Function at 0x403830
Capabilities:
Create process on windows
Create thread
Get common file path
Resume thread

Disassembly:
sub esp, 0x194
mov eax, dword [esp + 0x1ac]
mov ecx, dword [esp + 0x198]
mov dword [0x413e24], eax
push ebx
mov ebx, dword [esp + 0x1a4]
push ebp
mov ebp, dword [esp + 0x1b0]
push esi
push edi
mov edi, dword [esp + 0x1b4]
mov dword [0x413e20], ebp
push edi
push ebx
mov dword [0x413e28], ebx
mov dword [0x413e18], ecx
call fcn.00403b20
mov esi, eax
add esp, 8
test esi, esi
jne 0x403891
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x194
ret
mov eax, ebx
and eax, 0x100
mov dword [esp + 0x14], eax
je 0x4038e7
mov edx, dword [esp + 0x1bc]
push 0
push edx
push ebp
push esi
call fcn.00404230
add esp, 0x10
test al, al
jne 0x4038e7
push str.unpatch_failed.
call fcn.004046c0
mov eax, dword [0x413d04]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push eax
call esi
mov ecx, dword [0x413d00]
push ecx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x194
ret
test bl, 0x48
jne 0x4038f5
test edi, edi
je 0x4038f5
cmp byte [edi], 0
jne 0x4038fc
mov edi, dword [esp + 0x1ac]
test edi, edi
jne 0x403905
mov edi, 0x4139e4
push esi
call fcn.00403d90
add esp, 4
mov dword [esp + 0x10], eax
test bl, 1
je 0x40393b
lea edx, [esp + 0x9c]
push 0x104
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [esp + 0x9c]
push edi
push eax
push str._s__s
jmp 0x403942
push edi
push esi
push str.__s___s
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push 0x413d10
call ebp
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
add esp, 0x10
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 0x18]
mov dword [0x413d00], ecx
push 0x413d00
mov dword [0x413d04], ecx
push edx
mov dword [0x413d08], ecx
mov dword [esp + 0x20], 0x44
push ecx
push ecx
push 0x24
push ecx
push ecx
push ecx
push 0x413d10
push esi
mov dword [0x413d0c], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4039cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x60]
push str.CreateProcess_d
push eax
call ebp
lea ecx, [esp + 0x68]
push ecx
call fcn.004046c0
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret
lea edx, [esp + 0x9c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x9c]
push eax
call fcn.004046c0
push esi
call fcn.004046c0
push 0x413d10
call fcn.004046c0
mov ecx, dword [0x413d08]
add esp, 0xc
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x403a4d
push str.OpenProcess_failed.
call fcn.004046c0
mov edx, dword [0x413d04]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push edx
call esi
mov eax, dword [0x413d00]
push eax
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x194
ret
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x403aa9
mov ecx, dword [esp + 0x1bc]
mov edx, dword [esp + 0x1b8]
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
push esi
call fcn.00403e30
add esp, 0x10
test al, al
jne 0x403aa9
push str.unpatch_failed.
call fcn.004046c0
mov ecx, dword [0x413d04]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push ecx
call esi
mov edx, dword [0x413d00]
push edx
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x194
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x413d04]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [0x413d00]
push ecx
push 0
push 0x404040
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
test bh, 2
je 0x403aeb
mov edx, dword [esp + 0x1c0]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00403f00
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x194
ret