Function at 0x50036c
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5005d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004fff38
test al, al
je 0x5003b3
mov edx, 0x5005e8
mov eax, dword [ebp - 4]
call fcn.004ffbc4
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00500024
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.004091e4
cmp dword [ebp - 0x58], 0
jne 0x5003dc
mov edx, 0x50060c
mov eax, dword [ebp - 4]
call fcn.004ffbc4
mov eax, dword [ebp - 4]
mov byte [eax + 0x6c], 0
xor eax, eax
push ebp
push 0x500568
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ffca0
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403368
mov dword [ebp - 0x54], 0x44
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x68]
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0x101
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
call fcn.004091e4
cmp dword [ebp - 0x60], 0
jne 0x500457
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x500465
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
call fcn.00404de4
mov dword [ebp - 8], eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.00500024
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.004091e4
cmp dword [ebp - 0x64], 0
jne 0x500488
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x500496
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
call fcn.00404de4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.004091e4
cmp dword [ebp - 0x6c], 0
jne 0x5004b1
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x5004bf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00404de4
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
dec al
je 0x5004d9
dec al
je 0x5004e0
dec al
je 0x5004e7
dec al
je 0x5004ee
jmp 0x5004f3
mov ebx, 0x40
jmp 0x5004f3
mov ebx, 0x20
jmp 0x5004f3
mov ebx, 0x80
jmp 0x5004f3
mov ebx, pe_nt_image_headers32
mov eax, dword [ebp - 4]
add eax, 8
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x25]
and eax, 4
or ebx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x24]
and eax, 0x4000000
or ebx, eax
push ebx
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x500551
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4ffb5c]
call fcn.00500698
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
jmp 0x50055e
mov edx, 0x50062c
mov eax, dword [ebp - 4]
call fcn.004ffc28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5005b5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5005d7
lea eax, [ebp - 0x6c]
mov edx, 6
call fcn.00404948
ret