Function at 0x45e010
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x45e294
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, 0x110
call fcn.00404b5c
mov eax, dword [ebp - 8]
call fcn.004049d0
push eax
push 0x110
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 8]
call fcn.004085f4
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 8]
call fcn.004045a8
lea eax, [ebp - 0xc]
mov edx, 0x110
call fcn.00404b5c
mov eax, dword [ebp - 0xc]
call fcn.004049d0
push eax
push 0
push 0x45e2a4
mov eax, dword [ebp - 8]
call fcn.004049d0
push eax
call sub.kernel32.dll_GetTempFileNameA
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0xc]
call fcn.004085f4
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0xc]
call fcn.004045a8
xor edx, edx
push ebp
push 0x45e263
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0xc]
call fcn.004049d0
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45e225
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetHandleInformation
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0xc
call fcn.004030fc
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x44
call fcn.004030fc
mov dword [ebp - 0x60], 0x44
mov word [ebp - 0x30], 0
mov dword [ebp - 0x34], 0x101
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x10
call fcn.004030fc
mov dword [ebp - 0x70], 0xffffffff
mov dword [ebp - 0x6c], 0xffffffff
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, esi
call fcn.004049d0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x45e1a9
call fcn.00403f4c
call fcn.00403f4c
jmp 0x45e26c
xor edx, edx
push ebp
push 0x45e207
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x7530
mov eax, dword [ebp - 0x70]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x45e1dd
call fcn.00403f4c
call fcn.00403f4c
call fcn.00403f4c
jmp 0x45e26c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e20e
mov eax, dword [ebp - 0x70]
cmp eax, 0xffffffff
je 0x45e1f8
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x6c]
cmp eax, 0xffffffff
je 0x45e206
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e29b
lea eax, [ebp - 0x7c]
mov edx, 3
call fcn.00404534
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404534
ret