Function at 0x405620
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47fb21
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1b8
mov eax, dword [0x4a337c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c0], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1a0], 0x44
xor eax, eax
movlpd qword [ebp - 0x19c], xmm0
mov word [ebp - 0x15e], ax
mov word [ebp - 0x170], ax
mov eax, dword fs:[0x2c]
movlpd qword [ebp - 0x194], xmm0
movlpd qword [ebp - 0x18c], xmm0
movlpd qword [ebp - 0x184], xmm0
mov edi, dword [eax]
movlpd qword [ebp - 0x17c], xmm0
movlpd qword [ebp - 0x16e], xmm0
movlpd qword [ebp - 0x166], xmm0
mov eax, dword [edi + 0x274]
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x124], 0x88261dd6
mov dword [ebp - 0x120], 0x64c04eac
mov dword [ebp - 0x11c], 0xcb2b59cb
mov dword [ebp - 0x1bc], edi
movups xmmword [ebp - 0x1b0], xmm0
movaps xmm0, xmmword [0x49f120]
movups xmmword [ebp - 0x154], xmm0
movaps xmm0, xmmword [0x49f170]
movups xmmword [ebp - 0x144], xmm0
movaps xmm0, xmmword [0x49f180]
movups xmmword [ebp - 0x134], xmm0
test al, 1
jne 0x405788
or eax, 1
mov dword [edi + 0x274], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x1b8], xmm0
mov edx, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1b8]
mov byte [edi + 0x234], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x154]
mov byte [ecx + edi + 0x1f8], al
add ecx, 1
adc edx, 0
jne 0x40577b
cmp ecx, 0x3c
jb 0x405760
push 0x47ff90
call fcn.0045aba7
add esp, 4
cmp byte [edi + 0x234], 0
lea esi, [edi + 0x1f8]
je 0x4057ec
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c8], xmm0
mov eax, dword [ebp - 0x1c4]
mov edi, dword [ebp - 0x1c8]
mov dword [ebp - 0x1b4], eax
mov ecx, edi
mov eax, 0xcb0b3da5
and ecx, 7
mov edx, 0x5ad23c3
shl ecx, 3
call fcn.0047f4b0
xor byte [edi + esi], al
add edi, 1
adc dword [ebp - 0x1b4], 0
jne 0x4057df
cmp edi, 0x3c
jb 0x4057b4
mov eax, dword [ebp - 0x1bc]
mov byte [eax + 0x234], 0
lea ecx, [ebp - 0x118]
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4057f4
mov edx, dword [ebp - 0x1c0]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x405810
lea edi, [ebp - 0x118]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405820
mov ecx, edx
lea eax, [ebp - 0x1b0]
shr ecx, 2
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1a0]
mov ecx, edx
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405887
push 0xffffffffffffffff
push dword [ebp - 0x1b0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1b0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1ac]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045aab3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret