Function at 0x4044b9
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45948a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
mov dword [ebp - 0x90], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00401de0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00401de0
mov byte [ebp - 4], 2
push str.disk
mov eax, dword [ebp - 0x90]
add eax, 4
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.0043fcb7
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x98], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x98]
push eax
lea ecx, [ebp - 0x30]
call fcn.0043fb5b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.0043fa22
push str.anyue
mov ecx, dword [ebp - 0x90]
add ecx, 4
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.0043fcb7
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xa0]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0043fb5b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x84]
call fcn.0043fa22
mov dword [ebp - 0x7c], 0
push 0x10
push 0
lea edx, [ebp - 0x1c]
push edx
call fcn.00423570
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x78]
push eax
call fcn.00423570
add esp, 0xc
mov dword [ebp - 0x78], 0x44
mov word [ebp - 0x48], 5
mov dword [ebp - 0x4c], 1
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x24]
call fcn.00401de0
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push str._fatherpressID__d__fatherProcessid__d
lea eax, [ebp - 0x24]
push eax
call fcn.0043c5ee
add esp, 0x10
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp + 8]
call fcn.0043fe3a
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0x30
push 1
push 0
push 0
lea ecx, [ebp + 8]
call fcn.00401e00
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x404678
push 1
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00403858
add esp, 8
test eax, eax
je 0x404664
mov dword [ebp - 0x7c], 1
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
lea ecx, [ebp - 0x34]
call fcn.00401e00
push eax
lea ecx, [ebp - 0x30]
call fcn.00401e00
push eax
call fcn.00402b47
add esp, 0xc
test eax, eax
jne 0x4046dd
mov dword [ebp - 0x88], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0043fa22
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.0043fa22
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0043fa22
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043fa22
mov eax, dword [ebp - 0x88]
jmp 0x40473a
call fcn.0040430f
cmp eax, 1
jne 0x4046ec
call fcn.00404190
cmp dword [ebp - 0x7c], 0
je 0x4046f7
call fcn.004020ae
mov dword [ebp - 0x8c], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0043fa22
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.0043fa22
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0043fa22
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043fa22
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4