [esp + 0x50], ecx
push ebx
push 0x4000010
lea ecx, [esp + 0x40]
push ebx
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x2c0]
push edx
push eax
push ebx
mov dword [esp + 0x54], 0xc
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x70], 0x44
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], 0x40ba80
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov word [esp + 0xa0], bx
mov word [esp + 0xa2], bx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je case.default.0x40127a
lea ecx, [esp + 0x8c]
push ecx
mov ecx, ebp
call fcn.00401bc0
lea ecx, [esp + 0x20]
call fcn.00401910
mov ebp, eax
cmp ebp, ebx
jne 0x401200
pop edi
pop esi
push ebx
push 0xea60
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [esp + 0x18]
mov dword [0x40ba7c], eax
mov dword [esp + 0x4ac], 0xffffffff
call fcn.00401810
mov ecx, dword [esp + 0x4a4]
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x4a8
ret