Function at 0x402ca0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414130
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x85c
mov eax, dword [0x465148]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 4], 0
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x868], str.WICzd9KcdtzVor2ce1KWC8nl5HYnv9JHQofGnW5xMzr3GG0dcjhLFrkyH4eXS7Ukfgsv3cnfvL0kCmT513L6QLfeHeO5pnBz5VyqCPFzXX2HdnLJQNoICoYrDNeOTXkVbp6db05PaY9UDn9IHyCO9PngsnE5lC7uheWSn1HrsDEz9G29uO9Q9KhUts4CPLxR0jdSztEQEFG3dm2H2u0C44AEpvc1CyEjP4eSJ64ESK6Cn8dD2VnhUScPnXAF8O4BbkEWvP7tJzxlmraN50Qhqw0RSctPQ7Rajqnt6SW19Ip7H9n4MP2iwkdJy7qE5RsmsIu9nVY7aaT2OhTNKQFmpKJE8f9qXLWMl8uKURJiCYkC7m4IcpOcl0gg5vXbBGAtzwf2pooutlCNDTqRmbJtoOA1pjzQxzN4eQj5brrsmAwGRHQ0JPKcBNlsOvgfHBnPD4hnuIa5yCnjJPwqX7gNXf0iIvT5wdqIj7RMyDIo5Q5yDDXcVIL7pePoceVWR7oi0YQywr4xCc6dpG3UHnQjQC1I56om4j2LAF5mx6WQC6wYmQVRyR8182rpS3QER1sXecueGn2Lbv0qfg9YXXkb2OVIOyw9vK5qez6AXKJR8SH1fiwOCqgdla45NA9XGiEe9PXgmykTXet72CeAp3MRJWi2sE3bwFgcI5isOMTJV2EWHbJ7oGSiSRRg8JaIAdiHRlkMehpmXieFQ8TTT9z3pmTBOmXqWtvNKJmeqBAVFAHksWP3ogX4SCh2hAx16jXeHlObc61KpUbN0l3lBVgFNELDWWw7WN3hhjbpiR8gcRnUqjlbo1IAEbWHWx9dUktVeK05pN81Lvwn56PBToHVRHeC8UdHRxiOwPTKdw8JBruMNdYip0CdOvOT3d6T6jTciJBnirYhOLHARsBArKYiPBMeW1LXmNYWUBUheIrDh78c2ROsHAntcP1qLtKWRuzCWFHcvj3WxCnPsL2v8trqaJfraecOh12nb9TeBTbtPWzGNI4YNmVdUE0nvsKrIo34yfxTWW4E9htM9A0M5gEhAGEtQOJxLOE8heJ7THH27go43tgqtawuiHp6XwXJrMbFGlF9LaYj89dlvKB5I6u35kjLihSyd4iqoSAHR5BkfComY49yJ6BCWWb93juq1G1Ma8QOp044fUYGmlhkFd1cQKJ34moDdUEL0oQYzcJDANCQ1IKsQuTbIEtoVGInGlS25072vJMisxveLFDHP2yookJgV3fJGLFSNibdhsdtKTo5RSkrlWm0GgGS4LgFXimgKCIaXWQF2cGB2kyElkJALlWnUnFWyVQafQsYJbAPhTNXla7B1mBuaQiHlsRSW3vyYzHPFERMvqahLdX5nuxGCLfKfN9tT1OdY2O28QYe8TOHa8d18PvrTNH57tRPdLWc4vLzu570bm3mynxgo7M66NMbNrXsRg28wEoevxIS4pCWQhibcoVY1EWHrErKL4vbbSanHqg1apfARm20L7a1Uh6BE07ES7oi9KiQB0yq1XnmqFecVi4SQOidqjyUp2e0thdNjKteAEfawWYQqrtGxCFU9o68Ca3q5VDIAoQCbYMMeBNBRvtOifjdz0RHVxpdKEAoPOARvqLLPMLFJRrX6qoESNJRWTqFdMhW89zjIpHxIluSso2dz72RDtkGmGED3bgR8EHohkPjpN2Bjn7UXuqALC3523dvJ7iW
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.00408fc0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x85c]
call fcn.00405760
mov dword [ebp - 0x864], eax
mov dword [ebp - 0x86c], str.Wey4KY9rAzWgQN9lHpS3lgBO2BxpmPGYNXXEOtqi8DlJqndma2i37OxYwOjpiFBGxwfknH3nQ9NK9NNqNm91sUY2aIy3BQKUwAaXhRnilSF445hbjEfSoH9YzsrRf78uhx45hA33NRmsz9L9vVVaTOyg5o4sB7u4rtMH21UU7igOuUaBlS3VNlYxB5Cupvl8LcFs3FaxMAM70e7JWTWTPMrTJhgINR0YecAzMzcRWlnoHU2vx6vhCafFGVcYkJvLQFUPxbGbqnuMzJ6Hwf8TFSVzjfCcUAFsQxyBwoA5BHzsXoiYqSGcoQnC7zLkQR6OAoVOPB7wAy7IEyiLTcD85qDbetRrQY6vxyX0tCJK4mCTLQCnL7TgUn5TrJbI1gOXk26hjJcooIAsSQuTXeUJYXlPakXlP19sJxii7DwmyvxST5WiATGheTkisrwCavH6Fw2kyxXScH2L92JkQ7FbvkaW2s8ViVTPa4jda46zAACMl8rB9BSjBRjNfX8KRrVpp1BmpiGjCASGAKkxYNP77zq93LPBUbKqLTYLBLPlSkpimgvo0QxEAYtF5PA5Uc2jFXWYYuSfxGMuyWNgYyzvq2FjBnMTFvhhK7AbETpSsGEhs2P2SuYRXbwpxNLOp5IrL2r4CTiv4ADHIJXsLQlvngKApHWGJRmGB1BWNOFDwQpTodl7QCJLLDpNpTJrEIXKi8GIWuWay8B6VyRotrOz84Kmnoy3yt6c18NPKaMiAiVzbQcv9DEqjNlQKoQDeV2p6sAkMx7yDo6Gl4MvvhVn5wYfFk5kPOQBWgaOuN7NoHMU4cOij8M77nLOSNHnVPnOeqevfyifbHKMkagzvDSQUW29KDd6vCdUCtWagRlnV4IRyORQ8XqpWiockS8SRLJD2H28Fgg3hDtSw18wnY7bxUIdhJWdKP5tu4ElvJjrrxMypuiLAga7SKaLUEeCjk7M8ezjGG23j3rLN1oCf4iM7d8MbguK3HwMfz27Y2cIpDgpDgfUYnLjcaiwGpkiRnIsjaLq76RzT03tiQnkxRnn2VAyD7j35GTERN4tEEm8A1E2un9nPUmgpgeKVD3SlY32FWH64WhcTNVgooCoSCwQ0mFm6q8ILvQ7zN1FIHsTWELnupFwTKczlVEVf8dAOvPdzgMbS23Ir52FIPULcOcqS6cmcAUzk9dtNSnbHzotKLCyn7JWe0R00qxQoSURAy3Sz0CNclafSDttaziHBc4vSVfWTgRIdO6ghATKiShwuNvYaxwv51bEG86vrcureWVevm6lO8T5PyFHQh5FwJ5MpWaJnkut6YRhWHBpuwv2SrVk6YqkXobNVLKaHyyiAOYFtKkpSTMNbbiCbPNpzGpc6suD4VssUn8y3jHmuBIaVGHsHWaIF2d1yhekIKVBHuURNRFSIoze15eLKqgSGxvUS16LBtLtTXJo0FI8NwPoTHQyJgBkd1N7xQtLiMJQTyIJ4CMRUDhqI6DUtrukY04oUr2vYzDDsXNkxmor8SWpfXD1cUW0RIM9eTGuuVhLKRDr7cwKmQaJTiU5tyNeS60jCNCwkavhjRF9CaIisAuaJcAtkdCOaKdp89jKBJbi5x8o20098zKJq1Jy8FJj12uzEpsE6l8YooYUs9WW0K4QljvPEFh9RYpt2v44cUgDWSWhaJCVzxNeqP0R4V6yhk1nVPm5WxsBStyTvBASfLzUjxpgU7PBYvU9XcSc4xChGx414iYdjJjifARLbMUcPGdaCSpbPoHdgnwEu4oQUeb49lza9wu2OHytfDY9gPCVRjJJASXmasAgwnIjAQuG474C8EVyUMl9byfYlmlPY4eezqxaAeDxRboLoxOb5lPyhkqTOTH0fa6G6ueKF4oNCQIE7pv8DR61BJkTiwH6GlpDAJ5bKKXuTMIBdO5O6P7n1TQ962y0UDDq7xjD5AntpnCtuKW1E1UDJSCHMRX8tuzHqtemnQnsXE8LHGJN7kxPpF2p0cauLRdvUl6IGNvXzqtvrulBUT261efWxURF67RaA7g7uA4kk9pkcyXab4sE0sbQmAnPE66i8Y13Cn6JvYdqmG1yBoUL8exrwurIw6HVOlH6lfrcvQDzc9eazBtNCmMSgClEFQMmCNHShfFxQj0aTEyI8Ehd2C8bVDTwYzGd78mbrmaqgE76wofhSGqulIAa3WqNbS3uvm5Lgx2kwRiT0XLfb45gTmSufEKzVTJtGGfxxGaACEoFctVjTloct9xDjwfqLbUM9vhttFelEpL5OqKwFhy2cGRT95LB7IYo3sDzEiCzReinuPwfGPJBBuUrQwGSi0DzbkJ03jx4DTnoK7ObNb9PB4udCJUCvUOVW94V1sVtvXTvYatmwF2HwPb1NlRMQQJpr85Elmxe9BiJtky70UBh5dksREsSkBRhmHjwaGNDlKuDqps9YE8Glw40sGa1NtX84vfX100N30WlTEMsUSSbN6fVk9UR3a2SwmpuPN8FmGDyRKroRL83lbxlpscGISlNpimGWAX1vO3BbSAAwIcEeWmbKK0koessWyDe3O5rQ8akBED5eint7BRcwQPbuk9K5zPQgPLmU3vdK6h9Xk122f104hIfmGwVm0wo4162lH7gaLttmLrVsVwYQhd6djSyYFkKlDUyUVw7fCs2GP3ScHPpuMlS9DRvLDQTmVOOAhNUk4G7PUcEsvemJqHkcAj2caJTN8dAqWwtB0UllDh4RhFIuxmIgunEoGESIncoDVN6aJcIrNH5rUXfLcVX69sf6Sf5yKHFzQeJY3LvTpUFxeDuL8vwoPd2IBcK9loCJ4URVcdkeFkVW0YOMMKpIgzxjUeiI9HiKCwAMQk8w1q2RY5tikNgxAJCw62aT8PApgdwbaccw3EcPRKuRBkhbrbtGBlQFeJcCtDWFHa7CAwJOiCJgcudURCBL7U0tiaFsp0DHyQPQGw39Q1Uml0pPp3Rmvvg39Bm5UY0zc7BTybCz76y913P02IrHQTqCAksRAO0wz70
push 0x4662c4
lea ecx, [ebp - 0x858]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
mov edx, dword [ebp - 0x864]
push edx
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x402da1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004098de
mov esp, ebp
pop ebp
ret 4