Function at 0x402fb0
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x146c
call fcn.00412860
mov eax, dword [0x444624]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1414]
push edi
mov edi, dword [ebp + 8]
push 0x1000
push 0
push eax
call fcn.004140a0
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004140a0
add esp, 0x18
lea eax, [ebp - 0x414]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x403056
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x403056
test esi, esi
je 0x40306b
cmp word [esi], 0
je 0x40306b
push esi
push edi
push str._s__u__s__s
lea eax, [ebp - 0x1414]
push 0x800
push eax
call fcn.00407110
add esp, 0x14
test eax, eax
jns 0x403116
pop edi
mov eax, 0xe
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.0041284a
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004140a0
lea ecx, [ebp - 0x20c]
mov esi, edi
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4030b0
movzx eax, word [esi + ecx]
test ax, ax
je 0x4030b0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x403092
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
jne 0x4030c9
mov dword [0], ecx
jmp 0x4030c1
push str..inf
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push edi
call esi
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push edi
push str._s__u__s__s
lea eax, [ebp - 0x1414]
push 0x800
push eax
call fcn.00407110
add esp, 0x14
test eax, eax
js 0x403056
lea eax, [ebp - 0x1428]
mov dword [ebp - 0x1468], 0
push eax
lea eax, [ebp - 0x146c]
mov dword [ebp - 0x1464], 0
push eax
push 0
push 0
push 0x4000004
push 1
push 0
push 0
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x1460], 0
push eax
push 0
mov dword [ebp - 0x145c], 0
mov dword [ebp - 0x1458], 0
mov dword [ebp - 0x1454], 0
mov dword [ebp - 0x1450], 0
mov dword [ebp - 0x144c], 0
mov dword [ebp - 0x1448], 0
mov dword [ebp - 0x1444], 0
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x143c], 0
mov dword [ebp - 0x1438], 0
mov dword [ebp - 0x1434], 0
mov dword [ebp - 0x1430], 0
mov dword [ebp - 0x142c], 0
mov dword [ebp - 0x146c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403210
call dword [sym.imp.KERNEL32.dll_GetLastError]
or ecx, 0xffffffff
test eax, eax
pop edi
cmovne ecx, eax
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.0041284a
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1424]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x1428]
call esi
test eax, eax
je 0x40325c
push 1
push dword [ebp - 0x1428]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40325c
push eax
push dword [ebp - 0x1428]
call esi
test eax, eax
je 0x40325c
nop
mov dword [0], 0
jmp 0x403250
lea eax, [ebp - 0x1418]
mov dword [ebp - 0x1418], 1
push eax
push dword [ebp - 0x1428]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x403289
cmp dword [ebp - 0x1418], 0x103
jne 0x403293
mov dword [ebp - 0x1418], 1
push dword [ebp - 0x1424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test eax, eax
je 0x4032d0
push dword [ebp - 0x1428]
call esi
test eax, eax
je 0x4032d0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1418]
xor ecx, ebp
pop edi
pop esi
call int.0041284a
mov esp, ebp
pop ebp
ret
mov dword [0], 0
jmp 0x4032d0