Function at 0x403920
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415a40
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x868
mov eax, dword [0x4593c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x878], str.HGlS6zbiMLYYXzFykThOdVmDw5rAqkVykOV6QoSDDiSGfgitqLLTDbXAzWtvSePsBvAcV3Iiaw5N7Eoilbf6YjSsPmWcdseYNlhn7IpaIDnE8WH1WLFNXogf0gqVHP1WPuwGBOYNSPCYN4NLKFFgLJwyYAApATTloAs734NmpkMTBI2Q3xmD3TsCVlaF31qeOMKtzpwGgmSUWlBDMxvXSL9k9uYbggYRbMHxK6ddCa2UcdAJCmocOp4e93TNjwKBeMaUCAb3R1odHiONUdV8SeUuG2VJepL0rsy8DF7WAbftHm0HJOzvuRPTGt6C3kTF04RAJm1hyVVMtWDoSpnUAddVhQjiFfoqxgqXKVtsRDCIiUcJpeQr5h4KGgXRflvHi7kYEUa1XcfS1lfU2FHTnqUzA2W0m3NjbnmuHKsnVE89I2YPtzeyWrIOfsiJGzVbkLFdOMxj6ypgpN3r9FswL3p4TRNY4S0QPwGbwBBIdp3JeezmhaJfqaV0gt1sqEErFi8LYXRvmHJYrzcI2EBvcUhkmsjGRd5EEcWD3PyJ4QVctL8gshVoWCqSG0L4ECWLxOmO9oUufdSqSv1juyPmdMmy3bfL8FsCWbREp2eYa7zwm85IWvGabb8jI2nPQNjDpJePyjJrvQMcJI30xz7RDGKdiAy8rcJPkrtkY1LdlC2V139bTE2T3uinNNXkHJtN1tnmvnUjWwTQstEJwIrsjPzW2rEagWPzGppQ8MHrMDISbQxTf2tIfJKdMsVC7gt6ao7nkb29PdU5arkuVU9662UsyAiTojYeic3utd1TkhpWUYALEGsytRXduCN7o7jWOi6PtSa5OMvMAdKwuXU3PeE5XitaBhGcJPnrqcaYGi5DACraQ7IeImLf6CRhWNuvxcFU6txpOCbfwxbB8q8STsfyacSbKEpCIaOIJi4MjD0IU3iTpF1HB0hyzDrTgzVps2ed4wUctcIBg1WdtaPduIsm1zzWI1nRDEQDcgxoOdFN139ROKzSFCDNkEmaihT8QkgbKUJI1ygDAyFlDLP4LX3iyx0O7mvuoVzPM8Eb0aUMlGceO5NXLieVXSIwg3XngOwxMOIrRXcmymbhX3cIbp3p2pSlLTWlaSn7K9JLWTJNvfVnnznkVmG6qNRFDeU6vv0h4AN7KXd0qOAx6YlBg9c5voieEPuaeiTaqTY20OQX77KTKnlxRXl8exr07oNnSSjGiRyS60a8490PMpadIA3BgOWg0XqklXaj8WEiWbHnh27yMkIJb6EyznAqfxeNnzvFQV7Cq87mXcdX8sGIauWfr5oURx3lvS6PSubzKegKqtmJ4jphbD8dunycUIFf9enticz4qwdh17yiCwV3ijUiFnvGzfPyu2uIGvrhlGeDdILRFQ1ca9rygORR4He9BTjefLqHF4NyvjUoXe7p1GilR8sfI3vAlzocLez3VzzNvgSC0IpQGnwhpijjUBggqW0jA1pkXQs6Vot39vJexwDe91DA973im16MC8V
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x870], str.Mf1PWFKDBcwcnsI2CWrKkYdKRh7ObLhzVjgXJ6DHP54XcLtIAYc4FHgHdVWJfhFLjuppBwxXgBHTidTnXojPrx5y9vtz4RQn7vyn07B1mUDSk2Jpn8YVofQ0i8IEpbiDU6wUwHw3uEk6CHGnP7b3theedo5xE2tRERUUVSrQQRw37TwSIdDJHOp5lm8bQsVsFq635T5KB6cBrv0APhQliH5W1vLPDF9SHjcQYIDHLjBUOAShm365AwtLqN75m7FHS47GO1PdfWiu8sXMRhoX5yk8HDBQWq4wJ7vJSaVmQR2aUz41jEwQmKS8OTTnYqR49RN1CeFMfrS5kD1X3M4pdNTtG2mYPjrwwfOGKE1cdiSyktSm55rs3o75R6UMFq23JkcID8YPzb1gB7Rid3YfYP9yMU51xHnXcoMW8xqHt4JPph4mo912G1kc0pOpIsjjjtYcJswA2qKwoaRrkDmRObclB32fLhiiwDzhNhAVShC4ujlAHUgMPln5gVrbv7rli3JUmb5SbhMBUy85fplIVqC88IJn0fu35V1NgfBjyzCK78ymGFBC46RXRDrqBhPfoBnA6lSKeXlBNwB9LhrlYVbJFv0mV9vXItaRe9NuSN5F0zQhgVDIagJleHIGQ6brA17cOdnuH1SUXtyQUoowSiTjMcPmvI96wLl3ISLqs6CMcIA9yugtb48W4xsNjWoy5w6GoQn35iF056kynz55RNKdhCH3Tf5fYApXuht0JO9xSoicngPvWQUOyQuuyVMxQ2HsSbOFIkxKvK5IbWxDcSRxnudrFg0UUELxcxTmM1xIG8dpkvjq7twbGS4jr1Xg4Xo1t0wAAltY1Rs4fh3hc0ld8Teya87R4h361hJYtOXLeiMtBmXf7SQ73HGbSlLsyShnOCxWePYcNebYTGFQgqp21E9Uhg1RBraK8S9TJcq93Cmqf7hPkzz8IvciOHDsOsgoCzWeY69i7BHajnhfnS6zUosAOy95rozGePznY9X2Yok4l5FnLzVzqQqRpUI8ewzkesPNSiDAro1w9KTNcvhkbOCVzYivz6agfRJXSURR98hraMQkFct38zto56sCpcIHc9wleLlBwhkgmtS5AL6YnQnzzJxogO47n0Bqj1FiSC5Si0LoA1Vn3JGBuxwheOshnKBJxcral79N8qgF6E4JWvCkaiyl3xFbVbuOl7VysD7FJqLTCQSPu3fpzRhdbzc7FhvD6Xe41Sq0oNV3s0nPClVtjFc9VliAvGduLJH6ppnye7TW5nmNRY7zcJPC9RymuzIJmiVpORvSioaKDuGPbx0EdOfJxEMskg7LgofAvzQ5t5rUR3e7SxzstkX7JE7jlix3eOL4VA0QA8GhcUQVHsyxep5YfgSCws78rfn2EC0rlTbWEfsCJIslSUaarjLrtF1GrlGBo8sHlerpVjWCtHy4Wnj1C8C8s7nocH7EYgu43ofrnCgpQJSL73awXtEqm9o41TPTsRIvP7C9UUkA67gmbSPdyxgkJkh
mov dword [ebp - 0x864], str.NvnAFEIi7FaS4HXvgPLSKhDQ5wmqBz2d9t2m3evSkxlDfTbWXnGCFyC6xXRJoGNBVWGmReMLjHyfjoPwpjiXxghtAmPQAcD9ip5eC1JG8vRUC6SJwfP4xe9CTRxi1dB1t2uaGnLIxtlV1S1Tor5FLJ4wMTlCVQxcSHGVlCCgTn6EExGefSl
mov dword [ebp - 0x86c], str.t8h454lD5sGEPjLtprdYztloWRFH9LugFNogXchSGLWKlRINFVkpwAeS6obtFpnenyHNxc3KEtvY2mSpzn3YwAWLJbfo5GUp22renpgEM3Dgwo6YGXaVCd40wWtTemETOqq0xsRC70LWrl6rgo1omqnaluwJWUWRzs2rvc6kQQmMjloNgQxnHw5vhzc81BYFSkfJfNy4r8WSEhlcm6eN61FUBYhBauML2MB2aE9OxpcLVO8WVmbtqGYUNwJa5keNX4ei8r89WeLmyoLt4n450AbEA3x8oHWwoVOqq64iIatVRc7oxs6dC4JXPmLhGVtPFGFcQOQ87QaccaOoOm8kyGsgDIee4qO7wH4Qd7RfE5ojyJmuJ921Um7izQpVWE7GUbSBrg45EgXnWXKgoVrtIhhggY9iUE3tYMEKchzGvFJzym7eBJFNv2ag2jlizPBYXT7d7ESXBIBHooPEkRbB40nIRWm8Qh2E7gVID6flWHTTPcuJD3me3DfxgR3i2GK0L2IK5nxK6NquyzPKFlyMRAMbkWEwHpowoL3zxtoEa6r8zVRXFg59QCGBKXTOMsLLumtbWs70TyDGclLEUEaX4EoiLA0sxrVgDbrl6yJiz1bl7uT8MO3EsH2efmy0wD6zwSpCAa0x5eGukJSHKpQoM0pUyIEeFWJhRCKlPKieRQcQ84uHlrI7EQ4oI1QedWsWvb9Ayy7NRIhLWNXmcTbhJTnK4waOcKSMWUqSg7CrMGtT77CzlpVXNMr7ouv6uGdRG2o1CrLTIKXBNCpqoWJPFnDikFFfnmq4aGPcfr45wKl8hT56Xj8KdGohiqQdTMgLQvmmuViqJNvPlfGMzE1pitd9Eb4cbJ4BtAS6HPsgq3XbE95kV3agj6lAOsDml9uyY2xqRnn0wvAUUEkmXipF6ishYIEALk9djN5Cgm451zcBHVaX75XkTsqTsNdzFNqHVKLfvgIWY1Awpi2MpWA9eEh9CViJ8clGXFg6xcK2A0vKfc6YumqlVxjJTIQh1iFi2dJhDTNP58C8ffecwF5nerYoPbQa11SdoTK8pLFPLjAfjbXDi8DXCjXS2I79Ho8BPboeMPpw2U2t6QzXaQC6XLaWa7vGpEgdLn8v2KernFsWbj3q3Q14p2CnYxL5l8Re9HU4IQy7jHpxSG1IMtbPOpNxm7obQVmanDR33M3BfzIQYrED5rHFs0kRmnCDibEbjFFYCNMtJYQ1LiJPouuLIXBP3KNLa1SlVwv50sYrWcvNwPwOhbEN8F2pB6yIzNslXIppKxMg3L0xazRN9wDFOL4BDcjrKGcr2eFj60qLxfmnLG9AkX8GA38y7PgL6qxqDvSvU05Sn8pgx7hy0r3sQwItpImk9ymJdrQ0GVYzQPK0NqFBjkCUGqiBhwjyyh5l1mG9ylnTFMIc5VgjcpklNcllRRAJ8vENg5JDi1v2VkqjYGtJAYUjyqp5Hjt1ORxh0QDukVEc8JKDgnhzdLoLVYYnKpWkIDGsdmh1Ig6
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x874], str.8C6i7N6MQHiB691bOOlzkgNTiwol4RPkH2nqYNv8V0vkN9FdIrq8XEUnaaOUotaQenGMfeXyjC9VSoljX5KrIVbJyasMji7Y2n4mhJalPwgDzWFDIhjcAV4mN05CqjVIxOT7bNVtNdO2naXw6Cq5jjelJIjvDOti7D2WRLdE5LEc4MawhMSIpyrtIWH05sf6dKDHYL8ikfVsMN6fjDmmFtPOMjLhhoPdkr1piyUiPy94jCcsbrDAja3rm5zAXDawcg0wpdzVG7jttpSDOkDtGwrq1hmQDTAk6WH7316gQEj3kkt76z09HWu4q6ojTeGdmXRYu1XybkjrBLffjo8vpAdbaaex2Q0RHL3H4TbIrIHEBlxv5Udm1g5aDyEsWe71cIyJi8gcfTe0mOEp4YzPfNqiFK6glwD5pHBhHnS5bGTjfGlAXkotmpaOtWCzTbjHV9K8tM6GoIJy5fyHekni4qD4TEc6hkdzea3kHHUvJmDkgxJUtFLQ5QvF6OvyQ87TgRYBLpAemLhfyP0dsoLuUJ8OJgDUipYV4MYpSk5YY0I740FzYYviYlz95LcnCCYTHMoY604uVWx5dAh0Xg5as3ATMHddGNKk2QPa0yqk27rh8mVV2VNdcNKS76DSqb8cKtBxuczWveUEXV3QBbsALhxsLwr6Fsnu0YLIS8YHr4KOKveHnMzxt4nz6FeEOmxf531Y0iJJ6EATDAuelzGvCE2QItexeH1n99ajbeKGWpJiJNa6gdpw46apwfiWllBN5Bbof0SDM17veM1WEbwr82hMFBVkxhwnwrQz9N5noWA4FBeAEwhhzlYNTbH79VbbgRRitX6y30Aw5dPd5j6ct5Y1NCbCsjweiJvUgu8U5jkluVLPFWriOjyT0cwLGA1eHFHrySzN4hwp9tlzVrcdvLoekn6KHt5uYyGzyESVz2GH33wsQ1uaAgfexr5V4cEf4v5BHlDr6raqQnMnRfQ2nzXqoqwM3tiAnXMuDvsQgauWANppK4kWkE1PhU8h0k3FKqA164BtoC7HwK4VlvzvFe7tEohIXeVb05TE9lv0PVzIRwRlaDTX5JxXSQ9MS7S5DBsYT6FSkFafipBm4w2OjEXpLdMvnXifjbv1Li78fC9CRCLu0Tc6VRidKDf2rJklPFLl4i95CLRg4mG66i9rsKG8WsAzvmUS7Ev9WUjn6jDEJJolX4NfD9Tf3vFgetAtsUpUirvFrxHlAYm28U9BbAPbDF2UPtuCiCNLy1bYX61S9D68jLUSNRl0hwwPOJ3hvVjBlC60ROq5ceoK5eu3HVESmJX1DwPp704Qg94LKDeanD9rtucvn7Fff6ArwTCCIy4paNzxgE6l2Ctq5kf9z2XHlrY3vMigoTcDc9IL4X5KiJyE04HjkEI2HNrC59eipBpaSwnI5kfUIqyxiMBfx6MkgGo1enOyUc1TquKSRHXj4b89ayJVPF5TQXYGoS5qnQ5spxOpIO06pqpcuemipK2pHeWPrsFrlYtrMHrfWMEa8kXLJrDqrsb5JzEyG5yOFY6QpIonCbOh1hEEyRMK1IWgCA2NV20lliX57ac1t8ValVFfNc47dbysIpytpSEwqw5Yx9ykLI93yzbYHI5U9pBoa2v9uedCpsDqi9MUdI0R1v28sL9Pyk4jn1sXvH4Fob2v0UPQsbE51lAyVHHzteJn8DjvChF4jfpDbXH1ldYQVR45Mygs0vRMIf3GvheI0D8A12rn6QCfixa9wNzaRJIMP6sa1Or6bQOsj230m8W6Jx6KymFGtHCHwr3s8DzfqKpDv7A0agImY8Sn8OTWdCXek8UUAoEg1ho4rmCUyeRQlVKiveYQBwio2Qjn4t1tztb0cJ3qVn6jAWzhxveHC9nG9Bp3x24zL4fIPMjIVfRrUuJzkruh53GUClRKRGLMI3sVA6gnhIADk0jVwJ8DamVTqqk2IdNT7k9z1TVVI7B7F35DmXV7lT1uCAodCuzbgF2O35A287gNBlwt
mov dword [ebp - 0x868], str.XcY708Szjf0646HHhmzu05IexaPENnJRJu3NPEhLSTFgmxlJuOx3yWnG8CXSemayCu3mVHXoN4WvOkvRITiFTucWAJBIXSh9aFKt1SdIJ2zxhyUyG4uqPDd5yv8YFajCKXb8rWj5L15RI0MS0d1IOxuc3TJna20AHJCEhTyTmcLQh6SraJ3
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.0040ab60
add esp, 0xc
push 0x45a720
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x403a34
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a40b
mov esp, ebp
pop ebp
ret