Function at 0x20540
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor edx, edx
push ebp
push 0x2076c
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x20596
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
call fcn.00020374
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x20780
call fcn.00013cac
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
call fcn.0001e53c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x20790
call fcn.0001fc5c
jmp 0x205b2
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x14]
call fcn.00013a9c
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0xc]
call fcn.00013a9c
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
xor ecx, ecx
mov edx, 0x10
call fcn.00012bf8
mov eax, dword [ebp + 8]
add eax, 0xffffffe8
mov edx, dword [ebp - 4]
call fcn.000140c8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
xor edx, edx
call fcn.000140f4
je 0x205f4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x18]
call fcn.000140d8
mov edx, dword [ebp + 8]
mov dword [edx - 0x1c], eax
jmp 0x205fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1c], edx
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x20]
call fcn.000140c8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
xor edx, edx
call fcn.000140f4
je 0x2062f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
call fcn.000140d8
mov edx, dword [ebp + 8]
mov dword [edx - 0x24], eax
jmp 0x20637
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x24], edx
mov eax, dword [ebp + 8]
add eax, 0xffffffd8
mov edx, dword [ebp - 8]
call fcn.000140c8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x206aa
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp + 8]
add eax, 0xffffff8c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x30]
push eax
mov eax, dword [ebp + 8]
test byte [eax - 0x2c], 4
setne al
neg al
sbb eax, eax
push eax
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x28]
call fcn.000140d8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
push eax
call sub.kernel32.dll_CreateProcessW
neg eax
sbb eax, eax
neg eax
mov edx, dword [ebp + 8]
mov byte [edx - 0x75], al
jmp 0x2070b
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
mov eax, dword [ebp + 8]
add eax, 0xffffff8c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x30]
push eax
mov eax, dword [ebp + 8]
test byte [eax - 0x2c], 4
setne al
neg al
sbb eax, eax
push eax
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x28]
call fcn.000140d8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
neg eax
sbb eax, eax
neg eax
mov edx, dword [ebp + 8]
mov byte [edx - 0x75], al
mov eax, dword [ebp + 8]
mov byte [eax - 0x76], 1
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx - 0x7c], eax
push 0x207a0
push dword [ebp - 4]
push 0x207c4
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xffffff80
mov edx, 4
call fcn.00013d20
mov eax, dword [ebp + 8]
cmp byte [eax - 0x75], 0
jne 0x20751
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.000204b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x20773
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00013a28
ret