Function at 0x4038f0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415970
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x85c
mov eax, dword [0x4473c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 4], 0
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x868], str.qwzvxOIM7iTqYdYV04V6QqhUIdx3V5rfkNUhHTAWKQOFlDIlQqRGgLhdUs3pd2R9Pt5PXK1nP60zv7XLFoKLT0xeyWPmzP6krRXJiduk2sXwCgetgSxTVTrErt847RefMY13AxLoHxeVdEJAzuDfsJBvW0fIip9bBzduBsPvRchkeOv3Gx4uqcV7cHqD0IugP11h1aXV8sHhYekCP4hVGsy9PY0dv0GowrpgmhJeLy3sckITnLht16UAephRtqUlQHVR6STjHURDWv2kQ7Ay1dILmMA9V67Hajz5xwAptdLBL6jaScfceiSlR6hFl5XUUuTtUd66igmhvoqsiSL15kEhYy9KLGYY7SvuQPkGzEFzcCB2j2RpHMFl0swNVqD3vfBYAxoQ7VHzaOyTQ4rlpMazY7JEcaEgpUkS8EGLcd7Aq0mJbITpKk2JDjJWcNLaYFTidIb5y6kuKG2HsOEGlikQsrRif3Q4VQsINzsGYf75CgNFpJ3F2YG8WYSfwoUSto19boLFesEaiS1cfrii0Ws2GtSiTe9kkOvYRF1i6xwrOB8xHuuYD8zabxpT3HPKIbH8DeG4pqHDYhLH11EABLDo1TltnRperbkVAeWFW7wmkyGmXGDqRqQKLl1o6yryJ2Va0bDYBFIccWNRPOggC18t3I5XbpGcpy04tRa8cfrHFNalqgajkKX0sXCrjWYlKbTlRrCoB5enChVy1rUgIcw1C7851vkSAPT9jnKgItWFFmr0toXdOeAlcfs2xeSqh784atTtrOXXcR9Q8FFLS4B3PyPqS5VfD7Ca6Q5TGyUDmqE3PueWrgDodhVmRSSm4AjV1XWGpgV05xI9XALeiEqQ1LLQ2ijrpM1n6BL8wxti3vdtphkzvtj4XpLTGKUU6AqRNSvK15qJGrb2AsNlpdjVMHJsUyyT2rbhPdGgQF1wfjLxqEXoBJ2ucdTpzQdbDnIWboyB3aTKHTjokSw2VfM3WAOAhy1hRYsD4vWTBv9uMPeHhN20xet4A7jxlTVBSRBvGBMcbyk1JjGvv64d8UqtuKTGbd06amOIMkOsnvdHNWW7Nru07qvRtHCYdA3KSMQyjw1kGpvN33ipRFH8KYLWA5kxjl2mxkPoug35ROqkUKWsBbWCBfT0Lq7L10XOX3CqHj7zxKtCwscuihdnmA7VPKnsujS8o0PHu8VddIonBJjJCgg3R57dvuJFzbNiqdR4uSI3jCdzynAwFmCa5t9Soy8PFJMu7DTcvsdC8QexnnjjSJz6ahXzYjHGTlSSQaQCtqG7Sf1WJTPy8xd1lDOtFzTj1xcMrGpFu3ThB6mMWluRDRlT1runJBs5l4Ny4Y2wLl9qk8mlWkCQ3lbQMbHaUlIVwNiAyit9UDMiuOs0wjnFq6f6lvi8w1P7afj5a9v9k0rdkzKtbJH1uqgtXzMI5m2VplYvAIpIG642aClCc8hfIKCFC7ivK7bEORo9xopX4Yy76nJPXiH8xTWKU6086STk8e8OA04n90NQCecm3N56eb968F3h3jDRbBkWdO8JeDJLDvLf6T15Vmnp9dDLXVwYWOAyOzEakDjsqvfoUwFBKE4HuhXszgvfBq3dCsX61StyDscvvlEODHUmmDejXMj0pHo3O7DjyvcOnyX8UI9oqET4zgGkFSmuM
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x864], str.Q9AIB2Cg4jHOoe1Se9eH3e2095FKnIUKCncokURPUSTjGDnKqSDl6D13frkjQkNbUWSEYIcff1IJhKCE8JLctUtqn97UjaOpN49RU9AgchhM2NjkoYiEqbtesw9YiCniSwnUMhDPUib7ASaePrPwtUGLo0US3W1nfJR5usD8zLkklR1uyxR
mov dword [ebp - 0x86c], str.iSxzx5px4ev01UpRmi9rN7uxACI9VWDJ1LVOw817d7PE3pvxJXthRDPIP1Xnxaho70ghtkNDqPoctCWMIYfnnK8aV337NpBN5ReoT3UKeHXwe6VmE1gyCzuf2bCmcOxgFWbLjGT2QPvhL1wwa3VLRlngXGrRE4PtRc7gfNG0j97L44HYask
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.0040aa90
add esp, 0xc
push 0x448720
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4039e6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a33b
mov esp, ebp
pop ebp
ret