Function at 0x401070
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x860
push ebx
push ebp
mov ebp, dword [esp + 0x874]
push esi
push edi
cmp byte [ebp], 0
jne 0x4010a3
push 5
push 0x406060
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x860
ret 0x10
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x168]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov bl, 0x22
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x168]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov al, byte [esp + 0x168]
not ecx
dec ecx
cmp al, bl
mov edx, ecx
jne 0x401115
cmp byte [esp + edx + 0x167], bl
jne 0x401115
lea ecx, [edx - 2]
lea esi, [esp + 0x169]
mov eax, ecx
lea edi, [esp + 0x68]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + edx + 0x66], 0
jmp 0x401143
lea edi, [esp + 0x168]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [edx - 2]
xor esi, esi
xor eax, eax
test ecx, ecx
jle 0x401162
cmp byte [esp + eax + 0x68], bl
jne 0x401155
inc esi
inc eax
cmp eax, ecx
jl 0x40114e
test esi, esi
jne 0x40129d
lea ecx, [esp + 0x68]
push ecx
call fcn.00401000
lea edx, [esp + 0x6c]
push edx
call fcn.00404c16
add esp, 8
mov esi, 0x406058
lea eax, [esp + 0x68]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4011aa
test cl, cl
je 0x4011a6
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4011aa
add eax, 2
add esi, 2
test cl, cl
jne 0x401182
xor eax, eax
jmp 0x4011af
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401227
mov esi, 0x406050
lea eax, [esp + 0x68]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4011e4
test cl, cl
je 0x4011e0
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4011e4
add eax, 2
add esi, 2
test cl, cl
jne 0x4011bc
xor eax, eax
jmp 0x4011e9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x401227
mov esi, 0x406048
lea eax, [esp + 0x68]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40121e
test cl, cl
je 0x40121a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40121e
add eax, 2
add esi, 2
test cl, cl
jne 0x4011f6
xor eax, eax
jmp 0x401223
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40129d
mov edi, 0x40603c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x268]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x26c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x26c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x860
ret 0x10
mov edi, 0x406030
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x268]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x26c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x11
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x46c]
mov word [esp + 0x58], 5
push eax
push 0
mov dword [esp + 0x5c], 1
mov dword [esp + 0x30], 0x44
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x670]
lea edx, [esp + 0x770]
push ecx
lea eax, [esp + 0x16c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x474]
push ecx
push edx
call fcn.00401490
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x268]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x268]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x168]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x56c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x268]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x268]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x406030
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x268]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x570]
push ecx
push edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x284]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x7530
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x860
ret 0x10