Function at 0x4047c0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415f00
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x85c
mov eax, dword [0x479010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 4], 0
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x868], str.IJO2SNfcNsJupeCrBoUjpN9xsxRhAmfG0eCT4R2PHI5D9SAaf1QAM5FuACfHVOET4uDDCRKg6RaaW2G2OnJ7QYvMr0iQA8QhAgqpdrrXcok4IuTisA3B5qXnth1426SfFxR0GebMayIt3AM7N2Ardhrx5PdMs5kbVAbQ6T90amjGdcuvSmsC8snYCQyCLVlimWS3I8BefAU8eEGocu9NXUlMpfuky1HHtqSj0ARusOblMRGCJBpf1BVqHFlL9eJrc5lXB1nfMmy4iemRT9mUOtRLICe0w0koUdN3q7zibil8RD9KxOsl5vT5Ch7aodXmus8bvB4PwsGvjy5L1CrLIHT1wDMAckI2cFtE9htrFuum9TJg4Mq3S4NBwsQH1ieYMWlmOSx9qKAUz8jxUPODSDChDfL7GzIEuIBTcd2hxpxCwfyKhwoGgrrRPgMwIaXqWDqsa3QDIlN1CINVgTdYKypy4A1PmymygAgROeXmCgDLbzY3rhGUi3NYc0n3wLQ90NXCrAn1RB8JfjzUTeyy20V865DiPkXgbJFPxWew1ydSyYEh5ASAkwcmxcnSDiOMg5RiNcGdA8Cjw9QIXr3lHK5shq0fYd5zcPlo9c2N51VhjRpMVbNNUM8B1EKWza2hkfgaERCqSLxcJJ8OPr9AWO0lovHISKwvuQ4iD5QyoDHynPo907vWV0oC1pKp34XKYpx9BMg6VEs5rOaV9mxMev7MswB0VKlnwYODhVpkNCHyUMXfwCkDpx1xeMOC4WgEiSlpzsWUf7aWrpV3MAcGfk31MSMAIjQHXHSHBlDVqtmmnOKa2ePJI6gJxjIhQ0RCBgxpHziQvMF0MJHnQLhgX5IzShDg8HCiLGK4naMtAVjhpkCggHQlpxEP8LpfTDYzrlhOn774IwiHKjWoJNgKBLhcxAJ3fwqb7TduCtifTXuVXUG9e4tQk4XIne8FVz1GEeWyfhu16qAKUSqP5NPFAH8SO1WesymCrxf5ACSNcO58ctkDay0Rz2fwXYmYXIEnifbNczMp6Qj84s8FKaWJEoTTXXmjmRHcs486Ndw0AYtYw7aRAI0fr8KDNyOMdhPhFWQYnFzbspx2ggj8RyMWJCwLw8m5OL1F6an735qSpalNDe3bfij7wg2H3Lu0aFKkmc6MbzGv8XwUMOrFOPPy2q8eipwxWP85xNJVkj3MgmBbtp8a9j0OFzPz6EBMzBOGb2k8gtfQmCQucRi3e9K3268iiXIY7R5JebeAUf7gYNqWbyKFx2o1WscoCwEwp1IKbO9cuQyUCJiIioQeYTv9q8bdOg3UVVb9RK7qkuz9G0ecbMyOVX3xGAoxwTmQU4pdF6tq1qdDBUSP9FmqcHiR9kbvoUR8glY7odTXlTDuIDGgbuoV4SOvsRWEXAGGzd2WfIptga4cj2Uf1bj8guyrrJgUNTMCcDiGXwl2WwNCEJHI5goDXMKj7sEBmDSa884aHLmiPhc3WbWIuGs3Mm0mJBPs6lDG7Ec84RsEsKJ7mwsq4YVLQXcxJKxxnlqGzK9f7xX4DfWS0HLalbMaFHznKtznxGxPDsX0nIv9m9rMUslryMCrgUG4DoQQSf3U8ifQMD6bOMUEafpPDTyI2cssr8ldFBQQBkb5NL05qy7HGj37d3k0Up51pk8859HIjawTiSSmMQUyrEaaEmfafG8Q0BkFh1bJaRDpAYHeG5ech2u10ob2PrrJRFaim6EgO3qzslJv9F4221ARXiBfWlg4SbUNo4mMDQoh8xCFo3uOuSP03Gxohj6R7PXsonmVFTCgjmhOPHFKpHsTnICV1xOOPnKQjdvvEmKd9T1H55Qotku9N33cJvBgtuO05xxo5T3DduoHXFlGjlNtTRzryVY8KXKjy70F5Hi0yLoRvYx0x77MWRxMYNN2xxezzodxxtTCHAeQWyV2HLW4SgUfXoddS03WTFok2rOHz7vYHS2VicEuoKbKYdKy7813iXzvNkAmAI9cqxueM5qnPCp5S4dzGK3Mp5AHQomAC6o6V61NAQg8jAiW10MriFaxSz7GQnOgXcNUg8oW4F1lzX3ValVWPJq3kKEmbAfcodivGftowwlK8vwvAGtypOXshJyKUOv17C5qE2daf8Kdax61WRykjL3hemY3Qo2jP9JMM9BLqXzIxRJJr1D13tXpCgTAu6QwDN7pWdM4hjXqRP1NCwwXjQ5cRP9N0jxY7QsIcTTiUaSBsi3fz2mc2NTijdmkiSgVjOhNNRc5qkaGhBz1MszligWPik0TXcMvHwtmeP2uPlqe2EQTfYWGrcPf2Qpol8rGf1eM8vNU8x9XaQKDl3BcXxgqMgFQo68oiC42nz0cgYBHJ6JNXnYoBj1DGKMpQ1jqHWPL3Nbw8yWszOOTqVQvitWvRjvq7j5rMQIgpW0uzP7mcYAitYip83Y6pHsijX44irfrXKb5neSEO1egn2Kys59Olp6DfqtHp9dSm2vGkRQLnUwXNPW5OAwvDJFbsF8LOBOKvzR37FtesbLsQrYMVEgnfIjMaensBJyUucdlpj0KqNUGaah4KkD12aTti5bWkIeQAIA6NfwbhkqtJAxYpHXqQEeotM4f230Gj17hSEXrLKnx5wPdhTCYtxSO3o9haplblVXcay4FlFqv85z6R28tGTfd3q7QEN3JBlpz8Dp879MSjDsCXe039Dz7d0eERthqb9MxbspcVKg4rPypuDUhxmVgYHljEVuSngxyHfhqlBfkPyeGDsy6svevvCQggYsuIBbx334sBiHQhXbnKQIQseaPDpMUtEjbT7gLuGG9EYaIVwr0p0ig3sjnVcHvqhuzQKsVhIQq9jJRvSoKmadsIT2rDDKcNqMUHvv4zt6nsq7963HrzwvVQ1ypITH2FWh6KkeCy4NhD2AjieoxfmhAQ3TQPFPWzVpExgvtikatsj1X6UO8JUHI10Vtma2LxMWKMijQRUdvmYMEYSDXDt40DCm6m5Nd09XcquHlfeN1xgVMT8RpIkGvqQbbVXIViox8N82rc2h45E3N67MeJxpXvL3bJWK5rtdGMdFrfXyfCTY250z5jYsvkiCKhXDVMtFq979XI8vqoR9yBP8HM5mkNqzAWX94Df4q7UN7FE5cmE3Nfnkf9S8cxcA0BhV2Do532eeNNLWchOcgrVf4YLgI3uciwtdGOqHmU2Hd6lfSmwXGH21tI6Xl2UudMlKcWB7Gkzbywwxy1hTcxAYC2zLYT0WDEFp8KXkwxzeXsHMaSFEkofkOirJryvp7Dh5rVkdtxhWpNAbjNeTWHs4vAsyojw3LpXLv7dqkYt4NP6kdOyrpNn2gGUrrYmlqSBx3SWtWgqPTlr7Laf9l20TM5Ae3MA6x83ycMEHotU9ox5MtjUVSE3bYWMjzq6sat82ukbgQnipO5KRuSbQsRYbObjFi4YT3pLiQV99DumEC7tgBKHXVS53snwQkiDdyDRIy3Uae0stbdvbhX8tAOmNaOg0IbHwG4kMkYGYdNs1GonbzN9C2KCdowTOpc6j5N61f5l4ltJ4iaS5cGqKjJoVGbkAdl1k3b72LzAHvmbVYs58vkHfPI0rKbUbO1SGvHlyNHR3IqbwGDkPwzFCrGx0rEB3P6qP15LkzDp2apGkbAc3Ru6qkvQLJpNcKSCyNgoeJtbs8I7o9zzVPmHj53xFLWtfWaIUHmecljUW5sqnbmx2lFi0F51vOv4mHbdleIidOaaVBs5tJax9V6CivooRhYzjbzTBtQCoY0cFpe5vaBctOxv4kFAbH1tqpvNLgviT2M2io0TPHOruQ3KgjAjJMULClyefWCmXBovHyHAqwnt1wWdV0KXAlJYnOLKMDkVVEEbE3XDMChJdUIHcjIMHmcbLyDdqY07bBnpKa882V0XyQ57eB2IMXISsa6Iyma1dciiokeBRgs8PGTjiz9xrntcEaxDVHzLzB7HN80axj1uduicKluJ30hFbVQBzFcxTouh5gSnTExy7VAG2przRnGpoLiwQtbuUv1q6A2lnNh8nmgFDFl7VcW4gQFxv3SNohgkA6iIV7Xf4J488pt88e0Jlf96wUTFeqJS6WeDcPOdFFR1ci4cdtw5ISqTjfWkl5
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.00409d10
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x85c]
call fcn.00406d00
mov dword [ebp - 0x864], eax
push 0x47a4b4
lea ecx, [ebp - 0x858]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
mov edx, dword [ebp - 0x864]
push edx
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4048c3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a56e
mov esp, ebp
pop ebp
ret 4