Function at 0x401b20
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x413004]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
call fcn.004034ce
cmp dword [eax], 2
jge 0x401b5a
mov eax, 0xfffffff5
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00401da9
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401260
test eax, eax
jne 0x401b7c
mov eax, 0xfffffff6
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00401da9
mov esp, ebp
pop ebp
ret 0x10
call fcn.004034d4
mov ecx, str.inject
mov eax, dword [eax]
mov eax, dword [eax + 4]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401bb0
test dl, dl
je 0x401bac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401bb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401b90
xor eax, eax
jmp 0x401bb5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401c28
call fcn.004034ce
cmp dword [eax], 5
jne 0x401b41
call fcn.004034d4
mov eax, dword [eax]
push dword [eax + 8]
call fcn.00403878
add esp, 4
mov ebx, eax
call fcn.004034d4
mov ecx, dword [eax]
push dword [ecx + 0xc]
call fcn.00403878
add esp, 4
mov edi, eax
call fcn.004034d4
mov edx, edi
mov ecx, ebx
mov esi, eax
call fcn.00401310
movzx ecx, al
mov edx, edi
push ecx
mov ecx, dword [esi]
push dword [ecx + 0x10]
mov ecx, ebx
call fcn.00401400
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00401da9
mov esp, ebp
pop ebp
ret 0x10
call fcn.004034d4
mov ecx, str.load
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401c57
test dl, dl
je 0x401c53
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401c57
add eax, 2
add ecx, 2
test dl, dl
jne 0x401c37
xor eax, eax
jmp 0x401c5c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401d11
push 0x44
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00402c50
add esp, 0xc
call fcn.004034ce
cmp dword [eax], 5
jne 0x401b41
call fcn.004034d4
mov esi, eax
call fcn.004034d4
mov ecx, eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [esi]
push 0
push 0
push 4
push 0
push 0
push 0
push dword [eax + 0xc]
mov eax, dword [ecx]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
call fcn.004034d4
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 1
mov eax, dword [eax]
push dword [eax + 0x10]
call fcn.00401400
mov edi, eax
add esp, 8
cmp edi, 1
jne 0x401cfb
push dword [esp + 0x1c]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x401cfb
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00401da9
mov esp, ebp
pop ebp
ret 0x10
call fcn.004034d4
mov ecx, str.dump
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d40
test dl, dl
je 0x401d3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d40
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d20
xor eax, eax
jmp 0x401d45
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401d90
call fcn.004034ce
cmp dword [eax], 4
jne 0x401b41
call fcn.004034d4
mov eax, dword [eax]
push dword [eax + 8]
call fcn.00403878
add esp, 4
mov esi, eax
call fcn.004034d4
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov ecx, esi
call fcn.00401920
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00401da9
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x6c]
mov eax, 0xfffffff7
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401da9
mov esp, ebp
pop ebp
ret 0x10