Function at 0x403680
Capabilities:
Create process on windows
Create thread
Get common file path
Resume thread

Disassembly:
sub esp, 0x194
mov eax, dword [esp + 0x1ac]
mov ecx, dword [esp + 0x198]
mov dword [0x413e14], eax
push ebx
mov ebx, dword [esp + 0x1a4]
push ebp
mov ebp, dword [esp + 0x1b0]
push esi
push edi
mov edi, dword [esp + 0x1b4]
mov dword [0x413e10], ebp
push edi
push ebx
mov dword [0x413e18], ebx
mov dword [0x413e08], ecx
call fcn.00403970
mov esi, eax
add esp, 8
test esi, esi
jne 0x4036e1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x194
ret
mov eax, ebx
and eax, 0x100
mov dword [esp + 0x14], eax
je 0x403737
mov edx, dword [esp + 0x1bc]
push 0
push edx
push ebp
push esi
call fcn.00404080
add esp, 0x10
test al, al
jne 0x403737
push str.unpatch_failed.
call fcn.00404510
mov eax, dword [0x413cf4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push eax
call esi
mov ecx, dword [0x413cf0]
push ecx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x194
ret
test bl, 0x48
jne 0x403745
test edi, edi
je 0x403745
cmp byte [edi], 0
jne 0x40374c
mov edi, dword [esp + 0x1ac]
test edi, edi
jne 0x403755
mov edi, 0x4139d0
push esi
call fcn.00403be0
add esp, 4
mov dword [esp + 0x10], eax
test bl, 1
je 0x40378b
lea edx, [esp + 0x9c]
push 0x104
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [esp + 0x9c]
push edi
push eax
push str._s__s
jmp 0x403792
push edi
push esi
push str.__s___s
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push 0x413d00
call ebp
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 0x18]
mov dword [0x413cf0], ecx
push 0x413cf0
mov dword [0x413cf4], ecx
push edx
mov dword [0x413cf8], ecx
mov dword [esp + 0x20], 0x44
push ecx
push ecx
push 0x24
push ecx
push ecx
push ecx
push 0x413d00
push esi
mov dword [0x413cfc], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40381f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x60]
push str.CreateProcess_d
push eax
call ebp
lea ecx, [esp + 0x68]
push ecx
call fcn.00404510
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret
lea edx, [esp + 0x9c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x9c]
push eax
call fcn.00404510
push esi
call fcn.00404510
push 0x413d00
call fcn.00404510
mov ecx, dword [0x413cf8]
add esp, 0xc
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40389d
push str.OpenProcess_failed.
call fcn.00404510
mov edx, dword [0x413cf4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push edx
call esi
mov eax, dword [0x413cf0]
push eax
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x194
ret
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4038f9
mov ecx, dword [esp + 0x1bc]
mov edx, dword [esp + 0x1b8]
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
push esi
call fcn.00403c80
add esp, 0x10
test al, al
jne 0x4038f9
push str.unpatch_failed.
call fcn.00404510
mov ecx, dword [0x413cf4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push ecx
call esi
mov edx, dword [0x413cf0]
push edx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x194
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x413cf4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [0x413cf0]
push ecx
push 0
push 0x403e90
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
test bh, 2
je 0x40393b
mov edx, dword [esp + 0x1c0]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00403d50
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x194
ret