Function at 0x401550
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push rbp
sub rsp, 0x290
lea rbp, [rsp + 0x80]
call sym.__main
lea rcx, str.Creating_process...
call sym.printf
lea rax, str.C:WindowsSystem32_notepad.exe
mov qword [rbp + 0x208], rax
mov rcx, qword [rbp + 0x208]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x4015ff
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Fail__d_
call sym.printf
mov eax, 0xffffffff
jmp 0x4018be
lea rcx, str.Success
call sym.puts
mov rax, qword [rbp + 0x160]
lea rdx, [rbp + 0x130]
mov qword [rsp + 0x20], 0
mov r9d, 0x30
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.NtQueryInformationProcess
mov dword [rbp + 0x204], eax
mov rax, qword [rbp + 0x138]
add rax, 0x10
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x128], 0
mov rax, qword [rbp + 0x1f8]
mov rdx, rax
lea rcx, str.Reading_memory_at__p...
call sym.printf
mov rax, qword [rbp + 0x160]
lea rcx, [rbp + 0x128]
mov rdx, qword [rbp + 0x1f8]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
jne 0x4016c9
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Fail__d_
call sym.printf
mov eax, 0xffffffff
jmp 0x4018be
lea rcx, str.Success
call sym.puts
mov qword [rbp + 0x120], 0
mov rax, qword [rbp + 0x128]
add rax, 0x3c
mov qword [rbp + 0x1f0], rax
mov rax, qword [rbp + 0x1f0]
mov rdx, rax
lea rcx, str.Reading_memory_at__p...
call sym.printf
mov rax, qword [rbp + 0x160]
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x1f0]
mov qword [rsp + 0x20], 0
mov r9d, 4
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
jne 0x401760
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Fail__d_
call sym.printf
mov eax, 0xffffffff
jmp 0x4018be
lea rcx, str.Success
call sym.puts
mov rax, qword [rbp + 0x120]
mov edx, eax
mov rax, qword [rbp + 0x128]
add rax, rdx
add rax, 0x28
mov qword [rbp + 0x1f0], rax
mov rax, qword [rbp + 0x1f0]
mov rdx, rax
lea rcx, str.Reading_memory_at__p...
call sym.printf
mov rax, qword [rbp + 0x160]
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x1f0]
mov qword [rsp + 0x20], 0
mov r9d, 4
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
jne 0x4017f8
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Fail__d_
call sym.printf
mov eax, 0xffffffff
jmp 0x4018be
lea rcx, str.Success
call sym.puts
mov rax, qword [rbp + 0x120]
mov edx, eax
mov rax, qword [rbp + 0x128]
add rax, rdx
mov qword [rbp + 0x1f0], rax
mov rax, qword [rbp + 0x128]
mov rdx, rax
lea rcx, str._nImageBaseAddress_:__p_n
call sym.printf
mov rax, qword [rbp + 0x1f0]
mov rdx, rax
lea rcx, str.entrypointAddress_:__p_n
call sym.printf
lea rax, [rbp - 0x30]
lea rdx, [0x004050b0]
mov ecx, 0x141
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp + 0x160]
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp + 0x1f0]
mov qword [rsp + 0x20], 0
mov r9d, 0x141
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
lea rcx, str.Resuming_suspended_process...
call sym.puts
call sym.getchar
mov rax, qword [rbp + 0x168]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov eax, 0
add rsp, 0x290
pop rbp
ret