Function at 0x4307da
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6e8
mov eax, dword [0x4590c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x44
pop ebx
xor eax, eax
push 0x104
push eax
lea eax, [ebp - 0x109]
push eax
mov edi, ecx
mov dword [ebp - 0x1c0], 0x1e00b768
mov dword [ebp - 0x1bc], 0x2e800
mov dword [ebp - 0x1b8], 0xe0ff0000
mov dword [ebp - 0x1b4], 0x83ec8b55
mov dword [ebp - 0x1b0], 0xa1640cec
mov dword [ebp - 0x1ac], 0x30
mov dword [ebp - 0x1a8], 0x408b5753
mov dword [ebp - 0x1a4], 0x14408b0c
mov dword [ebp - 0x1a0], 0x8b008b
mov dword [ebp - 0x19c], 0x8b10788b
mov word [ebp - 0x198], 0x3c47
mov byte [ebp - 0x196], 0x8b
mov byte [ebp - 0x195], bl
mov dword [ebp - 0x194], 0xc7037838
mov dword [ebp - 0x190], 0x8b24488b
mov dword [ebp - 0x18c], 0xcf031c58
mov dword [ebp - 0x188], 0x320508b
mov dword [ebp - 0x184], 0x18408bdf
mov dword [ebp - 0x180], 0x4d89d703
mov dword [ebp - 0x17c], 0x89c933f4
mov dword [ebp - 0x178], 0x4589f855
mov dword [ebp - 0x174], 0x74c085fc
mov dword [ebp - 0x170], 0x148b564c
mov dword [ebp - 0x16c], 0x3f6338a
mov dword [ebp - 0x168], 0x84028ad7
mov dword [ebp - 0x164], 0x691f74c0
mov dword [ebp - 0x160], 0x101f6
mov dword [ebp - 0x15c], 0xc0b60f00
mov dword [ebp - 0x158], 0xe0c1f003
mov dword [ebp - 0x154], 0x42f03310
mov dword [ebp - 0x150], 0xc084028a
mov dword [ebp - 0x14c], 0xfe81e975
mov dword [ebp - 0x148], 0xeec1e396
mov dword [ebp - 0x144], 0x3b410b74
mov dword [ebp - 0x140], 0x1873fc4d
mov dword [ebp - 0x13c], 0xebf8558b
mov dword [ebp - 0x138], 0xf4458bc9
mov dword [ebp - 0x134], 0x4804b70f
mov dword [ebp - 0x130], 0x383048b
mov dword [ebp - 0x12c], 0xff0574c7
mov dword [ebp - 0x128], 0xd0ff0875
mov dword [ebp - 0x124], 0x30a1645e
mov dword [ebp - 0x120], 0x5f000000
mov dword [ebp - 0x11c], 0x8488b5b
mov dword [ebp - 0x118], 0x8b3c418b
mov byte [ebp - 0x114], bl
mov dword [ebp - 0x113], 0xc1032808
mov dword [ebp - 0x10f], 0xc25de58b
mov word [ebp - 0x10b], 4
call fcn.00433270
push ebx
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.00433270
add esp, 0x18
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0x40c]
push eax
mov dword [ebp - 0x40c], ebx
xor ebx, ebx
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
push ebx
push str.kr100928.bin
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x430ba3
mov ecx, dword [ebp - 0x6e0]
call fcn.0042fdb9
mov esi, eax
test esi, esi
je 0x430b51
mov byte [esi], bl
mov ecx, dword [edi + 0x2b4]
imul ecx, ecx, 0x188
add edi, 0x2bc
push 0x188
add ecx, edi
push ecx
lea eax, [esi + 1]
push eax
call fcn.00432b20
push str..dll
mov edx, 0x104
lea ecx, [ebp - 0x3c8]
call fcn.0042ffd8
mov edi, 0x2000
push edi
push ebx
mov ebx, 0x45d760
push ebx
call fcn.00433270
add esp, 0x1c
lea eax, [ebp - 0x3c8]
push 0
push 0
push edi
push ebx
push eax
call fcn.004333dc
pop ecx
push eax
lea eax, [ebp - 0x3c8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 0x109]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 4
push 0x3000
push 0x1bb
xor ebx, ebx
push ebx
push dword [ebp - 0x6e8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
lea ecx, [edi + 0xb7]
mov dword [ebp - 0x1bf], ecx
test edi, edi
je 0x430b51
push 0x2cc
lea eax, [ebp - 0x6d8]
push ebx
push eax
call fcn.00433270
add esp, 0xc
lea eax, [ebp - 0x6d8]
push eax
push dword [ebp - 0x6e4]
mov dword [ebp - 0x6d8], 0x10002
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x6d8]
push eax
push dword [ebp - 0x6e4]
mov dword [ebp - 0x628], edi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push ebx
push 0x1bb
lea eax, [ebp - 0x1c0]
push eax
push edi
push dword [ebp - 0x6e8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push dword [ebp - 0x6e4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test esi, esi
je 0x430b9c
jmp 0x430b6b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi], 0
je 0x430b63
mov eax, dword [0x45c04c]
test eax, eax
je 0x430b86
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x45c04c], ebx
mov eax, dword [0x45c050]
test eax, eax
je 0x430b9c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45c050], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x3c8]
push str.Cant_execute_kr100928.bin__ErrorCode:_d.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x3c8]
push 0x30
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [edi + 0x268]
push 1
mov eax, dword [ecx]
call dword [eax + 0xd8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00432b05
leave
ret