Function at 0x401460
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ebx
push ecx
sub esp, 0x13c
mov ebx, ecx
call fcn.00401e20
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx]
jge 0x4014c0
mov eax, dword [ebp - 0x20]
lea edx, [eax*4]
mov eax, dword [ebx + 4]
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], str._cheese
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4014ba
mov byte [ebp - 0x19], 1
jmp 0x4014c0
add dword [ebp - 0x20], 1
jmp 0x401488
movzx eax, byte [ebp - 0x19]
xor eax, 1
test al, al
je 0x4015cf
mov dword [ebp - 0x24], str.C:Path_towt.exe
lea eax, [ebp - 0x5d]
mov ecx, eax
call fcn.004018d4
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x5d]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x24]
mov dword [esp], edx
mov ecx, eax
call fcn.0040189c
sub esp, 8
lea eax, [ebp - 0x90]
lea edx, [ebp - 0x78]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x40607f
mov dword [esp], eax
call fcn.00404054
lea eax, [ebp - 0x114]
mov dword [esp + 8], 0x40607f
lea edx, [ebp - 0x90]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00404020
lea eax, [ebp - 0x90]
mov ecx, eax
call fcn.00401894
lea eax, [ebp - 0x78]
mov ecx, eax
call fcn.00401894
lea eax, [ebp - 0x5d]
mov ecx, eax
call fcn.004018cc
lea eax, [ebp - 0x114]
mov ecx, eax
call fcn.004018dc
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov ebx, 0
lea eax, [ebp - 0x114]
mov ecx, eax
call fcn.00401894
jmp 0x401764
mov dword [ebp - 0x28], str.E:PayloadBase_payloadexecute.ps1
lea eax, [ebp - 0x29]
mov ecx, eax
call fcn.004018d4
lea eax, [ebp - 0x44]
lea edx, [ebp - 0x29]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x28]
mov dword [esp], edx
mov ecx, eax
call fcn.0040189c
sub esp, 8
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x44]
mov dword [esp + 8], edx
mov dword [esp + 4], str.powershell.exe__ExecutionPolicy_Bypass__File__
mov dword [esp], eax
call fcn.00404054
lea eax, [ebp - 0xa8]
mov dword [esp + 8], 0x40607f
lea edx, [ebp - 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00404020
lea eax, [ebp - 0x5c]
mov ecx, eax
call fcn.00401894
lea eax, [ebp - 0x44]
mov ecx, eax
call fcn.00401894
lea eax, [ebp - 0x29]
mov ecx, eax
call fcn.004018cc
lea edx, [ebp - 0xec]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xec], 0x44
lea eax, [ebp - 0xa8]
mov ecx, eax
call fcn.004018dc
mov edx, eax
lea eax, [ebp - 0xfc]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xec]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x401719
mov eax, dword [ebp - 0xfc]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0xf8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x401752
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
mov dword [esp + 4], str.Error_creating_process:
mov dword [esp], sym.imp.libstdc_6.dll_std::cerr
call fcn.00401874
mov dword [esp], ebx
mov ecx, eax
call fcn.004018bc
sub esp, 4
mov dword [esp], 0x40187c
mov ecx, eax
call fcn.004018c4
sub esp, 4
mov ebx, 0
lea eax, [ebp - 0xa8]
mov ecx, eax
call fcn.00401894
mov eax, ebx
jmp 0x401804
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop edi
pop ebp
lea esp, [ecx - 4]
ret