Function at 0x402700
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414030
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x85c
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
push str.CREATE_SUSPENDED
mov ecx, dword [ebp - 0x85c]
call fcn.00403360
push 0x400
lea eax, [ebp - 0x814]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x868], str.nTGaX7V6146KY2FInEJCRt9L6QIcrS2nzPqvkGn6j9m6s8C1brNINpbDRsRUV3yxlmblSG4Sor7WP97La1xU9IYmTGit7TfLA1Yw7oHRKjvXBnVSjU82f7kGuH5f4UI5LRFiMnEHTb5H1T3Y3jEiKzDDSHIuHmLcPD2nRASdnzLF4HxnlU4pxt0mm25tEmiwhyJXFf3pI4ToywD5H0dxLs5ge1qqkOlc4sjHJWpyukbg0YIQ6tRjRveUO9qtUw63JKeFPBS4f6HGJuh54LEKxXr7rV8Km4UBisNo4r2BAeX0GEkj7aooL03vN1C9XpVVj7sODiCzzDb8ApmeNubmNX3UdRJ7Dbac4hAQcmoKUmdO5IfMkV4GtwfIPXtwsY8MaOtIKCONSaqWBe6RfAnheoehotjdjxkoWIbYWCADMTMIXedsaTnNotivfncdmfpJPsGWg57CseGzgE8uLLhK6NsMhAvRa4gviNVHYPvHnM1dV4zYRrfjhwr3XT5KyEUtTYO6fSzjw46BKFrTjyptJXCJpYfLIhGnizbJXmPmxpG2NlSg0aOY6zaNcrI0aS3YcAO1WvukA71Xvxe6XHxmLTPHwwMD2dchp5FnJJxac6xxfBMq13NNoPFdBfLJ0hfGlQBr4AJe2lxLPkH6GCs1yXsMSwJk93SP8dsyCtwjVDOJlJSGFb318eiwrapk3HLsqEIvdJuVq93WdejpPmJUvYQbMaOlrqFHOtIejfRxwg9A3f2PYCtYM7omUQlzioo6OJzK8nrsHGpoDf9WR75zM0KzhLFRNNQyUfgjA3zRRlsP2FR8dNcd0zjfKLOJiT4pzzyghDdSotdXq1t7FpfBEd5DFU9kmU4la664v6Su5wWthMj4TpyvDSAWRBmoM60t4UlmhYUzmrp3pPFKRYC7qRwfsxKmmHweMc3OJqbD9R4stRLroqNVxTQmSDgVqP9g0r6XrNIWB8LNLjqGnzVurLNcMDaP285e3ASBczGHJuQ51fXqoLEoa3dhJPNfSz3aSIRjMX6jeKc9q11efoHFI5Ji238cam6HFYz3VYLethiKDfzmWQRJ22R4DBEEv3B9Kvzbjmm7xQbyKPTDHw2p2KVyhltsWmjrFtztyClLfRv5lUDBTPcSyT5RlCgk5lf9d2j3e3266atKoUKobemJqUggUkgUPiKuknBrSIzbg8RSovvNNz7TdkMKqIXwRkh3EbYBA9tihxYMbzHmIEY4yJfvwRgE04rAE0m7RU3EccaPQ3DKJw3LTQ0bds8wByEUn4vOa4pqNbC6XH0OubGBFKIeXH6JSMfB0f1CoSoHSlTbXw0vfNfhHrTSozepXdPxnzuwOBBond3h9Ua9SM7ydULdfF5hPHhWWiBx7sqfl3E9ILdnXLEhO5l8qmJDpEHnRS0QjyYO1KO9Lpa8GxknwOomWFOosPxHS0jES3bvJ18bhBkIQ6vQHXrt1nqYFvr7ntgeDXHx0aIK7BdLXFFM9jOQUTcsTwnxzQlAN3a7iMA746jl1FFmE2q78Tc2PPubgXHV0bjtQrqPyMbhJgDoO5m81iAD2e0CFd1utoDTvJ5Ttol81b8TIChDnbJvqdTUsXviDIMrTLl0ESVlixjDsRCNn94LcFSkmFNiG3wPcaRfawGu2CKiRR0sFqV5NNhl6RUqB6Ly4abhmU0rJJquwu9crLzt062Cq8fw8nzLGAI6PYScTfDRNrWfow8vLpK46bzrJh9kMOOft02Y4E9VPepBHDC9mUGITK5WHYNOxPGDqxKfJv5ewfGV9AVOi7HTBGlM4v4uUOW385eY44zucNrUAcxl9rGHGfiibOkg83BgbjK7tMjaQiEPzRHuNSQpV6jQN6Mhcata6bsfLrgJEkXen789FHCPNCWXXQDBBlPczckhUIkFg8VGmxd8eeXCVGXcQP8l48G3nXL6DayaQx0f640u0PelF1fM8pn0AmBBgbzwr9a29UupuW9pt09A87NJ1vqzqdQV0AUmAQuSmfB8FMYmdhQOflMHgCas6bhjo3ni6jYXd5sO4uqXJiPxESv45Qpyo5rffsT2MljgYx2kki73EK28LLoSfQPdo6tpnORdcFcsUibthEgbgqAijB36ESdW8l8czjpSLxOL0LwPHJCbW2Ngrn0JE6yeW9n6NGDLUbAhiHd3QrCc62VMV6zKG2mvIX0vtpEbE7CVU2EtmqadvGhGNcMxzbaYcUu7QbDtQ2bzUn5CzML5qAsqe7HS6SnYPCRuCU9HxCErjdw7ybuAvvq7FkvW0bcVLgK5XP2y2Av93JSH4JYoUxruIiqjXVFsQslfvmulLGeG4SQmxav1g27WduLUEIFgFqodjf12qErtdqY6aCPTyAmxbrV7DTUguPh8SutdTfPilPC8NPonj7tTTKpUrfintMC5rpFhIzSz6fyGrovtmgihRuqpe9ufphin3slCKlqX6pSLFgXH2hohpgWWBIM9qCBQeRbg0VBRMdoa9dlnloAgeHtL9E187FfHkgCnMP7PbB1BKFjKPefOLDscLBK4c0nGCHpv6HJtFqvCAP3BXPWS14rBQaoEzRGbcJwuuqes3wlzNxgm2GzIFfUu7T3rgeo66kfuf5mxvEOFLnbXhLhU1BqoHhCKpLeWdT41eWUzByWTWCwYLstn3LvW6MLMkQqNnlOSXvIskVv9YdywxDOmjzKPePVyrxKmV3Yq0taMJN2tkrv5fF7ze1z2tBnEpcqvaHxu9uyqSSi43izCLqWaa16MNhUqO5ATzcqu3GfSIEeGnr4ATEnSrKS6ed2HV4umqPp3gSP7oFMWHCd5utoD7hFAevE9jUioD6hUMTIR97p1h5yv1e3sDDYGnYiWqNoONDLR1u3LpU5EhuPCDsnqMM5EqaUUBqqN6nINGlIgIGjdLY7v6RrHOF2Cdi2q9QjQmnWEY9qALM5AEaHAOqjyicDvLgCr9GgM5VgtruBQodVgN3azRh5hfbt3eJgtETIKoxwm0XsYzHSk
mov dword [ebp - 0x86c], str.VVmjxWKEQAPBQJn6ye5sE9R3PwQG7EWFffGf1ScJgQTEE1CGwqe9LLNtXV4HEnCdgJaRbdBF3u3mXpLxvkPwC5XzMhHB0C0qybUOxs1sDHocF2KeJQQihc7P8CtIiOs7t8fraJkzLWHRB4TfbKnUiIPc5mHBCpL082zKAJnWq2oiELW6yBGvHUD51en09Y6Op6uuVIPXP5uyIv0coOaV8yVkzf7Q1a1cUpH8KwiqyzGXHIyUXBlIF2YfFN9moEsK5Q3MbzgDlhk3xRuBi3T8UkYArBoPshK33aylOS5kflmuaz7xb1E62W0ylGoSpSDAMTkjP03FAboext5WdfyiD1XP3pjftpfPYpEYR7hjWBGnCjs3HhH5UfKxyrYURU3d5VXi6VQmaG8gqTHWLsluxT6e3PQ3PtX5muNUcMFlmReoV8EMh1PkIODU4T22EhiMLXQdoxzhTUcwaYyzPXH18rR7klgrBBHA72YgnGhCrTNzav1lQbBL2MeIS9U4XLgISdaOpgogRfxFYP53ukmq9p092D1S2drnpQundToznHsaGa8AGUSzKvocite5ap6FI9g65MHmpkkAlMYP8jguBNsbwEQ5FVtJF5QSLIzSDxuG43NCgEIb0BdPNtQrUsbzPuNiB3cR53YqXpcFkXDjJPuntAMYhHgcz4ODmHBvVUsVan6Kj4ug9W3paYTH8s8y1gHSpcKoHxczOyTwWBU831x4LU3NTCAy3pqJyEvCbBaT4ClCN4JIOFvTp2JHYbP2jE6BbHzIobTF7kzB8JQxi7mUwj80N9sOeXWz9DzFCCEQ8u73YNkLS8qAM0YwPDqF1anrQf2UrChCk2Tpcbnjs6TNaIKhxS7jzQTJcWlmFcfkUWe8kHkNtWTWPpvun9ioFvcDBJOjrJIyahNCLYGwOdpPilWARK5xJp452aCB4Su5jcJeAr5vW0jJh7qcvb3k4GsGTnPtdEWSBUvfHohsPXmoODU8PU7iEfsKd5pCJob8mIXUJVbNWoeXab5snyBThTjjpAfcOLSeR1qt60PEh6t7SibnHLdBtem5wK2OTMnKrev40lrRlvwTKU7moh4LzE8v44syCJGvqUhOlzkVaBIRRhs21VDKDqhH4v1UYhot9FaLR6X8gXh1yUofcDOQvEAv4I9SbpMQXdYX1aXlHJkMqKK3ymSiNe0s8S9QHqL2ihYm4P5f4CR5k02GI9viRTzNPKdIkWSDuJLT03cbqXMgqcjClaIYSewuhGsN2WjtYvkrAvnanCR76env6B0vICe94APS7ISxcB3QnMKY34NT1jBdEKaS4ia8kXfd9R54z5JRFgF35k9k8W4NJ0r9liWuGUqsTmYrz7xhw9zyB1mAB1ox3MrgLuo0k42LutmjDV3JMv4kjlMgUHWSiEc8iCp6TECJgMBtjSbT3dSWl4FrNwFxgb6DFd2WBvCqNeJY3jjnFVTGpy9EgkamG3UCmCtr81mj06q3oJ9HMe8tJIfRwiErm3QPF348H83m0VY7RFQojrJ124Pv9U3340t1Avih4oNXdGnN2LUTSL2FxHLsT1QGCOJQWQMRsWB1iAbWrIfCVdrw2gH5PKf2Pv0YhLizEvmMdcCCHj9WFCxlL1f8jC1Xy800VJHMUkP59rB2nqjc2E4CyLQRRrBCDQRrY76z4gG6AwCE7XOBKNSxFUSYol7hWT9Mi3BKoLuvg1P7wY7qlqXYWrBC0NfqozIwtxBMJQHqaM2ifz6O1DuyISao4BoMPgV1VovRr7Etz4EeWSYUPsJxQpAleSxgfqrEOgXTmHzD2nLbidqOyE7WHGO0q7mXvCnI3CGvSpAqjB7C0PtwJTbs92EjP37eBsaujLzWSvHKuV3dKdw4IEFvziOGTNJxuDIa3PEgLWP3TSxPiNplycpbVVT0kPNC8VgVuM59tcL78kgxkbkh7EoiCXoz7SwqxdtUBpb2qkch3rtBDYRI1YKmBYFau5K4Iona9jo0zWGhLI7x0W1sCXKAkb02WOXQIupIDViSojGkH1I0aQaf5dMUMjyPjQjlxAnzlxDdScA4vtwRWB3Mk8qXrIoHzhxhhRvEkghdv0CC6Blfb8QL11m4kiqe3u6A0zoPnYeNjDUxEfFqGu7LBVodXxwrle1pL13X4uECOEvQEvCSiLLnhPxbowoRgyY5IAPPLmO05bk1NTYkTba73qRo9TDpTQlbYNwcy0aYDRaW5d8Fm0YrCjFXjSLuFR5rEciKkDhiA1I3Kz80zxnMwTjLtibXaCNOUpH9HmRnwrB8ktFCsgOx1ollJvb8ivLuUaGY74MpyzhtBF44UDd19SqVItUJfdRMRfAPGs1cip8NCjh1UhOwHenuxJt1qMDiVv8co7IkTxpkFOVqpOlhgbaFRqNBxAgLmUqyVo9317hGnYhnm1Pt9fROQdJDyizcmv0jJvJjNRLXxTcdKFJhuOK1ao3HHV1JcnJP5u1MY6PHj0dsBHUL76a11OlMtPGL6HVsVeIPIHhU33vQU3A0F7Di7SaoBHlSnJhs5nExLaP3o8TiKLoYyHO1GDSravmQjPO42vPDkv61fEOW91kFVAw2tDPjpAJFcq2t6UlDbmyaMmn89XOYJfGXI4dQTCbxnYMMkOsIyVCjtlipRUEKD3o3eE4ltyWOb5i8ycAJh1zJYYWvoe2P68RigIpwcJ28YndxmTghBWy9j1moPlwXnvroCa5BsNXg8Ax17AaEnGDIFvbcjM6Tq1EHEsQePH1e1yItVJ8QUIL4zNHhY97i0i9lbFlufK2e39xRHF6x3aNhNERc06kMEPF6yq7WOzwEDjd15xd89GsSm6fHypRWEVbsCUABX7C9d7jJujFJ5wmSzt4LOSik3KJDNX5VoF9vfENM6NT8fv1GYwaz1supEexyYTMQ3QvJb95TSCoQy3Pcre4tl6OC5aWMyHOH7AL6vRTJyfQ5q97L1XT24SVnDcqEtRal59DXIanUAX3KMk1b6pr2qXX2tLBcawH0
push 0x44
push 0
lea ecx, [ebp - 0x858]
push ecx
call fcn.004084a0
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x85c]
call fcn.00402a10
mov dword [ebp - 0x864], eax
push 0x46b1f0
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x864]
push ecx
lea edx, [ebp - 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4027f9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406c09
mov esp, ebp
pop ebp
ret 4