Function at 0x40b3c0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
xor eax, eax
push ebp
push 0x40b7a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40d1cc]
call fcn.00401f9c
mov esi, eax
mov eax, dword [0x40d210]
cmp dword [eax], 2
jne 0x40b5fd
lea edx, [ebp - 0x60]
mov eax, dword [0x40d21c]
mov eax, dword [eax]
call fcn.004047c4
mov eax, dword [ebp - 0x60]
mov edx, 0x40b7c0
call fcn.00401e94
jne 0x40b4ff
mov eax, dword [0x40d214]
cmp byte [eax], 1
jne 0x40b478
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00403738
lea eax, [ebp - 0x18]
mov edx, 0x10
call fcn.00403738
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x40b7d0
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.004040f4
jmp 0x40b592
lea eax, [ebp - 4]
push eax
push 0
push 0x40b7e0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [ebp - 4]
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.004040f4
test al, al
jne 0x40b4f8
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00403738
lea eax, [ebp - 0x18]
mov edx, 0x10
call fcn.00403738
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x40b7d0
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.004040f4
jmp 0x40b592
mov al, 1
jmp 0x40b592
lea edx, [ebp - 8]
mov eax, dword [0x40d21c]
mov eax, dword [eax]
call fcn.004064dc
cmp al, 1
jne 0x40b52c
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 8]
call fcn.004063fc
mov edx, dword [ebp - 0x64]
mov eax, dword [0x40d21c]
call fcn.00401b14
jmp 0x40b541
lea eax, [ebp - 0x68]
call fcn.00406294
mov edx, dword [ebp - 0x68]
mov eax, dword [0x40d21c]
call fcn.00401b14
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00403738
lea eax, [ebp - 0x18]
mov edx, 0x10
call fcn.00403738
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x40b7f0
mov eax, dword [0x40d21c]
mov eax, dword [eax]
call fcn.00401f48
push eax
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.004040f4
test al, al
jne 0x40b78d
mov edx, dword [0x40d21c]
xor eax, eax
call fcn.004013a4
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00403738
lea eax, [ebp - 0x18]
mov edx, 0x10
call fcn.00403738
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x40b7f0
mov eax, dword [0x40d21c]
mov eax, dword [eax]
call fcn.00401f48
push eax
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.004040f4
jmp 0x40b78d
mov eax, dword [0x40d210]
cmp dword [eax], 1
jne 0x40b6dc
lea eax, [ebp - 0x6c]
call fcn.00406294
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x40d21c]
call fcn.00401b14
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00403738
lea eax, [ebp - 0x18]
mov edx, 0x10
call fcn.00403738
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x40b7f0
mov eax, dword [0x40d21c]
mov eax, dword [eax]
call fcn.00401f48
push eax
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.004040f4
test al, al
jne 0x40b78d
mov edx, dword [0x40d21c]
xor eax, eax
call fcn.004013a4
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00403738
lea eax, [ebp - 0x18]
mov edx, 0x10
call fcn.00403738
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x40b7f0
mov eax, dword [0x40d21c]
mov eax, dword [eax]
call fcn.00401f48
push eax
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.004040f4
jmp 0x40b78d
mov eax, dword [0x40d1b8]
cmp byte [eax], 1
jne 0x40b72f
lea edx, [ebp - 0x70]
xor eax, eax
call fcn.004013a4
mov edx, dword [ebp - 0x70]
mov eax, dword [0x40f1e8]
call fcn.00401e94
je 0x40b72f
push 0x40b7f0
push 0x40b7f0
push 0
mov eax, dword [0x40f1e8]
call fcn.00401f48
mov ecx, eax
mov edx, 0x40b7f4
xor eax, eax
call fcn.00405ad8
call fcn.0040afb0
push 0
call sub.KERNEL32.DLL_ExitProcess
mov edx, dword [0x40d21c]
xor eax, eax
call fcn.004013a4
lea eax, [ebp - 0x5c]
mov edx, 0x44
call fcn.00403738
lea eax, [ebp - 0x18]
mov edx, 0x10
call fcn.00403738
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x40b7f0
mov eax, dword [0x40d21c]
mov eax, dword [eax]
call fcn.00401f48
push eax
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, dword [ebp - 0x18]
mov edx, esi
mov eax, ebx
call fcn.004040f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b7af
lea eax, [ebp - 0x70]
mov edx, 5
call fcn.00401ae4
ret