Function at 0x404800
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415f30
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x85c
mov eax, dword [0x47e010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 4], 0
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x868], str.TzCruhSMR0f3rvzCOEblNbO1PtEb2FmNizRn1jHGz1NcrqiMEFvo5qhHv6yRM1lagwWLovXdeSefh1YYHSTLYSt1CbgYmaRaYAt4K3x27lVOUswYIt07DEEINd13rW0qjpDCLpCuF6tVfJBI974YE4qcPF94FWAFMbdGsjJwBUrXbAMe9XTM5JItM42mDxmMGAxmnKGKMywIvuqIBKRSoxNeRU9EUQOMYPzGu0HohLtn1IHx4HYszDgLvJ361NkOlFMzfyfmon8vrjEaOwKD1p03l7mcm15d9kiOue98Abq51iG1zCmdHIRNSNlEOmpGkmtU7f5hCEtdzGp9aj4mYblNSJQUFLHvaDB87A1ORaiFOI73l7Ad7s2vCxTN1QKsxM46iqh33AuiprrWrJ01Ek8LOR4UhqatsGK8K3KljsbvY0sXDKuHH7IWwEu3RqVrF5Gh5nfu3D6XdBCeNzrURKMN1c1ebQtbJx3jpQpLWmEyLxLNCql1iJdzO88EGNxtWraEmvORU9Rlmc6FwlN4A8KVLoUKPpk5n1tt5YVWaQrzH0gOHdDMVB44Wf996WoFQhzDer7E9FGJxtfaaKJFYoHw40Qd7M5py7qzKE4lciDMCGsh6RSNOGjMFq6quCAoCVQ7vVLkNIQgXWESMII2shzglB2NaiS1GaK9MKIaAxUlencAbIFzdxJoGWCrw2TnXiqogPovJbNkM5pyP8N6tQoF2omlnjTbRNd1yF3abz6ppo0yxbgJBi0Jnnno0RuL2eyzgvO7waTDmXY1h8hXTMPmsRkk7HA8h5WXRlEp5VXYlHFYdi8DBW0qFktQT8sTEU0wSXjiSmzkwIKaJXc3Vcs19KFt1EEmohnXIUo9EsBottcTrrXP4IViIEjFv66pUJOor0r7EqeIW5UijH8i4ipAoKldJPv7yKOBS2ORKj2Cigy9iMrVkavMSSAbTaCaUBI7uii6Gs0F2lVtE1iK9irKTOqNeaTctubmF062ViDdamujWRfyYUHIQopMtCHYm1AgrTqliy3LJn1DrA3ROPDjpMJ1qqNeuCwsgkjaMl25OAJnbhyVbouFstfyVvlzyyEgbbG6J3Y6uehpXSNE3zolehrIOVSFYUOHGXqbHpXVOCAAn9UEYSom9mqYTNm30C0wOJcSxuFXUa5ILDcj0soaVcX45i6gzqhaabEbkGqIVlxwGGEJAs1c7qPDNSgI8FXUzkQHHgY7t0ExsGJfsfHnW9cSpzC46dyo9mL33T37D3jsntBLwP0csJlJ44K3iPOyb7eVBKcn5QVbbf4z1yqRBnfjlF6ejFih2JR6SKQplhNuHyOGWVi8Uci2clg9JfqfTw6MWGU0fRpcRozT9xydycmyPF7njsBSLVYKtfIeVLq7G6VLjaUUdgKPQSGuMBemvwihI23oTNL7doxDWGIu9af57Se63nAFL2x9tu96Wpw1BrSAna5Key2JT9bN2RWv4jREa0IceFYH6KutLLL0T2OyAf7A9owlHxqqNEOjfzra8iTNPbSJp2auu0oWMPgNA75lVWaRxUtMnRn1uREoNxFTzsSf1wR5ablwRfchRvjbSiM5o0FlHNzl6uA3qSp0siFMF8EznrknvaR9c7uBah1WzTDgA8Pyes9PNqBspPRJ1Nducfc8CGuuGAef3eRPSfpjfeshuOs3bkfxsYuI22MmlpBHfU66AIHHmVU0puCsFBcTHoD3Jw4BEh8JCIVJatOp291e632xbh7fo3tJAIKUU5eRyTAj9C9IxMaeICmeiKVtF6qfRnFCEKpYnu8sOKDOvDUv7XRIlkpNADBvOStMQ7xJ9fzWNfkaVNhawn0ldrvnS5zMVs2DwIFlbgSsDKoXPPSoaU1KP6h5yfTk3YltcKsvBr8pea7iSbfwacnb1dFtOSXLVdFqVz0E3NNVrLdLtsS14MlMHo7GHio909gIgtb6h4OG3iJhzvimNeVuYYBsd85LjXqF1IDUcCFVHUU7Nl39GYT45XB4bAblz2rDuwN3RDmwWgjOtdG4rvP7n68onh8P8XD5k1QhsTnQgrKksxNOaa04nNGSpeAzXwlxAkHajXKVWXgQk0XhljvaKcjApcnmESnRVr0ABpa5VMV2p5AOhbtAJhP7X7VRRYyLQopPps6BoaW2LdhkCeuINeJo2PaRECSCxyhRnqkxCEP7TV1EpGCnQ7JsOqM0zwmkR76V8lw70YGwp0YHmaq8gLqelNHAIYSd0EXvknJsEJIdnKiMwC5Oq7NznHWHHUe6j1EdCHqGujhPq7THbmrqNahltEH5CK6fsryVHDoQcUQJEAGFQ0VbNYBjU5ia7x3moqHJhxUXbC5WJgqnntGuTKYeLb97lTwBjQNR3Rz0EhKgNLLYP4sYzGWLS0SMW1RBEU8Pf694qwcBpfNb4Jgp9RjyGisc5OO3KS0CbscxqHIXtEg97jSaXazsbYvAzlQpBhjz64X3NUbVi7n7s0d80Hgrpxmgmu87Ehw30L3sjQnmm0mWNcAL7L4IVrIMzPG78OD19JGRJft1WwycmRc3sUiIfdIE6GE6JqyS3sLwRX3C6Gq9Szaoq5T5UvTjAhmqK96zwMOWwT4QAlAMBpuEHvsEw18cuAebUFWnBQYPv5SnYaOLi538dLdsDwJE0sP9ufH7Da53FyeKCF1ufTDAbJ2KQTo03zUNhFO2cxxGRtfxzbe2buWYn6yX42MyQI3BHbkbp768nSug97aiCg5Kafsv6XFb4si6mI8kkPNUgJ5tru3DmrXbWjkBX1kF90VbbbiJI02GzWBbbD40MsHV3alxUVmDWXTXFxqLmQQjrw0qpjPO3hVBdUYfqsw4gJYJ3eGHuSGgbvhDa1NGVnQDCX6hcpBjQtNTfeRILTiGlUxEq2ejYHgpXYRO5Au9q5L0R3gPlUKmEPWE8pdAqMx9kRLJdM8KDdaJgFO1MgsF4jJgaXGwbDD0hODvQQzE7l4VqE059uaHHsftmgpgRL60PjCfuDTN
mov dword [ebp - 0x86c], str.yGgSWxCdi1yx1M1pgfUiU2jCnk2GT86VH0Rg3aCc524kbc82TSMDVcSyNxhJLmEUBKRa6MKKayAzsjKkk5ktONBw1IB1PHrIeBOndTWmij73dT9t22P14iWQ3UsyAA682Lb5NmLHg71yAzJrYvrWsp45VbDlljiG12kVxkpFRN4KvK5NEOdp2fIWJHnj8WWBFLu2jhHlVnqlDJPV4S5X5bjoxJgkKr3P0VOYk3a0hPCUrzQOJcTGdYVyqzifNwKYy4lK2NSaLjB36d6dHPn3eHeNvDQRBNmonhXPa0Dvf0IgAoGyxq80fJzDSpIVgFi71euaHrPWB9E0FGSYieEVDMVRIr38Fo7RydE5ThwAI8xJQu3ly1mH2UTo9no8s1y7B41rgWnJwlROn3KarbxClvKqlUHx2rtYgc4vzhJSVjxAjqEHyGlrIfoitQlTxnPk8Cb3TmzKSBPkruzU25QnBbmyL50JWpOIoTBdxDthmTqgkYrrvs26GFN1qwNvWTEoGdvE5THyiTmCkqoFawHHUozBFdhC03NkahWtnfaUGs7wwcDCGyEMyn7wKgjtlTMaxoPdv7lTyrw4Lvz6fotl5Xw9WPbnXkkh0tYSSfsdUQPiJnHxztGSfOy3veABD1fKhX9V8JiMNHDfMEH7SOIj5XA0KJBpStxkAVUfa1jMf90P53lIVYR2SHD1XOFV04jvH0LdaNAwloh0z3AVW9jQdHnguWEm4XOsRm7DxbSxaHjBV1w0J395RX69EGNKRcu4SNeL2yyAMsgrD6lVz1mtWMKfOIJ92yQT2FgmADCBm6IjSjqphVMcOOVolKuyUIzg8UixsvJLY8EUGtiO8icU61PyDBtVCcv9v3hY8wcpOaqVNeyf18eJDGmX59ub3hAe0a2InpV51RL1J51vf6qcDt017mK8P7VVXUjjfdxyK0QHMjA4HndktiTj9hOCqHMkiAIJ1jdNeocz06laMMUzQtPGD1Go0OxfnYMrgmOXDWI6cmuFmFIQHAg93MIav6Ha6vTiNqQqdEJHXVneR0JwfAfURRGCE1XjTamEKPtLbAWODpu7ehXqXJtqABInVP7BHulksirKOSsKmgsmSAhOBDjiIqm0AF6DYDWxxMbmmLKPYK2FNEqradKlNPx1Cu2KGk71UEKM8xGjb08usH6tUIpCmsATQ37XjQHTJARoozyokUOUPzPwpIAnWVe7LWIYQ5tOpxQMuk0eDjhNsF5Hs8b190w1ICngPt3OCRHKJk5W3IPEk1ay8cJdyv1XMjJTg3Ypld3iuddBfBWHY9j3KssMMkxfM6yKIrEzNx9A7DfeIcgUveDEVPaNrtp6kTOneNpJsaS3YpoLIyvSs09gxwmw9YgJNtyXpVqL6IPhulgceCz0TIIdI59nAYbjkm0vj9N0Hab63oQl36vhskbjRoh3pIzUPXuBzowczMJu6wy5FyttfeaPDE9njrjBXwyEk9sCgeXG3QaarnN2TvgtYoOsXzBqa5NGcumVzp06nwPlqMW7xKVp4uVw7v6jEv0rk6TjBBylyM9jqNuARavgo7P4uNKbmv6ppbBiFq4f4V3I4la03we5EMsJN40U3D8JCyVYpOwPqnSaH4RCKbfoRlrsQXDmdgiiGCbQH1Bl9AnbtwCpe3yciY0gohOf6yVEMkzQECDbK6Fhg5y3cE6Uqb2seO8lJyx4GfdoIxz1NzhVKS0TS4Dp6M2xbxxjW6HxDu7lx1YEQG6xl0n33XT3lWca2pnNhRdInK914D7aveqtgdhgXzrAt9jgEvpo2nX0dk7aviQLm4X2req3rJKj7dNTUYKDkV0tU4E1jcGV09MuBxFyKOcR5hNpE4W22IuUPpkffVMj5tm6gt1HKP1rvNYgL5T2JJKPLnBXimVIfayYDaB5JjmCMAKaaoU2PLho4xPLJHAg8nBkMCJYAnhsxM63KtGnvuEwA6dF6vOarnaauCPoFKGtIOF1tRjoEmCNIMSbaClUQufzhPr1QJpButKmhcgkXG5xlVQd1gva47ivuIhhxb9iiSiC8aopSB3JQr2bYWkMOK7VdycgExuoQsPw0wYND4H7cNdTEwqQQYUJhubMBOWe80AYTaFCcQk5M54GTc6DTpiKjrlnmDSzozq8OYvXkzoKATbiPrgCJMdOGdYembAE8BPiN1TPwHtV4u2VR7suaT5DypthAbc99RV0TmHd5tjadDWeDnV8XEDXPso9yYLbrpu0996221KEwJcj4ItCXX3qcCpafvgmlEWdDEHcbePl1ITJnXBg0SRE5YnlcftHrmkNrbvx8SHRd87xYhryTx2dHufqqgbIxyk7GaSQczExa4JaD7Kax7RC2R9RwdWlKDjFu2CSvG6qqezxjiU2NQ5mNGkLwijYtldgXoSkUtCe6Rk3fV0ez8OPxma12mDtjIGOiQeP41WrKPAwYwG5Lmxru8d79Kf9a7XvC9A2nbUavyRehPj6j4avI38ltriJdhWG83jr0IwhY1uUdYP09NWj10KDaXQtRcbU3r8BRaUjkNKL4rRFdeA6VG1DQsS0QgQYzg9YHTmxc4MqrWDgv694OG1JIBes8aKPUxSYX9hVKyEXbC451e4mMl1YqECoTSmEmne0RVe7GygXoUFEJuc4FSn7buHQFOLP8Ytkr8TudYtpsyCJFSLf8jBDGw0idAJVwAjfpp862iYJ1DIdSrpSxunGaLTExfCKPxN1ljUIowoSXAqgpj9X56uamOIkW5tgngpNvbnQ2kdcv8QcjFnoFFRDxOE9YLUEsf0JXcJDeROu3mHyGOT20xCntwMnuiikq4MUymrYKWu1jFm7B8TFxRWnse5NxXwSCmqnRu1sUVpvfLPMd1W7uDdjhRpztrc8rSV8fh9mvKB98KNIC235RIVAgTwnVEx2gqI8PdDGSU4xqXxjYJwepIJhgn4hNWrPtSBfvzt7QwBLU8Y5rP9cE9pcBWzRdUmUveMmUxL2OfYnDiHMc43zRjSOaMt9BxuTkOG6raQ6FC13LUyTYmDKuC9kywDlxtnJt9z7Jqg18Ro4zbfLQo9AoM2NWGw3HMjz2zfD3SeHHY78XfJDrM9LojGaY7dblaNiLjJqSkUjiN1xfNfG3Fjf0pGGuaQ06MKpjOzHdGc0GRWYNpA2lYruPichiM1wWJEL6aN6khY9EnE31jmkD3VLPLhwqQf1QquvAblaucdg3pWF3beSCbN0WrePglBHqK3xNPdQO248nhFTrBEK8pzH2lDXRncTEzUCSKVIlM1UItFQ9aPQ9uiUMXlXVi63VEqm8fyQ0UL7SFOHtnJXKPuiOfqdNFsA2LH9XnEWAmkwfNXIaH8DeAh5FBisrep67BBdXSigOuUgQW2hiBuiXAd4GRxIuW6cINMEQc4Eg85OpqULpq78upoCcm5paYHCOYClss6xpzAWeKxImv0ftgrImP6coFn9KHj0Nx0TCxuNhCRHs90wJ7vTfv07HBmEdtMc1YTlce6ObXPnnzDEfCdiN2uyhyP5mKIjm3u0fg0KaTpu9Xhc58JyTwxbVs3tFXCxhGTCPL3J8KAPgv1wtIK0fyn28weU4uGVizQuSgkbB2okwgHPO9tsvbuqX7FBOEVl83xxfKePLuOUdhYaDRAmaOD3cOCMBH7sCdFcBHpOq2TGVAenz4kHFsPTbpnOwTLOJOuxA1Kx2OHJG8D8rBr6irojVSg61qbKBmJbG3rIEbhhTO7Wa5bGeCRVapA8WpqsuYGjiCUr4DICnwmbPJjdAi4L8pHvxVjUMB7JFYT7CX75i3O0FB91jc57NsXQr3rY2LkM0Qksk6A9eaJo2ksXivhCKnITGLbjUN8pkqsxQchj9B6bqjBygSfgd9ntF1CogFP8CjMIuAiaq3D2vEoPRsUk2XlrcHGx26j2IA6IbROpN7Uq29brEJorKh1MuG1TlrUNlNoAuK2LqnbEWhPz3L7yuEPx7M2rpOvE7UYGDf76OovRjgJ2m0LY3WgP2KTYE2usynsItuhiTDI3kYNbNkhiP9KPEiB9zALA45BIwRKl1ynXl5qWu9SrWuMQH5QnPHK3Vny1UVKjPxQfQQxSng3H5nRelK7Yhhonl3Ei
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.00409d40
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x85c]
call fcn.00406d00
mov dword [ebp - 0x864], eax
push 0x47f4b4
lea ecx, [ebp - 0x858]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
mov edx, dword [ebp - 0x864]
push edx
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x404901
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a59e
mov esp, ebp
pop ebp
ret 4