Function at 0x401ff0
Capabilities:
Create process on windows
Create process suspended
Spoof parent pid
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push ebx
push esi
push edi
push 0x80
call fcn.004019b0
add esp, 4
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x402043
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax]
test ecx, ecx
jne 0x402043
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x54], 0x48
mov dword [ebp - 0x50], 0
xor eax, eax
mov word [ebp - 0x22], ax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0xc]
call sub.ntdll.dll__alloca_probe_16
mov dword [ebp - 0x2b8], esp
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
push 0
push 0
push 4
lea eax, [ebp - 0x68]
push eax
push 0x20000
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call fcn.00401db0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0x80006
push 1
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
call sub.ntdll.dll_RtlGetLastWin32Error
mov dword [ebp - 8], eax
push 0
call fcn.00401570
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 4], 0
jne 0x4021b4
cmp dword [ebp - 8], 0xc1
jne 0x402127
mov eax, dword [ebp - 8]
push eax
push str.Failed_to_create_process:__010I32x:_The_executable_file_is_invalid.
call fcn.00404d20
jmp 0x402197
cmp dword [ebp - 8], 0x2e4
jne 0x402187
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x402187
push 0x40a964
push str._sVxKexLdr.exe
push 0x104
lea eax, [ebp - 0x274]
push eax
call fcn.00402220
add esp, 0x10
push 1
push 0
push str._FISH
lea eax, [ebp - 0x274]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp - 8], 0
jne 0x402197
push str.Failed_to_create_process:_Unspecified_error.
call fcn.00404d20
mov eax, dword [ebp - 8]
push eax
call sub.ntdll.dll_RtlSetLastWin32Error
call fcn.00404c60
push eax
mov eax, dword [ebp - 8]
push eax
push str.Failed_to_create_process:__010I32x:__s
call fcn.00404d20
mov eax, dword [ebp - 0x64]
mov dword [0x40a0a4], eax
mov eax, dword [ebp - 0x60]
mov dword [0x40a0a8], eax
mov eax, dword [ebp - 0x5c]
mov dword [0x40ad88], eax
mov eax, dword [ebp - 0x58]
mov dword [0x40ad8c], eax
push 0x40ad90
push 0x40ad94
mov eax, dword [0x40a0a4]
push eax
call fcn.00401860
add esp, 0xc
call fcn.004019f0
test eax, eax
je 0x4021fa
call fcn.00401a20
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
lea esp, [ebp - 0x2c4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret