Function at 0x4030f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413820
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x864
mov eax, dword [0x439198]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x818], ecx
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x818]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x818]
mov eax, dword [edx + 4]
call eax
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x828], str.9RivxChJr7jS2kpp5iCMx96Iz8xhFW2UOIblXtavry5qGXDiM96opz0EpHbH0z79bsiVemxtSTmCYnEHsJloYJ0OIIhs0FIAIltlRSQIDaGYKA0nbcs8drI1FPn5JhipzRzFPCk9D77yH6wnCRx0vutNxmwG6Pz5uKs6r6Ux19a1tQk58kItDEnALmhWUixpRSYTpLnr2qUyxfMeGj77LCiBVxI9S0rxLm5rR5ch3MX1k9xRTLTys2RWJmr7zOMUSuC8ipFgDLpK6Ptl2RewDuvv3Xxhv0nlwNytA4OsrCRJkQvCQMlVFpgkqsTihrjs5fTKMojSunRYnTOwwzma0nmf77iJuEBbdCGMBI3Ec8B1GrPFp8tghwYWmJIyvgUvILDLfDkTf7HO8geSlX4qpxxKDcsqxLJabRkIEm3BDCmCL8Kj6jkXVFXRTD4F2IBi5L4MwBJHN85jUPgxqegp9DPqAtudCE9pTa4gdCtYBtFp3bFxYuJk0GhowmXF8a4p1tkBObV9pGj4Q1XEqFpwcBXF2g3hBNaAOSHo6xlLY6t7e9eCk6NR6Dc3TmETibhECnRlyuwlAiYXgrBzeQfpNBObwQHJaXp8UIcKOzocsA18DmHL0E5tjNI3W4tH4GyOycD4ygVbda7X0EnUNJUCnG5TcrnpAUq3G9BgI6NpyMvBtOhIKxmktzH3wcYqO3h8bUnvvOUtUl1c9iUpDRI7xXrPYoWXn1kNffPb6cCWryEAF3ELvQWHurAxmU50pmBhh8wPG6El6YzkaFKWFTF1jFOofumbyd5eYXCeut87y01GhlnBHP99WncBVEQQXgCLlqWkKnyHjOpCcKxPsIeqooaizMP6lMWtyvYkGSOrytkLBfdb31uoFAAAY5DFRCGm9AMBJFgTRLkwdFxM0U7H79gbkk6Dn3CEAqeOVIko1JWA7nqroasJQwheH3KqfbpmgXXoLNENqpDC3dalXh95c8CmOa2VGEnRCpB4NzRXC7tSEjMvdJ8nKUCb6HEAbJ4JUMvoeQxLtaiqIuOxAwCBM7EnnJ6Fkkv8evggRIjdgNGcaklDn474d77IRczdS6iLzuITeoOkDf3T61VyMempyvm4b289KmuXQ52QomHhFBw9GwGDTmnB16Pkj7wbXbIzP5BY8gDgN1YikvcNIdsUpVVvFhgTGj55dK6wQXjzQx8zuiBySP8WMiyvoj6CCOmYQSptIyjNqbBFWEoa5pL4aTX8FQcHpye4Dc9xAIKccLFwLN4EdqtSVujDtoQTsPV6EQEOXUyBMmrbWsGvk3uuLcHxJF33h3PzDvzg697OBU39lEzgoTjgVojrPnyNuhIwgfMbPBPJskmIS3AYf5HSnCh1x8SDUlYB3DpcFH8jys44G36nB6IrGEN1WvkSsHt1qHTgM4rAs8y81KWE6WDg5r2hC3WDbBzxHRVFVudHa52JdXxFf524oaeGtfxTiUbx65q2z0TQ23qvQcNOrnJR9czhPxHs9u2cSLj7JVPfynk7WPdTzpixYIVqFuzFtyOhvTy2fnvEFeCJepWhduO3SDM4kNkMQatVsFO0OTmKyNzAT0jdUxq59GrP1IwjtRv3TgSlT42hNgMjX5vc1yYtH75SbWEaFzkeQ1fSukFegpaxxvIsEG7x84hzESqdPAmR6o7Yc0QQaEJUMy42Oe6ayy6zwvLnoBX7iYntblBI36L9XPEIkAVFGx3LhtLCVHrTUxCKbspBLrIUppv3NlkXOP6nG4JR2n4TgVaHymdzx4gUwFBmIbFsO8EOQee5qt2zte0JcYoWKtodqagYvLaFymJ0FlUHLI6gIeLEpuvXhacdNrXH9Ae1QdN59GT3yEB9GC0qjiifiIcRWPJuLImDGGtIk9m8RDPatI3VttqwEMzwsMKDOU3xYJrPFowth1qISYd7wCLwVx7rq1y7YTU7B7fumCcvPoiOVVRj5729oHaImyWx9tEaoigRewLz3FG9S5whG5JpYrFpfC98nn1R7yFkRkdSRXd18XH8Rqgsow7ovMCMXpPMuUukyL5xHHLmk93o3NLA0bAv2Me1po3SecAuf6uxpxBNkbgXDChgQ9LpaJ6YnaCwVsBkIlkbJ567WteSRuBnjOThVuwgeUl2PlQolyamHpvPhmswQcpPmGihSDSovQM8NHJB7CFhalXX33xznFVeCGt7YC5mHUpK4Hk4VQXlAhSjQmTS3XNufr2qRuRCqXPJ9Ni5HHxVitMqNENLLsfNpFSNUa5kMqxnPMYbmGiphXlzvUq0HQcvjbnPkmIjohSoaKl3Olv2mDnG5FPLjbaa7Of01CU8o78Ytb0B4nP27ePrd20JfNlz4yANGkW3s5sLkOcY4umCRhOb1HL2voxFopWCOGe2JVRSzMNvMvxVI8zX8sOr2vpmYn3xlBIM4Dj3RVHi9KiQ3lc6pvuzTFn1heMEHv6XzHVC9IYq6EKlHpg0jHhlioC4yXAhqqCpqdwkmI74vw8MWmpYsD5BpVb3nEI5JXmVpx5wdRC7Q1x8kjTWl4tJYpxLA2EJ0dl4bjj60WtMTpiktI3BhQNClODhps2YCxA8cbCrzG4vLDUk5s1nm42Fo4QUlUJw4M1dJ27snGh0Tg88VN1vyOTNCX3hg3P6U9vaWOAArqqf3vQHRn9XFsMt5bvek9BsOeVAMHAMniisjdc5OetujqQBqiYS47xojs2xlGtydG0YJIdFfM0Ip2vjm14sRL29YG9KrLzFP34t8EKpierpWLFyiFCiSXKROGO5tbyQWAdAMMGgtJ6r7LK02raebOodRyP9S1oK92yPCAOYL8mycieOPxcEeEYayjFog6xASBv3cKTmA9moze4LSEvlb1xPHVB4kWY9xWHoIaKgFv3mOcLcdU7mMEanxmIjXMdOkb5l3TbEbR3JCxk0LUk7suT2DtM1bygxoROKDg1zEQQCOigFpGJmgEP917oW7RDPM1oKCK7830DUmbDiOIb9Tw5734SH45qQp6uO
mov dword [ebp - 0x82c], str.fGgxJgU7qkTzmwPbgpQXuDx8MiQ4248DjSCESkqBTLIna8qcRL43uKdJfGRFmIzwysgkrR3imxpSbECA6HfvfO0TP3FX7ikHcnsJNABbgSA1tfyOy6dokMaS9ibumXHCJX6jjfkdQQYpBBdM8brWpJnSy9tvGvT8TOJDpGNm8nvpG3uPVu4E8NF3cbLUbf0zIWzwsP4tSbc5hsbLmTP8acwuXMqps7YJtBpXUGupDOd8wjXQ7C9gccKgxdUjCBIPIqJddlQUGGS33CoN5b37TcAmntUGkN0zgmDENWlL70FXoQ8zEM95BXspYq6s090gSRKiOqP5ohiYsz4j2ur9tfuCawcvDrVmnqdwdh8PRyFL045pWXHiMI5qFdqBxqhXozxzVKIhrlp9JQ5hVFPPmfQywyg1rGatkdD7zsaTNPMuT0RNLsleYJIFwmkHBjzKRB8WG8k5m3fRgc8kwuobvb3qekmmL1n7Wje9QxxdjNn36EtCwfNAJFAoWWimf6okLdPWFyuzCMSxbdlXkw1xzlt9Nz9MNofCOzrMK6et0uEvPf71Ou6kPre9Cl7rLkxDNUdjIdf7WeGQRL3W6BMtsfLS3gvMYWGxK9WoeYpGJb7bBiilyFrEjboIt9N3KQ3RVt45WAWimjdKU0RhQN5NkFN22DB6YbPGQrECwhw3BrqzaxHfSsl2qi48EdEx0GdskTrvFn9X3cjnegCeQqwDzDGh1aPGJH98q4Ln5jg203zxvYkBcOxaIqxFADaxzay6trE7vyFdwi3aVbqgC4XiRqQvzAOOsvfc3TINDFAnu3J5TQpw7W1YYuiSXM7UMOSI3CfGhkAowgMNnCDaUxxm6zSSuRuWyJ4qz7ahaeG3XIqwOEppxh1JeD5wGhxLcufw1c2e5ae6025cdIRVKUAEqOGOOgYQIQLE342sQ2YgwCjq283RBw2QKhVFVVGsCdSWzb31hM8bdLMxhOVNpwKggfoXQdGuUvKWNowebrctwymzvhkMHDO2425z8S6B7ioGbPByr98IESYfJzWinVTwg5nf7uf7iEHCr03IS3grzwM0wlriuNlgXP4LVsy40ivGxFhCpsj6131YWOhaqY70kRhOr3zcjtweK0jmUGn7wR32AORKOuQItOB3hi3WO2j7ArPfibYRkbrHwHvoAINxBoY5Q7OuDomBPMcMurYHu5RdprmORmQRSoJskeRDoy4qy9mFr3HTNs8xmzvg7tyevFAGDbmXe7EM20UQ5EMHO0bl2eSm0o5pHcGgumxINbjjQ59rp1iiUg8Xz5lfvPfoivsUI7CHC6ckicBXX5SbPKtaD5HLlhvlUWL3Fdlig4IEnPNY6vmaX8TamUnFWjKqfnbJfjIqUQCudVuBqF2hjVg3qE6mgR0Go9UbVc9Pdtro7ebm0AdnNfmf89U4EyhpqjzfBJSoS7yrs5tDn5p3RQP4yAJVXfq3C3dczhDEqUxnRu5blyCSGm0XtMELsAEGDpoNwgPJLomSbGt7U0hLdbctTCp3Xz2Alv2v5xc4sg0KGOQqh8idc91tsaImE3rTIaylHqIpJrrO11eTIl6flyj6rFkk9StzRSUTNHCRq4H2dmj7GLFxdbdTKE2GqSwn6SznCBpR3sOoGQDyMerhic8GXKBfRMJUM5vvkNS9HaP0jvttJeqiVgHCiTQQek0Du7cDYr4MbUM1ffSX
push 0x44
push 0
lea edx, [ebp - 0x874]
push edx
call fcn.004092d0
add esp, 0xc
mov dword [ebp - 0x830], str.U3eEt2AGz59V8lCzFmfYRgLyO04YJCDffxRgnXQInnkGDmI1ioHHvmstmOGsUo5PRDKtJvLeJ62kFiOTkARXrb6MfUM2P5fThLbSTmeukzpndXv7vFxya5Sn9FIdmVNEYoU322dsoLsOxy2HEnTiWgaNj4FWDx4yw35r0SUNC9759zhXwxwTNKolrDKC5PXesncyt7CUgPa4RPLoW7n2xndWOvY8m17vm59MSJLR6tj5IvFGJ3NmIQmkcneLpHKqMVgvrzWpni8V34MIJsxsEDLPRwgirLJflOc14jR4T96QVlNa2gt6O6zk1mtncstXY2MTQcW9MxMtxJYmikUTQYkmEdW2ktdUzYFvuPDbIdhs2zd2ateX28E9ORGfejDX6HAJkUtmqK91sT8b1A3sCzVBzk6NdjOm7KxmBv4BPCRfQQIL3jbglRu9cVbGzTdiTsDR6dUh6wvujCqHaczUrcvyfkA6EzGRx18q4gpbEyOjSu1R3ziKIi5bxuEqMTtdPpqUgpOAe79rGPF3bBzHsuaIaLjgkxclot4U01kdMUxPP612MhMurFCntL8pDdTgzSIJ72Xfx1DDrNXxPrpu1jeO6ulR7J0Ut7flSXIh2OIdEwVf6J6N1tC9UdPP9Yhe1vArcUpqY1K6EWCL6EDcLMkS4y5IaVW3PbPrpyLctFj4AOcI7uWdasL5YugaBBBal8gpm7qzL7A4F0cBdo61yhiaki8WT9dmJ8ebtrS0r5ri6mwVckiwSB544z96xK8kYPhfDVynkzp65Uv8D5SlxpeaphnQYG8LLH4OizI2vWA3SIQBUimNrbJfOEvBJjmhA1pNmUzMmTMUJVDH8olS43uC3kT1i3nqHSfPi8cRvqpIVJnIbFAklFfY7cxSdq4L7gFc4TxYQQwAJtUTFe2yLkFxiw5g11MLATUWaxtiwRPWrvwt30HFkPkU7SMogvfQGplNAUIpXsGmoiRAuLNvwBDcnbyHwCxqIdtbPuWoRV3CUm1mU6EBnDWUbEWPod9OLzWdXhGKbWyJklmQ4pIcrut5QRaDu9YkEzyJwTkt8vtT2TL6nYEdLll7XI2aqqic08fixycXcRHvnOr38QahUSxVrq2FO6LCbX58CYt68HMbMW0DiW9KYrYSnwhAljrLjEhbQxieWWUGDcqLFYFGySqLbUxBFhLIkAc5P9A6WUU5nA8eLxSOLGARwMbzthzyS1jdIigYEegxrcTQUY6BfR0QlEhyrG7iqWhA744xTN3vhbSlbyMb848UOptOjXYR8jR0c8EUKV2AnMEonhxqcKulQx8jD6J8YKSvSdb0Vyetj2gF91zI6O4d55r3mm97vOUB10pBoCt3ak2mb6weVOrvRTl21isTncNAG4iKK7kOq3QxKWRf6xTiqFKlau0fqGCqFitNR6sflA1faIGMkqXcphwR9L8CwJ8F6787Ajsk8mmdA11sUqXPqMoVlrtLh7Czblm8bhiY9hh13dCqkjh8UL8MLOIuzFiszyXfm30y535vsnGVAG5cpcroesd6TcOXeYWPW0vbotIYmrQs7THbuq2woW6rjjhYruvjPXJJqxViPh9LBQHgPduIJ78QqyeDQz34Y9vTjk5Oyz9U58QAcGreyRPdsmGnqocyq6E415hoL0PcWX6npoo81hoUd36RpIKdiOVrmdlsj1CaScCPnfPe4xIP3No4
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x818]
call fcn.004055d0
mov dword [ebp - 0x824], eax
push 0x43a2e4
lea ecx, [ebp - 0x874]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
mov edx, dword [ebp - 0x824]
push edx
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp - 0x81c]
jmp 0x403207
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00407404
mov esp, ebp
pop ebp
ret 4