Function at 0x4021f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e63d
mov eax, dword fs:[0]
push eax
sub esp, 0x124
push ebx
push esi
push edi
mov eax, dword [0x456ea4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x4e84
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0x7d0
lea ecx, [ebp - 0x38]
call fcn.004067a0
lea ecx, [ebp - 0x3c]
call fcn.00406900
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x40]
call fcn.00406960
mov byte [ebp - 4], 1
push 0x44
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.00425f70
add esp, 0xc
mov dword [ebp - 0x84], 0x44
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov word [ebp - 0x54], 0
mov word [ebp - 0x52], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x128]
push eax
call fcn.00406770
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
push str._H:_M:_S
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406800
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x130]
push edx
lea ecx, [ebp - 0x3c]
call fcn.00406a00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
call fcn.004069e0
mov eax, dword [ebp - 0x3c]
push eax
push str._nStart_CreateProcess:____s_
push 9
push 0x45858c
call fcn.00416150
add esp, 0x10
push str.________________________________
push 9
push 0x45858c
call fcn.00416150
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str.called_line:__s
push 9
push 0x45858c
call fcn.00416150
add esp, 0x10
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x84]
push ecx
push 0
push 0
push 0x400
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.00406ab0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40248a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00406770
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
push str._H:_M:_S
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406800
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x130]
push edx
lea ecx, [ebp - 0x3c]
call fcn.00406a00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.004069e0
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push str.error_by_CreateProcess:__d____s_
push 9
push 0x45858c
call fcn.00416150
add esp, 0x14
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x110], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004069e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004069e0
mov eax, dword [ebp - 0x110]
jmp 0x4028ae
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 0xc]
push eax
push str.5018
lea ecx, [ebp - 0x98]
push ecx
call fcn.00404a50
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x98]
call fcn.00406b20
test eax, eax
jle 0x4024cc
mov dword [ebp - 0x18], 0x927c0
jmp 0x4024d3
mov dword [ebp - 0x18], 0x1b7740
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00406930
mov byte [ebp - 4], 5
push 0
push str.TIMEOUT
lea ecx, [ebp - 0x9c]
call fcn.00405b30
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jle 0x402567
mov eax, dword [ebp - 0xa0]
add eax, 8
push eax
push 0
lea ecx, [ebp - 0x9c]
call fcn.00405970
lea ecx, [ebp - 0x9c]
call fcn.00406a90
push eax
call fcn.00425f5c
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jl 0x402565
cmp dword [ebp - 0x1c], 0x3c
jg 0x402565
mov eax, dword [ebp - 0x1c]
push eax
push str.Default_TIMEOUT_value_was_changed_to__d_minutes
push 0xb
push 0x45858c
call fcn.00416150
add esp, 0x10
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xea60
mov dword [ebp - 0x18], eax
jmp 0x402576
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, 0xea60
div ecx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x10], 0x103
je 0x402658
lea eax, [ebp - 0x10c]
push eax
call fcn.00406770
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
push str._H:_M:_S
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406800
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x130]
push edx
lea ecx, [ebp - 0x3c]
call fcn.00406a00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x104]
call fcn.004069e0
mov eax, dword [ebp - 0x3c]
push eax
push str.GetExitCodeProcess:__nRet_STILL_ACTIVE____s_
push 9
push 0x45858c
call fcn.00416150
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x100], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9c]
call fcn.004069e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.004069e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004069e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004069e0
mov eax, dword [ebp - 0x100]
jmp 0x4028ae
mov eax, dword [ebp - 0x1c]
push eax
push str.maximum_waiting_time__d_minutes
push 0xa
push 0x45858c
call fcn.00416150
add esp, 0x10
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40278c
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x18]
jb 0x40278a
lea eax, [ebp - 0xfc]
push eax
call fcn.00406770
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
push str._H:_M:_S
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406800
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x130]
push edx
lea ecx, [ebp - 0x3c]
call fcn.00406a00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf4]
call fcn.004069e0
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
push str.Timeout_by_WaitForSingleObject_while_waiting_on_external_process_with_ProcId:__d__T_s
push 2
push 0x45858c
call fcn.00416150
add esp, 0x14
lea ecx, [ebp - 0x98]
call fcn.00406b20
test eax, eax
jle 0x40277c
push 0x12034
push 0x442b58
lea ecx, [ebp - 0x98]
call fcn.00406a90
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40277a
push str.Timeout_by_call_exe_while_launching_external_process__skip_by_User__
push 1
push 0x45858c
call fcn.00416150
add esp, 0xc
mov dword [ebp - 0x14], 0x4e85
mov dword [ebp - 0x28], 1
jmp 0x40278a
mov dword [ebp - 0x14], 0x4e85
mov dword [ebp - 0x28], 1
jmp 0x402793
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x10], 0x103
jne 0x4027c4
cmp dword [ebp - 0x24], 0
jne 0x4027c4
cmp dword [ebp - 0x28], 0
je 0x402670
cmp dword [ebp - 0x10], 0x103
je 0x4027d5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x4027eb
cmp dword [ebp - 0x24], 0
je 0x4027eb
cmp dword [ebp - 0x10], 0x103
jne 0x4027eb
mov dword [ebp - 0x14], 0x4eea
lea eax, [ebp - 0xf0]
push eax
call fcn.00406770
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
push str._H:_M:_S
lea eax, [ebp - 0xe8]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406800
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x130]
push edx
lea ecx, [ebp - 0x3c]
call fcn.00406a00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xe8]
call fcn.004069e0
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push str._nEnd_CreateProcess:__return_d____s___n
push 9
push 0x45858c
call fcn.00416150
add esp, 0x14
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe4], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9c]
call fcn.004069e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.004069e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004069e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004069e0
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret