Function at 0x428ca8
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff54
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10ac], ecx
mov dword [ebp - 0x10a8], ecx
mov dword [ebp - 0x10a4], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048b8
mov eax, dword [ebp - 8]
call fcn.004048b8
lea edi, [ebp - 0x88]
xor eax, eax
push ebp
push 0x428fb9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x428d0a
lea eax, [ebp - 4]
call fcn.00427d9c
mov edx, 0x428a58
mov eax, 0x4284c0
sub edx, eax
lea ecx, [ebp - 0x30]
xchg ecx, eax
xchg edx, ecx
call fcn.004044dc
lea eax, [ebp - 0x10a4]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, eax
mov edx, 0x357
mov eax, dword [ebp - 0x30]
call fcn.00428b2c
mov edx, dword [ebp - 0x10a4]
lea eax, [ebp - 0x30]
call fcn.00404484
lea eax, [ebp - 0x10a8]
push eax
mov eax, dword [ebp - 8]
call fcn.004048c8
mov ecx, eax
mov edx, 0x372
mov eax, dword [ebp - 0x30]
call fcn.00428b2c
mov edx, dword [ebp - 0x10a8]
lea eax, [ebp - 0x30]
call fcn.00404484
lea eax, [ebp - 0x10ac]
push eax
mov eax, dword [ebp - 8]
call fcn.004046c8
mov ecx, eax
mov edx, 0x343
mov eax, dword [ebp - 0x30]
call fcn.00428b2c
mov edx, dword [ebp - 0x10ac]
lea eax, [ebp - 0x30]
call fcn.00404484
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, edi
mov edx, 0x44
call fcn.00406f0c
lea eax, [ebp - 0x40]
mov edx, 0x10
call fcn.00406f0c
mov dword [edi], 0x44
mov word [edi + 0x30], 0
mov dword [edi + 0x2c], 1
inc esi
cmp esi, 0xd
jne 0x428de9
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00428fc8
jmp 0x428f86
mov eax, edi
mov edx, 0x48
call fcn.00406f0c
call fcn.00427aa4
mov ebx, eax
test ebx, ebx
jne 0x428e10
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00428fc8
jmp 0x428f86
push ebx
push 0
push 0x2000000
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 1
push 0
call sub.kernel32.dll_InitializeProcThreadAttributeList
mov eax, dword [ebp - 0x2c]
push eax
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov ebx, eax
mov dword [edi + 0x44], ebx
lea eax, [ebp - 0x2c]
push eax
push 0
push 1
push ebx
call sub.kernel32.dll_InitializeProcThreadAttributeList
push 0
push 0
push 4
lea eax, [ebp - 0x28]
push eax
call fcn.004264c4
push eax
push 0
mov eax, dword [edi + 0x44]
push eax
call sub.kernel32.dll_UpdateProcThreadAttribute
mov dword [edi], 0x48
mov word [edi + 0x30], 0
mov dword [edi + 0x2c], 1
lea eax, [ebp - 0x40]
push eax
push edi
push 0
push 0
push 0x80004
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004048c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA_1
test eax, eax
je 0x428dd3
lea eax, [ebp - 0xc]
push eax
push 0x18
lea eax, [ebp - 0xa0]
push eax
push 0
mov eax, dword [ebp - 0x40]
push eax
call sub.ntdll.dll_NtQueryInformationProcess
mov eax, dword [ebp - 0x9c]
add eax, 8
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_ReadProcessMemory
lea eax, [ebp - 0x10a0]
xor ecx, ecx
mov edx, 0x1000
call fcn.004030cc
lea eax, [ebp - 0x24]
push eax
push 0x1000
lea eax, [ebp - 0x10a0]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_ReadProcessMemory
lea ecx, [ebp - 0x10a0]
mov dword [ebp - 0x14], ecx
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x30]
call fcn.004046c8
push eax
lea eax, [ebp - 0x30]
call fcn.00404920
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov eax, dword [ebp - 0x3c]
push eax
call sub.kernel32.dll_ResumeThread
push 0x1f4
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428fc0
lea eax, [ebp - 0x10ac]
mov edx, 3
call fcn.00404410
lea eax, [ebp - 0x30]
call fcn.004043ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404410
ret