Function at 0x408870
Capabilities:
Create process on windows
Create process suspended

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x1bc]
push ebx
lea ebx, [ebp - 0x11c]
push ecx
sub esp, 0x1c8
call fcn.00401dc0
sub esp, 4
push 0x104
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 4
push ebx
push 0x40d060
call sub.msvcrt.dll_strcpy
mov dword [esp], 0x40d060
call sub.msvcrt.dll_strlen
mov dword [eax + 0x40d060], 0x5c2e2e5c
mov byte [eax + 0x40d064], 0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
pop edx
pop ecx
mov ecx, 0x10
mov dword [ebp - 0x1c0], 0x44
add eax, ebx
mov dword [eax], 0x5c2e2e5c
mov dword [eax + 4], 0x77786462
mov dword [eax + 8], 0x6578652e
mov byte [eax + 0xc], 0
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0
push eax
lea eax, [ebp - 0x1c0]
push eax
push 0
push 0
push 0x12
push 0
push 0
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebx
pop esi
test eax, eax
je 0x408b92
mov eax, dword [ebp - 0x1d0]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov dword [0x40d040], 0
lea esi, [ebp - 0x17c]
mov edi, dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
mov dword [0x40d048], eax
mov eax, dword [ebp - 0x1cc]
mov dword [0x40d044], eax
lea esi, [esi]
sub esp, 8
push 0xffffffffffffffff
push esi
call ebx
pop edx
pop ecx
test eax, eax
je 0x408a12
cmp dword [ebp - 0x17c], 9
ja case.0x4089b5.0
mov eax, dword [ebp - 0x17c]
jmp dword [eax*4 + 0x40a1d0]
sub esp, 0xc
push str.Unknown_debug_event._r_n
call fcn.00408830
add esp, 0x10
mov eax, dword [0x40d040]
test eax, eax
jne 0x408a6e
sub esp, 4
push 0x10002
push dword [ebp - 0x174]
push dword [ebp - 0x178]
call edi
pop eax
jmp 0x408998
sub esp, 0xc
push str.Debuggee_was_terminated._r_n
call fcn.00408830
mov ecx, dword [0x40d040]
add esp, 0x10
test ecx, ecx
jne 0x408a6e
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0xc
push dword [ebp - 0x1cc]
call ebx
push dword [ebp - 0x1d0]
call ebx
push str.exit_r_n
call fcn.00408830
add esp, 0x10
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
sub esp, 0xc
push str.A_thread_was_terminated._r_n
call fcn.00408830
mov edx, dword [0x40d040]
add esp, 0x10
test edx, edx
je 0x4089d9
sub esp, 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp], str.DebugSetProcessKillOnExit
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edx
push 0
call eax
pop ecx
pop ebx
push 0x10002
push dword [ebp - 0x174]
push dword [ebp - 0x178]
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
pop esi
jmp 0x408a12
sub esp, 0xc
lea eax, [ebp - 0x170]
push eax
call fcn.00401a60
add esp, 0x10
jmp case.0x4089b5.6
sub esp, 0xc
push str.A_new_thread_was_created._r_n
call fcn.00408830
mov eax, dword [0x40d040]
add esp, 0x10
test eax, eax
je 0x4089d9
jmp 0x408a6e
sub esp, 0xc
push str.A_RIP_EVENT_occured._r_n
call fcn.00408830
mov eax, dword [0x40d040]
add esp, 0x10
test eax, eax
je 0x4089d9
jmp 0x408a6e
sub esp, 0xc
lea eax, [ebp - 0x170]
push eax
call fcn.00401c80
mov eax, dword [0x40d040]
add esp, 0x10
test eax, eax
je 0x4089d9
jmp 0x408a6e
sub esp, 0xc
push str.Debuggee_outputed_debug_string._r_n
call fcn.00408830
mov eax, dword [0x40d040]
add esp, 0x10
test eax, eax
je 0x4089d9
jmp 0x408a6e
sub esp, 0xc
push str.A_dll_was_unloaded._r_n
call fcn.00408830
mov eax, dword [0x40d040]
add esp, 0x10
test eax, eax
je 0x4089d9
jmp 0x408a6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push edi
push eax
push str.CreateProcess_failed:_0x_x_r_n
call fcn.00408830
add esp, 0x10
or eax, 0xffffffff
jmp 0x408a3a