Function at 0x4038a0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415a20
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x868
mov eax, dword [0x4543c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x878], str.PqsurLr4hyca102zLf4vEGbI7gXPoPNE2Umm5ze2fa7JD468iSMm2wqEcda47m8WTQ6tefKVEALSDqzq0J5KPX0gNFvDz3gGOzdPKtsApVst7YS5KungLXEM6TXKsRGDDEw5J1Wcq3isUc6yS9q6LviTdPkGbetvEXgurCRlyxf0vYLe9Vl7XDNCdfdUR5gRCDS0m3T2BM4l9N7pLnyMGnep8E31lUfaJ5gab7SCiWoUJERdrfNgsJD3Wk6I6GfLFUxbLAFTnVCfS1nHjz9j2NdLAjuToUDVv5eSdif0tp33WTxQVF2klEcbXq9y9CnMPM9LO5CueOL8WORsm6bowmTfSeNQXjXmEsrW4LTibnFuBPqg5IDbU2Ioa434d3xzrOzdFfjJS4wdmtPR
mov dword [ebp - 4], 0
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x870], str.eOtp33qflyepL5Tf0nsXVrKLtcqnbNb7YMeUzJ6bxWa06I5pQLsumiDE8mEtjLbEgME9Y1tzIu7knMD9LLDPn7TICNiGCez8INW7EHXoYETnXPx4gLin6wREGa09WhYFe6021EovfLtPFVCf6soFIak6PWwCFvVNVliisQVO8XX7SLAejStsnOoBmsNBDaRxfs0vqkc66eBhtz61cpLHijBKjPUkd07mRJTund88ilLbOcE1jK9AFyT0w24FkoQaJMphKH8BGX0hP1D7vU6tIwzMyQzfnjck4zB444WdYxWOV3mGRgLWGhlwMTWnif8FkkdiMFIzGmsG4P1vKtUKO0iyjEP4wjxshEyArW0g2xqwFvEQMzYToRUb0oX22cbpTuELxpIM20XCIOgoRR2xGd6EwcgGi9JJv47TDCcEtxk2H1Gi92K61n5bi1Mai0K2BYdbih8hSJPsC1Fb45v8FRwUtCHixaEq28R457D4A33k0gR6ijfr1buY0AnB4DNqPKDcAXdlFGzMPLMzMnC1nVprBlgkpYo1mqIqpIIoWLfEIaRAMgS47P7jK8XnBmyGd1VNbmsu3cWtFBowKhWXBDPAF2fqfuiigKLyxV5OkINuiTAir3mmhcaaoW0NpFudDckb9BDwVS0DGmwdSxi2uq6VECfyHNWeKenjDzAIM6SzrTc4m2AYIl3J2AbqejlCg1jNI7KtwzXDG3t5paHrm1MlMg7QDge668aJ5CnMBnST4R7WQRJOUCtv1Pu24h4NspCnsw5Ceop6J1MOLqtJOnHTynUMbwdnN30bxnQTmkrHnJ1hvrh1zCocYJ7FaNTSRzfP7K6vIH4RaOemGPaGGIUXFCYYHshQDO0eVmBfNStsNFLAaSPXFa0LLzxF2okfnWsqKWzTT5Y4vfQU59Ai4vL89UUoP90uCuwHomyd1j6V16AJQznjqnJtuSryoN4u8gHyDvvRXpq2AmWTanNQisOedsycr0fz0pcGkoNti4J5YIQKW95WiyiKvtO8h06wxqLYj5bEkLUqtt42pM5QYxRnkCXOEC6Aj8RwpIKV9S29QtfX1vl10kClpnQrUgCsdFBCwz5ODxe4s9WduR15XW1Tf6uUQSVijuGLwT2JpKRD6vEVRLSTwvTd5T1NO39G3qtGk8W8Qjo58bGFopnxkaypWMIqDTkH1yYhPGwk7SphoihtAkAg4bBACz1KI8nPbnRE09PD7VEPgCxPhofwqS4KEStvU383GEp7K7mkyL23EuuFvOGY6HoVnbN6CvjK1vwd5iWBRwzVXN3oC7TwP6n2RLQBLWtPQmMCVsTEh9pc630Od8yelEeXYLBSMp9Bb0qjktPALqSfvg1h83Ulp0xzj9coCtGPfuhnhfNu5Yqc98FuvoTmLRiFgERoHknKziPbMOenJfDStOsGJY5We3SYXT4N3Jm3U8ddVfWd0veNtbHvuYE2Ar3gmljd81HPk5dfJJ9XWP5cFxF4FTtFEYX75ejYX6mH6zedjvsvmcd03RuUty09hIccBDT73t9HPlkfHSQGOjLO9Hc6m6mXhKD47w2mscMklqcG4hIhFM2029H330kPxhDeBAOaJVTvIfa7t9O212sAfSPIw4kEVyVbOswDVTYEnvdf65lFKgAkRbgs2qmvlWCjguyDETrCTfW45HQOtzaEuSA86y9IHSc2bWpI0kyHeRDHAIg6DQ1HeqjYuf1NVQxFCSN7z8uFv3cxMVU4mOalIMMLiBTsWrXvpbvMxPlIbQ89TdyeC1I75xhFM5sBKi8L6ywnvA3xUBCh9vh46QYhYQWkyrTmgb6F1xUgE4sdI1vTJPCXgvlMAtOPsO73vSjlgxVtFxklM6edUjtll2njAGQJABEdukDSHIWOKRgVCcUyW67tliMecoQ2mAGycsilY8tIAtMtYYhx8ueF2Ypz74xcmP12HkUJuCcnqnkSTtHVKNSaVBcaAJx7xM5K26v1nSSE09bxFXeJ6sy7kxjqm3k9LAiAAjMyAyUMrL3YPJxaCKNBpzPpvvIq9rF8kKu1WmOdGqtGfkqbs4yzK9gBSDnSCRSGd3IbIMtIl7yFsTCJ49TGJ8Rfn6w8iUYUlfpWnvds2tbNFFboY77EAaI6MjawSvvJbWFirClledWsCNyV5FE8GgRIKP1WFrnjvsN8yC94ff9wDgGqyabPpShqKotNys26qIlqMrX2OxECtVu6KBsUgyQr6lVe1BLea84yJrIO5DL035EyXi8fm0jw19mWsqcPIN6JVFUYdWu7M6jSv0GiX6TMY7WBbA9SQBmVvM4UBr1Ql9ysImOz9QaYd3QMtqwTpJjcTHigJ9W0acDnuDa5cEl5RJA1n3r4M1eXLIpO1dglo3VreEffEdhfa75MIr3jRNla5sOBUNjz2k0aNPsXnwsRkaEx6oJe51K91QBQVeQmKvsJE96zsX4uBW1GPwX7ldrJ6auWyO4l4R97J9lSfcPSeBey3ho17tie2YNzh1s5cv1RtYg8nfd4tnNsDXKClt5kQfxvEkX7bo8lQnP2JrgcDxCDfEXmwurdPclOdlUUMhJxlCUJusEE1tVjhi5mClWxuqsJwJ2UyMdcWAgQ3gL2UFoDTEjsar3mFOPG8fpvOj3KcJur7dz8GC4J5jW9aM4fpC1kFHw2C7Tk7581EVHVEWoFvHvHaWeb3pbuH0hLOjzJfgBzQpoDcmbrE4y2d5DBe3afS8VY2LYyEqfueVzDHCE3MtSMSTjpLMsOO8aRBge0TndGvaMzxzrpSQmjhH9XPaaGba2zHlu07qCsJ4dd88woJT2DYoU4O33vDpXddp8fRvsBbTGzTjiQRb4w7pjXoEv8RcNPOFF3j8AloiFSicyxA7MqjNSotuADzRMrWdIu5mKobdhyKVseWSDuHb7ugsVhsTx2NS4ijQDQCVgcMLzBOyezYKkSeITwgM3vlqCWHPLm52YCP2QiKYifkhLE6Nr4JaIIjkrBr9AV9rvTr6DT9SHKo7zjSw9LDGlwc0I8d9q5Irtd6qF08Lt5rbKPN6gIJ86FhBO5eOtKUCe1mB54A1MTa0fFp1EcOlzUzcbKfHRmaRHVLeoycMUzOEOGv5RGIeHVRzs7vVzL8suOT1tTm7jbaMad7t4SfLRmJspOMdvhKVOHjLFsiPyutFT3zF3Ff5MMvlUhlNrFfdzPCjDxWBn1w6truuf9yhBKgx2y0z294wgErCsq3WBUCtf5G5KD4APKQfVs2XPnWp3OpGCj5ai6ANu7iTiBEmpfUqWsj0kvULIb8DXpjqx8MAl9HKeLeVDCQTxL9fP7dOINjCLOKGEk10PeyLA3HNcfLkjgqTzdo47VAUDDbM4GGJSRMoYy1uaqDb1yuHGiepD2GOCTbmjTF6l2xqJA6D3q7JxWgYbiN3DMiL9B2Q8nnUS8iWKGVUHsF9Sr8DWCru639g2FQAleGF73KqCxv8oHunfK29N6KAGTXOs1tEWg3nx5TBw7N8KgAcUinBp2zxFCv83sv25YpDw0XAlvOPPdHelb9Bma3PXFySKPmuYDeCk4tOx3Cg4AlT7eNp7Iyk8KSTYR9C67t59Uc2hhdugnMvYWjM1kLboJi3uhMSW3En0IaiiVFHDu59MAc7l7BRzHBiqJXwfLLoP2G22X49NQ2Ix4smcDge9YEFlQ7DNjlDuVmXwvu8Jge1q0C2CUbqg2hhbbt9AoqbHRYbtT44Qx0AHJKgxq5TFykkhfYNJsxF4OG3dHRrSqsQOjpIK4WuLtI4kwoauDMk5aPiIE5N1Bt5ktFFXf3kCRjQtsdEfMIWbL3XCIPLOLHiYE7YLKTQT327coHuwrtVBVfsa3i6dtwqA1R3ETgRWxOlnFUJ1REeypAre2Exxj7bbnxRXqdvI2A8jAEiwYpo5puYnc60xMp7Ski20u3bOsi8GotQ0tlvaBGqLkQokm8BX7KHSKmHvWV6xgIYzGFiE76sfo9LosHRPF8AFiXaENuOlku3rG22gvY6fzeeFroV5G41iG1YOyWdVIDf0eDxDMOGSfmWqDcFmwNSAURUaWlexsNBKLdhitnTTYOcklRLyf3Efqa4tSHVNzoYovXfEsEKFzSitK
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x864], str.id4vgq9XIt9lxVgKGP9a6KbtLnN4alJp7O7ALP6B7m3VoWbTm78n1I6irufSTVJv8qqnLuh19fJSKxUlyvdnCnywGDOFSgA8BhBMdWHp8wHtw5POv1ChFl9TvGpDBzXldy2x8rYwh6HmgbmdNxmX4YUJL17kbjuiYrPfLScHEhLt9DRqtXeaPkvTipnBm9Rbp2UfuXXSgPa70tNtR8Kr881RJ7OGxWKjhnXOK1pyX3qViTAqOOdcjP5FFSp7KLQ2QvpXd5aMwypP8kHssLHDMBQUxPjIHRSOJmrBEVogAw97hnBMmF3NcjYOIC1IFJzcWR2qY1KbIx2m7SNKuaQzftE9riJYc37KWaDKynVqJSiGrnwuUTpmVAOMj6Bsh58wiOVg8FFhGqKBze6AuXLu2aEYnPscXOrI7uR0l25VEmBr3KHycAhbTDazQ24hENFWlkNhLBEapNgCUu1dXJJOrRAgctYYw62IoFt57vV7CDWISwifaHhtLLi9QDCGnilr7aV1nTzmWuKsqrogCYnNaeGKbNdUMu0oNGxmGWgP1KzFGmJIDlPa9ciXw0On0jVJer00qPOSnC6muTk1VQJurAF4a2kRWTIyAPmtaL6ex0UEpdIoGPyqWnuJmusljRqOyyYWDW40WCoQHV60yQ3cNxu1gFKSqpNlfAxgQCIG3VKmkfaTCJkHj3um4HzLnc4Sea4RW1bddb0IVPg2rDPs0VoDOr8kTq75xKSRkpDPKl2ETUgc1TjECb85Bvs7tOlrD9G0z4mgWdwYibE8MbQ66QNiqjpLhzMntktDshEy2h0HRTrqFoRexYvje1E6br1bpCzOXnXbbRNU8MiA1H79jDswUxI3KHc4iADbiEMYx28Sf8o0ExDAWUVKnAWGg747o1D4PtFcdBX25HwWPCRUcTjapBvfIWWhu1Vobbitd99RfN3AiUwaYH1mNOo5N3JrKW7K89nQy4l70fSYbEDXuszhfdqHTHUlPpbmGKIHcr3ylmz69mDD4jAjoAc9vuGCFIua3S7OxvIw0VzXRCLxVh3YfgasNcXEqHkzEDuV0jqfxzm9YLCCrKeRCJ5ihBEH3GqGWzAQe7KhsLvvO5iE9PVY94xmRdNQe20vlJ4CR0tkxr7qOJXp5IDuYPYPKU5mGcF141EX5CgwSRVxsWby7tTeLhLjqSOHaGs858joxdDtPElFf2UKOXuLI87SzCXxp8KH6z52rA2dYIoQEpuAzSgnwLb5e07LadlADKaKs8MfelKiewFCuLg1m7XQCbwsdFqxXPS8PN7wH7IruVzlvXCmYEoDiF4Slmxj6RJrja7sNVfVYhGefFEMDwfk3hhyobFyPFkE6kMTe3WBiH3WpLf7YnnkPnuErlINfPbWXQ4MKLUVL4XvSA8nnfbk1hTuXDphdY0Ypk2VJtUkGGYG7h2m3QEgKNKfzSPs39OGtILrbMxvK7f5lYevA9JKIbBBdIDuJYkolOugcbuRfBpOJnkBgdqyXBO9XvY27CuNPAqqj5fAA7DDky9JXnGvWese4jxnUCyUpdN1pR2JljCR32Pldcxsw9p4UTwmM0Y793TfMPPaczynIQJcbm0pUpiF1JDqffx3OG0l8iryYVbE5qvmFO6pK2wS106AGihHNUoGvsmrHcHJHG3gaISA3
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.0040ab40
add esp, 0xc
push 0x455720
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4039bf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a3eb
mov esp, ebp
pop ebp
ret