Function at 0x402ac0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414030
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x858
mov eax, dword [0x463090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
push str.CREATE_SUSPENDED
mov ecx, dword [ebp - 0x85c]
call fcn.00402680
mov dword [ebp - 0x868], str.PvnvDUdDiCm7cOklhGv4dL8dtSeT0BTllKpFFD752ScLA4AnUxQdrdxmF2DaOyOhTROHqB7LlRE3KvjoDPuUsBOrDiWr7B2dlT78JPOrhGOgGY58zaXIhWqBva1ROlJ4DxkYlP29xHMPMhfb2SlIQJ4m2mHChiTzTg2VQxRitsHfN8SWs3bAWSJtCLTXbThkobhcKnIA1HF2UgTGomwBiKG7kuugFBmIuaFAsac5PoSPFjUszi0CtcqJPQoVeNrYKJiugdca9Hto2Rl9QXI3XtL6slvsJNwcO9LQjjSwRXDsjwludghS8kImcGNsvTrexmfdHDIcwLAVgMQ3MHQHgWCWCNeyckKMP1lGnQnyjSwLY6zbRz4FtX3DYNKvQiNrPtgYc7Oh2gFXYTY6RO6vQuQxd0m8WUEyLODmSWhn95hDbxiQl5Exi485MW5kkkdk0MHG5pfcLICYPmwi0LVFEGg2UmT2ex5L3Q9mjWuqDMXfEDq8EUDkCNTro9RlgAFLAbcqXw2381BLHBwRjj1APkVLFu2msq90pEBrmv9pgrQYqr8Q4qN4KCyJRGsieWqXsRDAGIpaHd1mHhihcrhXMudqFifql2c0N43A2sEhKKsuKdP97ee4ddzeu4s71tViGf8MmuV6mDw2ehlhknVIcuERkVfPO5RQr6G3xYCf7GzG8ucmxbdRNvEpP4I4JxXsB03SkAlGfS1iTMvPzCo3XS5ejM1p6yYON33knqXIArfIk5a4oojkxII3GGiyFJsnN310c2E0GLFWCcOc7TlngvATyvKgAFFryvQ9fpOrEtJ0lYSaWfmsJg0a8dylpSGb7AUwO39ljnR0vbzNjdKoupvxfXVI2SixGe8w8Pzk4uz9rvNJIkpzUQV2ra6nL76jC1S4hajk03iJVCiqPML1jUo0OlhnkWs8ph7GfOQANsx68by8tvKgRpf8biKROKsrF2guV7VJQmOFyHO1z7PrEz6qV0L4HO1vaXi96KzG7zFX9L6XeUYiD8Qe9DBhRpJtOxGUoU1Ff8CAfPaNGVE6FdFcwAASzI4eGPrDnfQiuhfcwlz6hSSJvsYlpr2kuUazVI3IvNPrMs6w7FCiydaFMTsYM0faF7Y5UGxa6a5mFiMpvapC93xU154JhgAYwnea60swmjTCmFUKz7LcPex6DW2C8oquTIn64zQXrFT7EA5wALiTzgfnWVPVhP8r18EUB4hckaX33kWMeknuqqdxaUehf96Htx5zBMQwU8dYFlaFyV8wBEyUmedEebKbiNrK6OaQ0n4Lgiop0IuptzSrwD6l3UvTQKf3fSjBeaaEd2jhoH6mvyjCvnqWbzNUVdNOnrWQdcr8zDDEXWpqmDtv790rIA6pHRcjVEednD762m3XmnCuOAyLX5U4ryRBJsfywnNQ58CHSFkMyUGhLRcDBMurHiAPYAxqSaPyyHIu6gaFXsljhDAVuinvyQMtMStBSh3GWUnih0mknN7WyKs2V7pvFsX0RSaEyGE9hJRiFXGwXKeoWM0T9cL3lwEXo7vU34mtqAH09rV5k1JFT1W7eWP1xGq0P09yFNpKemHdfVSUnhpB4qzLceiFPNON8WxCQWzCmnS776p3vbPTcFDzUl5AuTrazmRVai7kprBcxPjwrkl3b8oNc4oFmeRWPx5amjPIQMqf1gsvkf0o4UFkFCI9XeJ60JUNhd1a38epzFIeGrF52NKAUFMyszECxbRcURvDfA6bYyY0qmX6qhvAolBMD5hDk4btrQCHBLrlzCacQojiGweVqeq3VPgiAvRC8vdv9KT1nL9hEUPhqtOLflMTr5hQ0AItoMEJO2pF29TNVesyoGCRYaudQi2EyljENpPHpy85O2moaARpstyyEEB9x8d7HLWC4M9fDLvlGWtJddwXER0I9csgutyHfNHF22uO8vgUbCgBlhCcayTRgCEpmoMYolqUGVksk6mzw0FRbTaRhWF4Gf2Jq9GBJeKla1zKDk5nzaKsN9TCsbiUYNIMBeYjgg3HHuGSlqSMNtwnB4kTh3cFDv8osjvRlcsBKiFCz4Awmt1HrBJWt6p700UHbi1bKKTtQ20hpmdH0RiDuJaRUwoCkp0eDgmcDz4BF3GLLU5G9CqonkqCBhb9IiyMhulVyim44lgBvMJfRRwj5d6UHYjdfF3wguPxrs1LYGJQkr2rPWEM0cwnvXOWN0dUkWGaBB1tyuH9QP5DnqYjT1Norih1dd1LTLN7Nb5L2UcIAmeAv2BqWoOd5FKH9FIe042H8EJ2NLOnVR9kNKHLHWdS9yPPfdPJl9jo5mfvoCGuaFHdxIr46inkt6EPW896evzExECguIo2sx4YBiY6u1tg58OHD9IrDQJ5NOHaT14xTEGEx4yJABse5fs2ArPbb8Mkx63WA9o8qHfAxMlVvw1CKEgXVF687rF9OFY9EuuuTNHtoqBIMcCDxlneJUlmj6nl5HB9k64T3vikA9ydh0wkXYu9VKHkiEVNbgN8YKjdvQwudmuykfGxKTOBk8wLgOlwmqa98SVQNj8D0BF3zdTXJd55EysM1wDweb82sGaOkOaLlHn06aF9SEuBvTqM0TSWNuPuJ3JIpKTegCVQmejpkHOOnxAvii70vhd1VvUGeWSEqxF6dASWjykTFho3FgsY8oWX6ntuQHW38SUiUjdKf5MEFoxLtwXeQEwvtCGrhKcIjd176sRFGSvqwA0rI3McfO9CqVnqmiXizmmgK0elidh9i3155X3ojDO9rHRVQYSL8ikzlUqiT6smWo56PDRqoLhJa1Y1oUOpQfkTD5kOtdR8jHWdUCpXeQ4SoG4iwDVSeBLfPnA38WS87vGqUFRLYsrR3b00GbD7r15CxADY5pmDYMz93LrFa8uRbIaTbYCoffIbIuEqJqHrq0b2b4jzIl1N1drneXOk5l95KNBYBsOXR1j9MVHsWyAvSghmTvsQ2xQCnbc9nK8dzb6P1WRpyaAAibzodp1fMekaLfTaQcyHJiSK
push 0x400
lea eax, [ebp - 0x814]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44
push 0
lea ecx, [ebp - 0x858]
push ecx
call fcn.00408490
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x85c]
call fcn.00403e40
mov dword [ebp - 0x864], eax
push 0x4651f0
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x864]
push ecx
lea edx, [ebp - 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x402baf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406bf9
mov esp, ebp
pop ebp
ret 4