Function at 0x401c10
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x84
mov eax, dword [0x4320d0]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
mov ebx, dword [esp + 0x8c]
push edi
mov edi, ecx
mov dword [esp + 0xc], ebx
call fcn.00401980
test eax, eax
jne 0x401dfa
mov ecx, dword [edi + 0x24]
lea ebx, [edi + 0x14]
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0x44
mov eax, 0x7fffffff
movlpd qword [esp + 0x30], xmm0
sub eax, ecx
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
mov dword [esp + 8], ecx
cmp eax, 0x10
jb 0x401e66
cmp dword [ebx + 0x14], 0x10
jb 0x401c9d
mov ebx, dword [ebx]
push ebp
push esi
lea eax, [ecx + 0x10]
mov dword [esp + 0x78], 0
mov esi, 0xf
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
lea ebp, [esp + 0x78]
mov dword [esp + 0x18], eax
cmp eax, esi
jbe 0x401d0a
mov esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x401ce5
mov esi, 0x7fffffff
jmp 0x401cef
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [esp + 0x7c]
call fcn.00401ed0
mov ecx, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x78], ebp
push ecx
push ebx
push ebp
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], esi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str._runasbackground]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
add esp, 0xc
movups xmmword [eax + ebp], xmm0
push ecx
lea ecx, [esp + 0x38]
mov byte [eax + ebp + 0x10], 0
cmp dword [esp + 0x90], 0x10
lea eax, [esp + 0x7c]
push ecx
cmovae eax, dword [esp + 0x80]
xorps xmm0, xmm0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movups xmmword [esp + 0x4c], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov ecx, dword [esp + 0x8c]
pop esi
pop ebp
test eax, eax
jne 0x401db4
cmp ecx, 0x10
jb 0x401dad
mov edx, dword [esp + 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401da3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401de6
push ecx
push edx
call fcn.0042441b
add esp, 8
xor al, al
jmp 0x401e4d
mov eax, dword [esp + 0x1c]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0xc], eax
cmp ecx, 0x10
jb 0x401df6
mov edx, dword [esp + 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401dec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401dec
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0042441b
add esp, 8
mov ebx, dword [esp + 0xc]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x401e0a
push eax
call dword [sym.imp.KERNEL32.DLL_ResetEvent]
jmp 0x401e1b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x10]
push 0xffffffffffffffff
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
sub eax, 0
je 0x401e48
sub eax, 1
jne 0x401e4b
mov byte [ebx], al
jmp 0x401e4b
mov byte [ebx], 1
mov al, 1
mov ecx, dword [esp + 0x88]
pop edi
pop ebx
xor ecx, esp
call fcn.00424429
add esp, 0x84
ret 4
call fcn.00401ec0
int3