Function at 0x404810
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415f00
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x860
mov eax, dword [0x478010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x868], str.vhfPXsUfbT0iKH4JyGJtLXeokFll2Unjta2F7Y3O5C0r6XWvSInJnUSHGkAlbUYpCJWLXX63cIySA1Nx4Uz7nWq5K3MgQHxo9iqKsnKDKLnATuLMK0FMxgNE0wikiVfoGpeQGbKCV41Fnyx64UnyO62WOdk0tNNslWuWYnTsTKQl5UncATHUqGePCnUN3XxxD2CBRW61KF50LJ9IkrYVHiyCG0VsoElrB0nX5WjuxsI9VJfcLiTnfdj0kP5NyzFRFwQQyoAxfvErIaI2QusBOIN0LqRNkWzsKutIpk4aQYxH0I8xWjXEs8t8b3DzbxGGe6XE0OVLgOTQmGESSl7biLMdHMzphCdXRLpoRXvblH5Y5Q2aXmRvKXlvrsGFwWUxYdciJP7xT6ej9tymVvxxr5MCqENVuQaAgp4pzzdtIdncfnakY5LT8vPCEIARs8TcTz5lwikUv3k9KSjOKJxMPAkS5Nwhr6ChueBrV93eWmKOLN3umm96KK7fBLW97BrG98lBnh4cFF7X6w1Rl5djjqaR4hYAR12bnjnqBR6VfhIwdSqnIkHz62xmjKBOOdCkb428z70XedJylh4lXMRGV1mH4nDgKy3GYY2yseGe7i6ioBiYXnm5QPOg47Goc0IEFQodCq83j8B3Vh4n6l5O40bMYFeVlUCuCNteDVo6e3TlkeTvcakB0XNqqvxE7hjqAcVpi2DueapLxSShwyGNhh8JXUJv8wVvQDN9yX5IBnr7keIrNy4oJrFC8RLBGCcH72qwB22DBk4h5JEFepI1o11qqbo9P4pRvxrfQxPxrpfkWowvqGgVvyORgnewhPrLFzQCQMY4hNJrJHJotcy4uCP12KFessJ1EP0Fo7Yfet7WYGhFUYQX1OSo4p0VuYlaXgv0vRtyl7OkVTJyKoIOUKSRFcjqeUQBA6mSmp8NEd6bungbp33te2NH6GtCcmsFVOSdn7Id9Y1gkHywON4peiGBxhgBDSVySbGx8o6nIsttLXWuiMjImdGA86fAuyBlLbJ3sDbkhodQRKiRGqEbhq1814MUq1p1m7lAlhYrDkMymb5kdlkaQDW3dP97LmQrTy6A1KzuBzAUITlrAvOK9xSyKQmMzgYo5hXcTx7FSbPo53FG062zqQgjCijIBQtw2od8A6Qwc0zyjhhn3A809iBiHaGPkOynmdsMVT60bDEaXMWLOHDV1CvTSb4cSk3n6oBcVtftqqN6jg10Oqp2SBFVYOMYa6kQKLV3QkLEtwymjUq422AuP0PzMn2xImn2iv1D5YdGRPe7DuETS2HdaBRo1RQlOOJ060MTh1c42Y3EFcOiheAIleElm552sJwM3VtshYsHnq0rtNzWwFob5HeMsAnliTsfrfEx8sKUhmV3QB9rqGAngRCsTHhcIyMa49e143Wn3IxcgmnfdR0LXz1vex6COwpd76pnwn0aXghJToEIB3LrwGCrWU0On6JXhPMOc3TJfruFEvW8Imm7p7LbuvY5S8NQFmd6SHMY4xla74OCccAalIO1gEQTwWbeSVUGG2M9xyOuzSpd3cyzesgFDwgQdp3jV7rDPHcQLjH43mpQOhK2agCeT4GIxTaejFDGOoj8NkDsdm7lrCUMu3v9kVqmNiP0WGIahNzqAV7nuioomFcLINEi8zBN210wfuc66Grx6dpFY4HBq90AyvNWteceTY7A3FV7lKvGe1Dkv73tW28pWaPKuRXUQCfSE67ujLorNWLsyn2nIyD60LFJfeylYT2YNSfaruPNEpymnjPzWfYa3lkmLQn67gHmHq9FsIC9vxDqRTeflQTHDXSo3YITMI3m2o0edgDe5ercFCxq1qtwvEv60HGBcLreQHjFOUQd3ccn6wE3yi71zvs3wMcfipP7LxRvxwhE0P3Nb57Y00ye0B3ftP0XHbL2MmQOTU2uwpRqEmWUQoQS73F4BbG3L8lUmSIpzYj28PqnWTOt3AoitYPiHVFWvPezq7iFtzo1iTiSdMXaYVVqQv46rXbeElIGmhGDHBByr6SniBaow5tVbN21uUiAGgDRYTo0z0o8VGpmIrOqXUq2C2p0rbUSJHqzzMa6ADeE9HWvJVSr4CtDxm2pRWK8Di4dSW9SsuJojXnFkcTw2BEiu1JWg8msXa816IMY6wx2I2pK7RYCxAlbgctJ7r78WYN9PGQCDGoCwfBTs9OAHwd6N8jhOlfzAUMDdGrIoY7DSGkjrHG95Ehvj4iuL5LlvEpsLOYLTqATTeMoOHqVIrTx9hEEgDy86oxovufYR0MEBwYD2Suu4FJTS1CrBMiMpRGbRjk8fLLx2VNIitRc5lNYkByV13whehRqMdBG9LEx8EUrrcan8MqPskQAFIyJ2pHBAmRKV5E6NAPJ5kwc4wf5rw2hIRBqXvp87ba39L4YTqUGtCGL9pg2HwEdfjFJWnLhBpSWwWepgEkwBoX49uMEPGn2iEzdyh8dNYMs0IAVEt2AaqiVfaswCnUMReXw53rYSaSgJeFxNSTow37860gQ406QTbmwu1cxrrBC6A4zmDyAN6viNVtwnWN5jo49u0vKzADuC0sNYfvXMU40T5J1XCYCVwevto3jOC2s6ABme12qXn2CqR0wrtG6BYORy43R9R9IrAkLF0i3yRcvPYxMCW3t5WDAwnmV1RF8RcwXKYf2rhUR2mYgxwf74okdTgnSisEdICdgWAGJg18Moeg1nEzLe2loR843kJr6z7qmD9fDi2mgI3CKAQnBbkWWnV1AV5HydVklbMmmyLIajzGONC6awxiO07mAl5r1Bk9IRmjGMaRhSOmdPvemMGi66DO0hE2xVBamWxdvoH6gB3UyI2nvpxJ1EYFHRW6OA3KvEJYSvodD8NU9HKdmRDdWqaNqKpEdaYpP77p1VJCTxTgRegsXwj9oOHFOYH1GrJCptD5eeKmlnpdiU8WRJCM0XBio4MPRqE2CLYoXBXWcBEjBDYBUMqfzIriAXS63i7jm2ECS1syAHgsDqqnowtAo5kT58se5aq3OoRIdtzmKrjc6b7NuMDF6QyvaAmNy5SG8gsqPswpLm06kWU6jL3bBru2Lio1DHqqRnDEWCIu6nVz2J5iLVmaDKj9zM9Ouqqz6kLLl2qXfaxJDOHJhsKihLiwMNBTV9xAWUMdGUOA6aUMgNrA4OcXOlqs0hYflEtAIVALx2XLHX4fjj4AzSUcMdJ3bWds0e2pgkkXXAjwC891uTukUc5zrxxJUIfby5NNvLBWUhwf2rp1X0sbn0keV0rjuI395q6jzADngbzAKQ3jc2olmgPUkFfQKfDa2p1iFR4yHSHBfymX7oyQsEgVw56OgR0ag8rXcn6jTqpCAUyb0nUzkxQcngmWbh950CYkEyr5nhqiyvVexhgdPXj9BEFljp70ST3hJBlSwlMEv8NrMk8hWJQPMaWp7qY1TUNscnvhE2N1tLredIM8MjfSr9nSGDLltBap1resWb137Bd5FyjVCRLwVqmRKABhpNPtf7g8v4fII2pApXwHPiavzgDIG2ybSkgN7lTEirzmhDpo3X1gYaLcvnacwVJtuXGpYOVTbunBkfAeCz9hKKnwNVamSpiHbq57nWImTRgp7QlTyI2eW5i1pzay5PmskoezUN358F66uD3iDkzsyPpLamUx4K5oFuCgocjGnt4hY28n4eq6Ep3rNOtkoVFhmjxuIClo6gyUJE2cqfY7wS7iWX6ihlhXVn5oYhx0zvfiwicRH8sjv6X96co8B89kib1Xn4NQ2871MY5zhCNkawwpGraRQGtmLaXXfAxUAul1AWbCSmHCaod3X1vRazv94Jf15bHHcorzDB0lFYGthBXEaJNMjzuOhd0BvPHjK97hhA1ac4X0uLfmkQEEJEHBSV5Xigwr3ro3wIMCn8y9Rf0Rq3XNu0rMK8afmUCjHuy9Y3PjxEgGE0JujvTTg0YLb0EmJS1NiT99VMJQp5BddMq5KNRVpgE0MJH4C1cigMXWjo334NT933C8n2zeUxN0DqiWmObMWE5NDvnF09eLOSkCGHXqoPJob87spywQyvOg7XjE7oq8k96c9Mgw8nRRdTCOn8gDcOOdAPuYGO69tm022GVN0
mov dword [ebp - 4], 0
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x86c], str.Hvj2hL4aCBWrfpzmOj38krvms0UkJ4s9mb4G090hPHehyKg5qoIl73zior3tJ0vl57SqTklbVknufmBFznFna7cztLPJhiAWw05cwqvntthUn6Nv3uKRx8Jh3huqFUyF33yNTOf49bSN2AR7kqniFQSaIdfceE5lKWKXsaF2UshLbfE8xpz7xjBCgSr892IVnYJi7lbKTnyOOdQmAbTBtMfDFBwGCmMzpQ8hdxwir0WnOq0K31yXmPsU9GWIMFtw1Q8jAcLp5pJe5zoocEfhsjeK3tkuJNMc6KvFu1jtyHgzo8fv1pkwvgS50kiAvly7eQDwEXTuOY00xiwqc6ExI44tMBz57FsXHXsWfiy72orrf43G70K7JjIbpIYnuSXzupuRSuGDx4cibdvURYDRFVa462ofxRoTj3N8Dk11TbUiXgmTfoWm322Be0MV8jT3xe5s4QyORSozctUzL5TYU3fYq2dY3AshiOzv8kGfqorGpTkYBsi6HF8YvALp5UQWne6Khl7bHSXx5oxlHptRlOg0v8EyUfJChl5CpIQ76CWsFvm1CkpqcJB9B8acfhyVeAuoQzgbbOt8yBpsIbBK5So7g6DsGuBH7UTgpf19IIFE6N9jXnaIh1gf6ywTNa0SzLqjkm8sHBLwAXOm7TK6v77wU0ks9hEyT7OtkOVbjL4ChKzuyeEyXucCNYCqaCnV9rmDxL6YUvWcozkLrlHDgF6LV55xjJKq2KUxAEBe78QT5BPnzKiMusHTNQtTXWdvXyVNx9NUGYkNsNGDutqlcViy1SA0tkYQ5StYTdjDEoYlzQk3r4FwmqoWqMmH8Icffh7tE38GcJvktfYblzassxUT6cKjbHICWN4BdbyVInFY8dJPPyE7l94ShIOsOGk3s35zrkeXOJkVsLuRg7rqpno1p2HecMzJI7vsGw6VjdobkFXkFQoarDM4aMB4qUP3nzgfI3tGcdS5AtJoNRX0HArqoGPMzKmtLAPNMrWGHcRs1tcn8OevSaT8bpLDDHcDXLkTyxu3eCvtmJxIMOL8by0QLGPez0elHjnbconupW2Fi6P2DzMfcfXUEezzkB9utPddgmcr4GL2u9V4fe451WhhtNz3Lev9ozFpP4SUdk8SwgxFRuWK8ENy9axtGoEund76pnGz5nxXWzcSuzmixCHXJ5d2TmNSWXxuVqdK6oAphXfQKdOBFnupwmrg78XMpysHNCnnVUTHX7RS4CpuqI0o0Naa2xYPIg2JTEp3nvaNpr7psAME6Hm6Qek3g7xMzPVswsT0vKbX08L2KncFvE5jXt3Gqc9wlysFreI7xfNT2axrqKs2S9Yurptd3S776es2Rr8TWCXGLfUwD4X4W3bHATN9D1DIE9n5tPEvntHLsRehi6H3OtbGUOnpDeFFtaejppcJEt73hiCP0ce76MJN66yhrU4rLBB2eqX2ShmJkx5u1eEkRF044CPtpdrDrkFtXqvshyGuHppFnxHzB2r7UlI6R3iY4IbL7dGJk0smsqfVL1FHi2NfYdRA47TmXFtVBPGeHj3JyV4YA4ppl9eoMbWPdQqP9zqRPD3VfdXsW0aGXAmiC4961fK6tuMxkmymDdCu4sMHwtE0G2zQrMkACo8200NMStT6kpAapM769Yv5hkCrzxRIJC1EO842XQ7EDnrTLYIBBTsaWVHmgPaYFYqq0o2QnYpvLu3fONmBEnaGDQyKbs0uXvr9v5X0DOzYppypr5WS1j1cWxxFsrs2mge2heYj0TYmD3reKBpykojne2x5G5U2Mj3FcEYPldBL1Cyb0eNdd483tP5LSY8vpKc66UJGliXezz3oIMeLfxncs0cvzW9bxF6EMmPcjcbEMCnDz9SyVMOVA4yRG6ooLee817GLiuURyKmkuc3iKx2v17ooCNy6Ow9Gs2vX2erzhd7uzN269jpjzIuseGGUDHuTMKoxW2BlKx8O6TitsmbSN1flOEb7pYXGAGejeYPGiubDBpli4KpTYABe9SJzuvmos1JiGI8VC8oUNhIRdgYa2z7cqMmQrtyLRDtCTo3oVKcgBr8PatDEBCTck5s827vTjiNy6ELbQXoV8Thh6ISr6TD5WIFcdEdjbrXxhF1mtB4NGCYEb67Lw6CzSU4xclOSSiX6476QmMDqPCaNtsw2FoGj8bVfkqtVHRHXQdTvvRTVgTLX4s8I1vgObh04dcr8WUPWGGU1mvUbVvRKVtOwHEnwYeemBW5yQXT2mJaYPB6AXvyc3FgdCAzGSjXbwYNEykfml9hVilcgHW5Gj0XKmz4xJ6Qb8C6hf32aNbtexaiWGTG2B7gdbmy8PoTEPdxG0XiRCAvaPLLYFuLrIulO3gnsVjpye7LuPEQ0oHKSU7npAOLsrmcVG4rocb1s7FxJMtmfoj9tVr9SA0b4uID3t6cEiDHBtjEPLzkqCKcRxgtH3dBCyilOtcIUjyLQyoYAHN3vLS1UMl5MuzJSfDM2wIDIO5OGInubsQFAf2fmdIYHHij091gA6vatPEPiCEfdO7bV869MOFzHDxatNuUzpY5uMV4r2HlExNnUesyJ2MwDsxdgHSIcl0J0CRay1Y0TnPT342SBJSSYxvrFhMsNw076GF2HKYsFWWc1Pf6Gh40TsFTnVvLRgUHKOPXCGa78UBxCs0KbsFyaXiKv0d62zbDQh5xCr5oOP64NwM18xlxc5EewNKI3aKybNrGIReMFfoHFoyAwcYj3X1AjAMJPs8KoybExWaS0Bhfq4NKdBJwq0Hg9yI5rzh22cP1lYsnwnkgsgwqVo3bGL1FGSIx4mIPxLeH4mE0mVOcipd1lAzAM5imWEKF2kt9gRpUgKnyXBQixEVzXIhqnURVpXwVNH4vprJf6YcYfHfE1OeHdKoDIt86ROuw1rA76WNzq8KetsCbEr8Bo7pxGaqBzcTzobzElit8IqGnk6mCxLf1HG3MRzbj61LVPe7r2PSr6kDxPJAwQJEjfNnjqxM9taQnoGPnWmspk
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x870], str.5GDpYCbvmlHNKUim9x889xhMDya2UYHfbvkmV8kEQgjaWyRn8IiACisiBpRjqKxrKmt4O3pHLmyOiDi6vp3RzdVXqBDzRWT5Bgrac5dmRnj4IJNxQqHle8kBoo6DB5A3CfXfoID0pzmFqJiXLBVkwIjEhBGKbU2sCvcQuiHGeNmQSShORSN5btMlnDMzuDlzufDtmXCeBvShPHSJKjOQGJJwwrDiCIfV7LdACJG7oIn5h7VB7XONjCkN4AouYU5doudyEpnwU0cPujQrz13459NtOe5dcoSleQmLCDim3yxA0PIxOIaHL6Cxb2D0dAhqAoJwrSbf97yMAzfmxpbLV8lH2kSLbiyMoKN5NtVr70fpkGNxsvxgSIFnKWwYzCFVCBrD9wz0l8vOzInYhu37H8rDhmat50aAfKToHYgAMY9SSwCJJUUdguEk1zgzHcfFh2PsrEjDQCQR9iN5BrIpaLqVUce4FjMjHoiT79ahvGbyuwQvELsvLJ3Hspk9vKgQzOGKfTpjdoB8h3kGDJugg0TwBXIxXiONUqQY6bMgWxvgc2qwnbCnw0x3Qdrl61cVNm0yI6alev53aYY5H5XwfYFBd3sadjQ9iTIkVAxv4ew4mHvEqt6iR37ccWA1SUNBuk1ajn5nYgOjfm7KosVhB7QyP2yqWTLFt4hPb44g2GTgwqx4tfPYqVY9ITYjuE4RpBg6E4VfMdzQeIety5uS45K6SNn6UTFWou9ECCf2i6yrylc8wj1p2XzfUx7BPGdSAlu9HMJ4bcpR4MaihoVVBNY8Wuvb9nWObUecjtfwwTDpvOpuLM7NOED1zBHw2HK7kXGlBoMeYeBNWzWrU7PhtqmPUrMTTFcmfnC7x6tJFKAeIvm4G0MC9P6gE7IWsDqi969YNXAjgDHkmmTt3d219oXDUjlNGkhTf9KlQexUUC3dKhtY0y1BAvc2pio0NIdmODlAWSTck0vpYEA8wUztmlackVvBhck26Ld14PnxHEUUrhpCEgWH3XnCmEc4TonvnL3VXKM0K51dLdMqqEMh5evsKsRkGkHzW0Uyca7lHjocRS8ETe59BMlAfVQKVknc7Rg52qt4kYydU3yE7bffybPB6ejdb42BcRXCyG9kRhS5mKNXbN4qCJ4K47lXguYaxAgizYw17YD4SpdkbrKuhDf2rTULgXasuFL8F89Hns1StJPGexSfIRK83sTOx6akrPw7fNGHrD4InOjcsDpnWg4qdi3KHQdJLUVdnuYYE3Jc40Vd0jGzJsQ2JsYGEyaTRLOjXuYgRLSnk2Di2fusAWSIYzhaxOyf9nmiGXNTpudOcU1cIcWCN460PQlcKBum4LaWVSG2crmtX4gSgYBBqUx5E5tg0bN446b3T42rzsPNd8gwRwnTgtqQmDUfdaSoBvMhx7lDuV3HJauuJNyVUw7VmsKwBuOyakKmzviPkShuEw5m8TS6II4Dz4XVFrkXeSeRtvGW3PI0kRQSiVpKOuVXsyrJ9AJgkCJovguA7Wrrnec4u9Fc37tDWCWF2S3hY2etEGL4sVqxHUb52OvF6GA5zw9TByT2KJ1zIyLpB5vssCuibmbpmblpg4A3qcyManN8fuRlwisM4kvkhcny0jUtzGIehHVWNHGxxTxiKYSBdmbXES8eYHELvnRYfjAchxc9F3tpidlqRm8bD1Ru1L0xAHghEBIlaNaeu0rvJzfdejEbCirmyKAJTO1z8s9s7sU2BGn76gSoMvDnXu3NQJb01q8Kv5lMJy5LnPmuY3tQjBCn4rkLUBEDYQucX3rNHgIAW1BAug6SOyNWl6f7w72JrYUGRdc8EKiAfDs1cOKjzE19cqcGcNv1ug3vSN0EjlCPTUqageil8wHb6w0hf5oWKJtkXkSqmpWkoS84jzuFj5YruyMAJ99Fp1DmiExJunS4Ssluvv0rcDCyQK9mv3m35jTblYh2tMqVlk1Rvflf7LYmEr1c9ELDYnuSPO401f0Nx1aowD08Hq7Rq0KI2FgINzxYK1uvUrnwVT1Ue2fBORGjEU5tiDPfKP5tnJNEU7JQNcT1RqkBBE08UI9XOTFSxE1KeuSHP8DwbSiW9mlytJ0WJ4rEhD31q79J57gatn5eQPNHlVij7kjBFDSW5SqH9TaJ0J5GDSoAoIdWdS4ar289keLcrsnK1fEyjSadcGjd73q42uqUFImOhHNJk2CCMX5rBkWN0XYD6as9Bz3KhCv4a12Or72wLsP5JfvLTWVmecvYfBvnYjIxA9WGh1AjMG8CO5ACNV4P7aT3LBeTNEM6depw5TsBbe9EeEx3AjGr9S6xx8zS0SaMGqEqTKUGNdTgD5oXcxvytYHnooKo7wURHYluvooz1kkVVNKuyaBu2Ws8H7USVsKOUfuKsqqVHSfDkDWVBOrvu5g7oC3ixQ4h5Bxd4lLcgKmMeESNkbUNiv7lPQ43egO9SzhNpqetBmhfok9QG2gyGbdvXfLWCxEu5GVpmNNyaItkMoVXGf9TCUP3eTPkAPRzpC5TvqCXSskPCX6ikIASRis3yqPUeGnSE5I4g5XVeK7Xst89Ev3zULDmr4eUXVK6BRdEJmembl0p2D95HFjT5C9tQBoYqIa63QlnQHXSdA2iozWPwoCPnVODiqzfyyuYN0gTjoQOlnadQGWkcTygCDFKLtSfwgc2HmvPwtKc6dcd0FbIOw80ovRuPhn1OYoKA11KIUBLvaTLDDkltFIR27H9wWW18cROlb9aQqxV8SPQSXLKjO5ADQAMoaqarH2aO6AxGCNR3AyO8mrHswpS7Y68wdvP2ETSV9sjJRMpP5qyYRXa3qeo4yXDvUMRpucgAJgRep25AKKnlSCghevITu3rtHIyl1dPHnSwfjd8VzG0o7hniJArOujp1zIASmVieCBzys8x03kFyzu5lOb3I7U4i71dmWXz7b7gKzLWrkB2wDr8Bpo1jK8HXsL1myyMlJtL9bcHp6ndgYVujyLK5Bmgcm28GiBfS97fRFFR
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.00409d10
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x85c]
call fcn.00406d50
mov dword [ebp - 0x864], eax
push 0x4794b4
lea ecx, [ebp - 0x858]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
mov edx, dword [ebp - 0x864]
push edx
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x40491b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a56e
mov esp, ebp
pop ebp
ret 4