Function at 0x40267c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff764
mov eax, 0x478cbc
push ebx
push esi
push edi
mov esi, 0x4789fc
lea ebx, [ebp - 0x48]
call fcn.0046aaa8
mov eax, esi
call fcn.00477514
test eax, eax
je 0x4026b3
mov eax, esi
call fcn.00477514
cmp eax, 0x104
jl 0x4026c3
mov edx, dword [ebx]
mov dword fs:[0], edx
mov eax, edx
jmp 0x402902
push esi
lea edi, [ebp - 0x848]
mov esi, 0x478180
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop esi
mov edx, 0x4789f1
mov word [ebx + 0x10], 0xc
lea eax, [ebp - 4]
call fcn.00477268
inc dword [ebx + 0x1c]
lea edx, [ebp - 4]
mov eax, esi
call fcn.00477564
push eax
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0047739c
pop ecx
test ecx, ecx
je 0x4027d0
mov word [ebx + 0x10], 0x18
lea eax, [ebp - 0xc]
call fcn.0040290c
push eax
inc dword [ebx + 0x1c]
mov edx, esi
lea eax, [ebp - 8]
call fcn.00476f00
inc dword [ebx + 0x1c]
lea edx, [ebp - 8]
mov eax, 0x4789f3
pop ecx
call fcn.0047700c
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x14]
push edx
call fcn.0040290c
push eax
inc dword [ebx + 0x1c]
mov edx, 0x4789f5
lea eax, [ebp - 0x10]
call fcn.00476e8c
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x10]
pop ecx
pop eax
call fcn.00476f80
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.004772ec
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.004773c8
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0047739c
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00476f3c
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00476f3c
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00476f3c
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00476f3c
mov eax, 0x478a04
call fcn.00477514
test eax, eax
je 0x402856
mov word [ebx + 0x10], 0x24
lea eax, [ebp - 0x20]
call fcn.0040290c
push eax
inc dword [ebx + 0x1c]
mov edx, 0x478a04
lea eax, [ebp - 0x1c]
call fcn.00476f00
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x1c]
mov eax, 0x4789f7
pop ecx
call fcn.0047700c
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
call fcn.004772ec
inc dword [ebx + 0x1c]
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.00477410
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0047739c
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00476f3c
dec dword [ebx + 0x1c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00476f3c
mov eax, esi
call fcn.00477514
cmp eax, 0x400
jb 0x402872
mov edx, dword [ebx]
mov dword fs:[0], edx
jmp 0x402902
mov eax, esi
call fcn.004017e8
push eax
lea edx, [ebp - 0x848]
push edx
call sub.KERNEL32.DLL_lstrcpyW
push 0x44
push 0
lea ecx, [ebp - 0x88c]
push ecx
call fcn.0046a6a8
mov dword [ebp - 0x88c], 0x44
add esp, 0xc
lea edi, [ebp - 0x89c]
mov esi, 0x478980
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x89c]
lea edx, [ebp - 0x88c]
push eax
push edx
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x848]
push 0
push ecx
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x4028f9
mov eax, dword [ebp - 0x898]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp - 0x89c]
mov dword [0x48179c], edx
mov ecx, dword [ebx]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret