Function at 0x401000
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
sub esp, 0x174
push ebx
push ebp
push esi
push edi
push fcn.00402e40
mov esi, edx
push str.LoadLibraryA
mov ebp, ecx
push str.kernel32
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push eax
call fcn.00402e40
test ebp, ebp
jne 0x401052
test esi, esi
jne 0x401052
push 0x1a7
push str.C:My_ProgramsCMPQDraftCommon.cpp
push str.lpApplicationPath__lpszCommandLine
call fcn.00402260
mov esi, dword [esp + 0x1a0]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
test esi, esi
mov dword [esp + 0x2c], eax
je 0x401090
mov ecx, dword [esi]
lea edi, [esp + 0x3c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40109f
mov dword [esp + 0x3c], 0x44
mov word [esp + 0x6c], 5
mov eax, dword [esp + 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4013a2
push str.KaityIsABlubberbutt
push esi
call ebx
mov edi, eax
mov ebx, edi
push esi
sub ebx, esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x4013a2
mov eax, dword [esp + 0x1ac]
test eax, eax
je 0x401135
mov edi, dword [esp + 0x1b0]
test edi, edi
jne 0x4010fe
push 0x1cc
push str.C:My_ProgramsCMPQDraftCommon.cpp
push str.lpContext
call fcn.00402260
mov esi, dword [esp + 0x1b4]
test esi, esi
jne 0x40111d
push 0x1cd
push str.C:My_ProgramsCMPQDraftCommon.cpp
push str.hContextMutex
call fcn.00402260
mov ecx, dword [esp + 0x1ac]
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], esi
jmp 0x401215
mov edi, dword [esp + 0x19c]
test edi, edi
je 0x401166
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x80]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4011b3
test ebp, ebp
je 0x401175
lea edx, [esp + 0x80]
mov edi, ebp
jmp 0x401188
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4013a2
lea edx, [esp + 0x80]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x80]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1dc]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1dc]
push ecx
mov ecx, dword [esp + 0x1dc]
push edx
mov edx, dword [esp + 0x1dc]
push eax
mov eax, dword [esp + 0x1dc]
push ecx
mov ecx, dword [esp + 0x1dc]
push edx
push eax
lea edx, [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0x1dc]
push edx
mov edx, dword [esp + 0x1e4]
call fcn.00401590
test eax, eax
je 0x4013a2
mov edx, dword [esp + 0x19c]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x19c]
push ecx
mov ecx, dword [esp + 0x19c]
push edx
mov edx, dword [esp + 0x19c]
or ecx, 4
push eax
mov eax, dword [esp + 0x19c]
push ecx
mov ecx, dword [esp + 0x19c]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
push ebp
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401376
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
call fcn.004018a0
test eax, eax
je 0x401376
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x34]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1a8]
push 8
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push ebx
push eax
push ecx
push edx
call fcn.004025f0
test eax, eax
je 0x401376
mov ecx, dword [esp + 0x10]
call fcn.004013c0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
call fcn.00401420
mov ecx, dword [esp + 0x10]
call fcn.004013f0
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
call fcn.004013c0
mov ecx, dword [esp + 0x14]
call fcn.00401480
mov ecx, dword [esp + 0x10]
mov edi, eax
call fcn.004013f0
test edi, edi
jbe 0x401362
mov eax, dword [esp + 0x1dc]
test eax, eax
je 0x401331
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
call fcn.00401520
mov eax, dword [esp + 0x1a4]
test eax, eax
je 0x401359
mov edx, dword [esp + 0x20]
mov ecx, eax
mov dword [ecx], edx
mov edx, dword [esp + 0x24]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + 0xc], edx
test eax, eax
mov esi, 1
jne 0x401376
mov eax, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x20]
push ecx
call edi
mov eax, dword [esp + 0x1ac]
test eax, eax
jne 0x401393
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
call fcn.00401950
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x58
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x174
ret 0x58