Function at 0x403160
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413af0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x868
mov eax, dword [0x48a198]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x86c], str.OXQmFXjIEpYfDSd3507daclfIYOS3f3ItQNbkCX1GAWcOP4SzuJXMBfbC9vYw9owXL0vfXcN4OCPKTlx82j9qvjYUBLn5JQ4nRxN1TR8p6jp1WWyNM6bzcs418O5W6a1eSqWvDphntE81KXaawlWYhe2iyg188dGE6zjRIYFB6I8RQBkkB7LFKNGbO72pz49fpKGu3jYMaXxtEeFSVoqUS225UJYjXR85hDl2OO4yYdowokyX149hjlhsWVE8HW5QJNYrxw0FTGIr7x2dUSDzXSQJ3RMX2LbEpIKU672No1u2MpxnMe8WnkhNdVzIymgQaJ87om4jSyvrvERgEmMfLJAFKAreQTeu1CF4B0Ipqg1x8hT5rqnqScUY4GdLmpTLQ4cQJNVeAK5DfplOX3SSuIpIRarDmHawBcfy0bIkUeytl2LBNnTQJDuu5WOv5lJGXEV73PrRcSpaTNwIb4AvhyWxO43qIE9nhDWp1INFoXDejdQz5hESdhRLpsXRqKMOAMy8s6NdFInxYtLJ9HqU5VHFnasFiuQpFkDXpqNzpoLpdC8TLyNrTTcsrav4mumD0WAnlttvch8vioET0xf96PrtpldR830CUqtm6iswWuSzgfYEJniLVJmkyVbYi7pOrbXq1fQraBOzWODd5P06LQUyaFRBNDrC6npkRXEBlhdiaAjHlHfJe8B1NdVX18XaWa1dUDhPUzOhYQMXfj7Y5ivXixGqfadwNyeXV4YnCUYgvYgPfPPOCHAbHX4ARoPKhnAcezVXo0KdPoi5yhLVEeIPq8EfexPPIiKbA8cKtTKg7CSpbspGtlDA21GqJpDJfNyUneJon1iLthovR2odW71xrU1jMT3mJdX4pYnWR1ji60x18txgqanfNs9jMXgxRF52mEaX4eIu6540PzP7YO0SQ7hREvP1Mz8Qy2yhFCvpyIEQlpIpRTjjlL2mh8rw0XlOI0sOXYEJ6lX8TlpPxh8dCzveOw1StaiRbwyr39edrUyYb8uVtKgVk4eBSbXxanOB5HgvAQMSCYcAWVzX0fdlFFfVrfVU7bKuoNESOIh42LP81gc1dObPqHYSKwHtrxPFUbyYBf9ik9EPj3PR7F3hYmnospjEmQN8intGkQjpyB0TOAV8uar7gLNFs0WW8QizY4AqXP6v4htzBCT9XMGgNT3d4Y5R7HWtg3Q85niXyWOlFeyROFKW2ARtP0e7KJ91rhIKsoKE2654FuNpxBDYN5KWxyERM00KOdAx2uyss0JAetNFx4A2wKmYtwxhi0PlNEwpzvSLwQFKUM8f7i8JR3fa1BVd3k7NIcQOLAVkproXbyy49JQRWmIUDgj7F3uqzCTiERDKtlWdkhake3kfh1Qw2AH1HHVRXU0rFoHsaJR5CYhBx3cKHku2XsFwyeF8ajxXDcBF7BcH96xNTO2oxwgnnohQx3bu6aSCMfzt3yvOUwL9OzwcqOuhlC6JR4eAi7rhHtDMRWTIPB9anNhkqmms1LwoH4w41K7kw1Rp5k5hNT2DrAby3AGNRJWaLp4xUjqxarQIAdPI8w1fb7UhyIlXsyfvUqNtft9Be2K8dvDTh4V64z6ba0kpVhE4cxJ9dJyo1yhCDXeOawAGBSeiNwV61TSHTM3P9XUyBURE6fMK2w3ApnMofvcvYg5AIS6QoqsuWbDesTWfslwk8Ke06mPEI7R9EbvuqLjoOvqQ7nM5mTsuw7WsLxi3G5j50E37L4BdLgJx30QmYIvGoXfPwJGHUHUjqUI34IpCfSOQR09pR2uuEbsWrJQc0oD6TfIFXAJXjokGlyOQSDvqPQ07jyshDACv5azUv70vSqiFgxU8jNW9WQuNBdnDN6HTwcMll4v7fpwnGdrClyaGERPaNrgCaPzM6rDwBcqwolgReAUNHkCwFyNKctMwws5eyoQTVAyEnf89iwYQA8LA3TKn3G2Anxc0652pdEmFeg9b3HrCLwTi3hI1HtsX2n2yv9GpC9VS2AIQpFgHtHcqgimQskUOybR71LcGB70PQwE35IumvoKjuXYhEPEdLW5xqKOwSYViNq9zw4mA9TxGPBwTFDiegvep1rKCpsLbYIJdVFf4c9q3NzeNz6nUdp9viD2WeA1o8C4eVAqnjWSPBsU2yadF4w4kNRzHzMJGKIMmfcmtJovq6LixniS6ClarB7dpUppAm8H3nxJ2RqijWHLlkPtw3rHVnKjHLMWzXFlx302oPEKK0biXzAnD6AUVe8X0LVPMqBqrBfL1dF7TaOjzeNbscM6GDy4BEy1SwFXF35uoTYoExVMSdbMjpbvuthgCl4W8U3et0xH7f5nNlyebqRnRsbtH2wWXTCElamLrKS0QWpBXYoBkAum8EnhNVqkqv1CXGIotbwWl7koxVSrNl7qo0xhsBbOTh53w76KiWKiieahXlx5B9O5mas1iaxHlfIHgorSFjEQY2PQRkeohhpQtmALnKqBp3eajoARTB7PE6J4voyxuLsVC6R2N4mm9nVv7uj5A7tipllEmlcopXskAwJldIh4XypR9tnB8iMLVAyBfy5PkzTJWRkNPgy6AAnnVvskMGLmuwM9g5iJzHdH5xtWs25534Ob98fSB2SDWKPPTCa1zQLte3KVum8VIgSsujjFvahJGJYqWtbCQUT6r5nlRotNk4VoJneQb6MhJRYXwC3sXbSnDtjj9dk8S0xbM3voHg450JPERIPnfvHqocXGNcwOaG9P50CwGjAUGejBOULPUY3wzeDAu5ifXawo2mQU1urEUeJwFT6J0zJkTents1p2P7sAGmHPWSnUir7jhSij7lr2JUgAiK44vau4rONfupi2ScljMqu2TpeLdQuS4DmE0iOBHHa1qLd4imelAnqx20wFfqr0qBgAzMfdUY9XgxkKDopEnXvIcpbMuSzis9E6Ngg8uLyTj6VzyltW3ILC60q8phyNOkhSvFXJUczxEGvDcPRpOuTwreREas9iFNO5Kh7GDvJA7jCPd2XD9tcR
push str.CREATE_SUSPENDED
mov ecx, dword [ebp - 0x85c]
call fcn.004063c0
mov dword [ebp - 0x870], str.2xpukInIMEtE2u3Of54iOJpcVtEEE6B7xkTDymFK87ULvxePvVW2GnOcuhNvx5HVsgCQYslFM9rrKimjp28AH15Rs70icLBWWYW2AKzawtacNNhdfDisOrySu8sRp36SUUtORzonndQMGgat3QmTw2ulwQ2m2Tkm2jQyOPKTELV8wTEYCBiPRJ1OI4b1RkQ1KhVfX2uJVQsom3IAyEhRn7bkzV2mMsAqgHFCmflq3x8Ul7K4bzBm4eSjLWn5CtS5znc8x6SR6dgeyzwbCMFlxMWJiSA6iEsuoPKUAPEvsCP6mzts7HHvRffVYGKTQe89IhtIiFm6Jz4oJQxnL3uhyQtSmzbdTkdMG1RqdM7QeYoKeQ00H5y8CkfkK9bv918gdi7Qnq4aLEfKY93bm4K7Ef2n1tigqkrklghjLqLOve9V1J82SvVkxc1V6iyytK01KhseMAznJ2bpf7Y337WXEGcJ71v2ReUIMRN4cFAfT7RRtcz3fMGiHcjnjMfV9axcqMrmbnGFxcjyqma9wC3EM9Pg6rk3Hovri1wNgkvIoJ5lGphOyUUtpU5C1xQKNfJSCGd3qasiiRjCIEGQHdfgsP4v6pYk5701El8WVKv5jEnNwbcmPEd3HFc6jGOO8WNn0fMqCww9tLSIxnSg7UusQh6IOmSE6LsO9kme5tApFu5quhAlHvTubJQMkcOptkIFJ9nxW77kPYNyw1IYfaXdJBdrzjcjxz8OW7SLczHj1SRxAOm20xFST89TnfxstyREBxjA5DbOk82zv5kSN7s7k8OmFUmEcvQ34EAWeJyjY61BTj8s3jeH58B2qE6txJFqfx54AX4hgyulfdXaIpjJvh5bHa7g6LEIHbCpp07cvE4gNyJVoBvChk13FwNaldMnxtsJecz3Pip34kI89q3LbYgU6z0hnhrX6cluPlxrf8rUtUmORFnvjplml5amYeixHgrfbryaxOKTnIOnPtiemCsoWFq629w9vBvf8GaHAxvM5aDtMoXzXD3dnFMon2mVCIh3yofw1h13qhjfHjboJx01UfmPkqXuro5jnX81dPLTJE9hSrnJmxxVAmtIKtnSCLXYvPwwjRmeSsnzOjDTvQj29Pv30RvD4hx8RztngQxCfq9DlOEjROmlaj4vYUbFXI87qNvOI6bpHUrqv8OD9R7SXgPv4t6qLcEq8cs5aIjzFOai8aMgMVTB7Iy9WzX4TrgqDQEcKWcOkjOPtCPszIJCV6hdds62A6hFKfCX7vL6Kb6m6Q76i04vLXE8vP5gS75Nd4tWsih2sGJdP0AYnMozB7SNQxyRJh2drnTsCuYSdukfi1oBLG6BGDOmewyVVey2oOteKBO8LjRgRFNeURrOvWY8GNwuXoe4xBFsfsltUXJ1HydJP7AUQNsFhrgw73NQQwOPKfLMtjHdI9bLYIB0Li4G2D0Wrh8CQXcrbqUaeiTvzFpDnDpFyNb82BlFI2ehySVQJQiS2YTvIeHoxlQXM5RalrpcJ3PhGGk6tTdC7YODDRdGMYLs6sXpfJaERHWxqPpkITAKfhFJh3X7H8ryFjBKD4XzJ9dXVHWzTfCxnE5IrjDv2AQ1vKa3eQjjuY7P2bRqaJFEjUgIe1mjqnrVv2oSoJGiGNThFRD0BDm6s2uY6s0MCea1qSja5xD4f6AeV8e2cDAcSb5NWTc3xxwuUubaXhHbuoWs3W8OMUwEjJix3yo3estcyuxshdrj85wyo4jd74yq3jtE2yJwSMyyLXdXXMqdgADXtTjHO9pQ6GWHX3a6P4LzTrhSzCfHoenWWAahqoEP6zp641xGTnwFxT9m4opKatdM3Ms5mUGLzWoXTas9zhy184uSaoyQj1CQPzyDVLUquvehbDsWMq3wtYU2ipmYW1uyUeTJaTvBhdTTGby8bHL2Xybq7Ghf0TayUEr8lCkll2OGXmWqPAoNfYGXju9F6R7cVo561xNQ83JqiyUjq6uwiMsGzbciHY1wDuxh0B5w5sQQKXWV4QwngPcRDf3518BjaBvQm5S0HsHDbFDaq3PXDjc0dbHW00P0c0vosAB5snhsavGwHtFn9JqI3AyLm9JLUr0WT4hORCTS6c1jgIcVgUef06Aub5XJmy38jUTXcRpunvAXadzK7EiqlClp5wwix37fKPDKXqRPv3rvHq02UiYiDYpaIahUMRt8mfbixJhd3uh78jFQosPBQ7DYAfPEMdvwdp8l8FphytvE1OD7suVCSlcqNeRDAfmYwfAeQyhYcMx3nNDx7sTgxttn6L36D4UUDp8SDa9CMqNiA7dGA5QXtL71TI2jLJRx3gUNpIAOPBIttxFW9OoLhV5TeaxEdgDUpQy4TWpvpLMKaO5ygPHjp9yRLlizzBqUtUekLXFXhvqmfChxx0rLb108pk8IpJtutJzgaYJ2FhuB2bhJTCpYeep66mvTCL86PDqmKrgMjwemsTBd4biH3JbD8Roc13ybPON4mXgy5NoKpU8jiBSYhLRnMg9bQFALS9t9fPrJoQ5844keOSu7T4zB276tJFNFwcKXAKM4fCqWY5qW1GU1MODXrfDQI3yyqhrssUwBigxIaHpinqt9EGHqeD95dKYVqlRaMUaJP8z3VC1Vxb1zbLDiiv140GW6u8R8qRsaNLFB5rNkiJQUTBAc6hFMjH9dH0O46hsUMX28IL2MzBTpdeX5PxyfHCXel5zcfEENz6iDpOD5qGc6uVonhILWV1BFyWxXUEoSau2yi6jCgGe4HwQI3lF7HBwGId3vUwuOqPjdhbKhiHuVpGWQtKWCRkFDq3eLKFjqXUvs25y0EnwlevqeaMbkXEJPxRC8HjpfQ8UBrb1XyphTAS7XcPQvLm4N2c6VMvsxIrIoFcYw9A5bDx0WdVkSjABfNBWsPahfHnY3a92eDMFFl2fImDSDVLY5PKQVoYN2r4DeAojReXaPnI8wh7EqdFqq6nQzNv9g7bz4VDFpb948dO2k96HlXpPBzipva7yXo0v7qSy1
push 0x400
lea eax, [ebp - 0x814]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x878], str.x32DcwynrjIqTi4iDmwpJW8MgradmHfo0H4tdo2Dc6NJA7zpxkHMFWTTLPUAbMV3VUCQ24JCKHK4FLVNDvNbglElr0aKKKCketFKzzAuHknRq7b0voRpzDUUjuDKdICdJ0Ultsag3qQhlYrWKaQtjSJnS9niVKl6fMYU5JyPfID49gTXRMusVDLk76NHr0gIuYfTp1r3fbxCHNOMl2nCyXegnFDXuBUicqYSck5Ao4H19vxwAnSm3sUzwxTG3GYl0LfyUil3xUzULivE07gdUdfzSA07hr8OvqUMG1CTWtXD66d6TgzPsP9pcXBaw3c4hyIym7VwmOXbOPf7zDG5AtaaF8LnmG1NO6f1vIQbYg38QtgngNlRXLqNYLRTxByaBKPrnww2qnYJl0YXa55jXSC9fQzA41PC3YHfVFH7N0RTAnfkpBfDDw1X2AST59X7x2SYOQGmEg788CVj7c5eJPsSmubTXi7UnRglphmAYwwDFK28jwACKzooIj7mkHyIPiwbMEdwfr9cbOzr1XCrPVOV15GFUGDzbObtIegMlUpgLPHfbFSvSGjNE5fOKyLWyJzlEJaPD74WMTBWIBSLr43ctRqu0CqH87T3Ns56WtbXL5AluqWiNQLbJheY3ed5XMaX2bPPwI9Hsu0DkBgiWlNJdnWfwJLH8jbFVaKd6OHaNehoYmN9zk1J5xgRcvOBC5CPMgNiPYT1XpWzbGqm38UU1n645VbcmcYiAMt2nJ8yhdCyBmLzuBxV5LMGnqIihzzY1zRgMP6HkLW6RRjyG5wlQRWhuoq5dPy1uYEIAkP3PhGjAvmf7r5xl6wX3gk9YpRE6T51MuINNTGKgl3G030Q08NxQtytlulgDIYGNUsPmRQkocn8fOEuKUoqVwiq11BnDkL7wp3CTp9nqC6SraXyXFfGvSPKFI7FhapAk4Rk0JFzL0QrU1t2sRB3Y2wCU59WuatjYgAIq7x2Jr6rFNhOug6R0uMzllO9SL6mJCedaOYeEN7Erv4DNPC6oM9wtv6mLX0Gj27Sn7j2LKYXCA5czTrpbscMMnIPcdu9PETqslTIiHErm392rX74C5A6ItiTRxpuXUCc1LcWnOTitnHAtRAW8d5yE8g7crgmIuy9OLJM94jNuDJceE4EnruDVpQ6mW2hCmmVRF9CF7huDkO4HF7mcnIeQ9bE9ClFFH2NmP7kWt5VQw4lkwDTCDKCDX9I7vnQf3REGDo6XnMTMMf005QKUREswetmvcU0g8u4tuPyEOiiMcDW5ti2yIxOD5KMgLie1XSbwMmHSzl8Rn8Xm6QuaQC86pml1RrujQkQPX0VvbtANqcJ8DJwDXefXTwy9zPHnjrxCsN0hW6Y2YQP41sb1JGnf0j3GxyASaanjIW7WWqMIcIHlpT8zSu8TSAzoWhN0vM4veFOd0uyIJ1HAjfHLa7yQw45IreUjGS23ti5IHb5ALu4Sr1Qjhd1XFiBQdelQipiWWbe4rbcB0uUIL2b32rk5NCmDYDp8dCvscP1Nj2WHDXh5AuU4byDXceFEWrk6A71XIMxqf5tAop5ppSWEvpxlRa1aQcebPMK96GloTw6CxT6A23OiQU0UCg28W15cBSjPSdk8GmeSN82Xu8EF05ni1dtg0BLvRYU3EbMYNrt8tjti8CiGPXn7nveVhf7POYs31qqhdqxSlgSQwl9raIaRNtmdAMJrU7shAThhDPiiIpEjxrkeTzg58i2TfFdXTV3oYCRdyXKhoH0PimyxTPzc0VAt4V0xLj1fQG1ggY2pJI619Tc65TpBNfs8p8rJOtPSQh0xJSrYAzWULeeNmetGGPhM8sKCxXyAFDr9Lso1iXw25KlLFnPJycM1BE4DLDUN06n7WlscLdClghNjWVY18DQ9H4oKxGfcw5fqy1kUoaVgKUxVbBMJPhwaRzClcFzEY4P1GLRj6g5Dg68nlcv5S5WMYFzflpve7BmMcI3aixxNMAMypwMahOsqvqULP5mcEnqBGO01UAGxxulBqyF3L8tbpteFMe24p41eyQ14sAN44eiQnhzMPrBT72Y8AE5t8vusWqtfRj337xMOlMlkM3y6DTwPVxIlCxCXKXVaE4tDKwzgnfaDF0eYts6RHnNJI9zrFK6aPN1qfA56wUFzhhCvDDQO7YMXfmTt9QLgTXwqdrmuT7O0bBRgEYNFBwNw3ivDncWbUFGasa6LCe1HKyhDABSUUrD5Y8LskxJoqxay6aDvLL2p4ziCXbSt1AFzV9npLro0uNq1u8Xqwf2Q1SsYUYxHa4W5MGrUbkiRIgRoi9Fv0lzFfyw9YRosRlbUtaslPp0xdjN0oy2SoKAs8tjhjeX1UdFAT6l2MK9gyToAW4VWSgrMRnOdv5B6mNoP14mhOgAXUzGmoJUfEKPanOcwH0ASwxXxLIcjwCgkUrF0rTaxUaT4naIrA942YdCO9NTkcpgHJcbA2guOVx8SjCNWjf5DyVg289UtYXP947XKqPlfUXr1qf0GyByfo7pFIC7PIwmq44Ds5XQc9D7MIS02x8lQPvfuVcIt25l1trIeLkKfTNPsWfE3Xh8UyezoOWmolws5vhDXwUpcsOFgDPWw56xlsFQxqY3xMvutU9G4C4Q2955o70YTCe3tGA9fNvbPjznNWe4mDqJUg7VYoW3oRQ49I3e52Pz9B2ekofP8o0nhbss7kDvRAJRCessLeiph75e3wwY8W5IGeMhPvWVT6hCBdxPgvkh15ILD8XnyGjlXMPraivYNconiTl2HYt74tJltz2L4dGt5fol1MOvwdB6iLgltNjj75OzGENNJpuXh0lNkTcsNYYBFC0H68xBMorh2JS08rkmVsF1UgMV0SeE0tBGm8S9EHUn1GvOgIcLG5pyCkzbfLAQdCrvc1cth5mTRTryAUl0kjFpcglzj3RHMCd1NYnu8kL6sg5q3YosSAFVl0JFJCtDBkVJxfpvF3UipbkwX8hfAqFUKid7HTqV0OXNX3nfgyrX2AKPkElsngCNJhvEOrSLqzvYwCVkBO9bUGyv1jJwAt3tsWeabvnDCn2eB4cxfMCgG4B2xa5vUkRq29moJrPExso0Ti8CHTXDr0kuyQvt9LawvMw1Plicv9rXyaBr1j4YiJqLdrgyXtyswWfuBFrilQcA1DDMu685tRx6v01tecvrIMkXB8e4e9NugcrLxLCjThX5caK94b3R1jKPC3XymvLE54105fY7F2NKe6bmn9K3MOR7EH6gWhrbWY2XsGVz9cfuyJN4KnLbSQksRq628u0m2eF4vxxqQQB71LXlrCRlAf6cFyy6YXszeAHyswe3y5fNqDOprblvD4wfEr85xkCm7lvC4zHsb1z9xAnCrR7wfHfdBtw2OTcqYk1kuX3jSL967BtuP0Db3Kcjy2ymLPCyOPJCmbCT1vx1OrJFGoY696IoGv8RhYgKjJKlJY99amqFgCFVOqLO6Sp0qkcJd2e6RoLcapEE3wzc2qzcJWdLUyffmUMzmovPzE0QDKwDDcN7GUAxBl7g3LtVkJ2lwfTmgViMzBrV8y2mGTGamvOwqtJukf9pox3co84pSLr3RRefuXEqBRhCpTYYAUnyC0o1eFg2TlR8qkustt6MDl1zOvr8yg6TR7eBDutOpGqWAdV71wvSuo9fU2JhOMJ1G7FWg2PQGr6WkMNGo08vRWkprvLpe1NNA1E6og45queaPkn4Ry5xcwOJzcOaOuSB5BXj5GspLYtjt93uDBj2A5tKWErOPLE7BqcV3iSwlmQIRyhDSjycS9HVEExhGqRrvMLuHBM7djFoLSzyHCplAJtAejn533k6aKVDcDeFSLzVcuzGbfjXXnnVDVvsKgWVQcM9mVNDkYxClJXPjFvEW9y7n7NdQEHfPHfYIAFjXpSlBYvg584aaAJ7iLvPASEGiD1bw9DSGPfFAD3wpCRoWOePMYarqBVkn9HYHI2sNfzM77wFcUGnmqT3CbDM2tKBd9GJVTK26V9uaPV4fz3i8vds529gfbpmPicUxPkrNrChYelvmQmsJIeBRsdUapiNh2hczaPtCBTfWLVahRPjjdxXaEHq1TOzvyOkO1TLFui9IUVzGqwtJDlR
push 0x44
push 0
lea ecx, [ebp - 0x858]
push ecx
call fcn.00409580
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x85c]
call fcn.00405830
mov dword [ebp - 0x864], eax
push 0x48b2e4
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov ecx, dword [ebp - 0x864]
push ecx
lea edx, [ebp - 0x814]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x860]
jmp 0x403279
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004076b4
mov esp, ebp
pop ebp
ret 4