Function at 0x401860
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4cc
push esi
push edi
lea edi, [ebp - 0x4cc]
mov ecx, 0x133
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push str.ExecuteNet_...
call fcn.00401140
add esp, 8
push 0x3e8
push 0
lea eax, [ebp - 0x3f0]
push eax
call fcn.00404770
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x47c], ecx
mov edx, dword [ebp - 0x47c]
mov dword [ebp - 0x480], edx
mov eax, dword [ebp - 0x47c]
mov cx, word [eax]
mov word [ebp - 0x482], cx
add dword [ebp - 0x47c], 2
cmp word [ebp - 0x482], 0
jne 0x4018c1
mov edx, dword [ebp - 0x47c]
sub edx, dword [ebp - 0x480]
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x48c], edx
lea ecx, [ebp - 0x3f0]
add ecx, 0xfffffffe
mov dword [ebp - 0x490], ecx
mov edx, dword [ebp - 0x490]
mov ax, word [edx + 2]
mov word [ebp - 0x492], ax
add dword [ebp - 0x490], 2
cmp word [ebp - 0x492], 0
jne 0x40190f
mov edi, dword [ebp - 0x490]
mov esi, dword [ebp - 0x488]
mov edx, dword [ebp - 0x48c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x3f8], str.akanea_setup.exe
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x498], eax
mov ecx, dword [ebp - 0x498]
mov dword [ebp - 0x49c], ecx
mov edx, dword [ebp - 0x498]
mov ax, word [edx]
mov word [ebp - 0x49e], ax
add dword [ebp - 0x498], 2
cmp word [ebp - 0x49e], 0
jne 0x401973
mov ecx, dword [ebp - 0x498]
sub ecx, dword [ebp - 0x49c]
mov edx, dword [ebp - 0x49c]
mov dword [ebp - 0x4a4], edx
mov dword [ebp - 0x4a8], ecx
lea eax, [ebp - 0x3f0]
add eax, 0xfffffffe
mov dword [ebp - 0x4ac], eax
mov ecx, dword [ebp - 0x4ac]
mov dx, word [ecx + 2]
mov word [ebp - 0x4ae], dx
add dword [ebp - 0x4ac], 2
cmp word [ebp - 0x4ae], 0
jne 0x4019c1
mov edi, dword [ebp - 0x4ac]
mov esi, dword [ebp - 0x4a4]
mov eax, dword [ebp - 0x4a8]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push str.extract_filename_:
call fcn.00401140
add esp, 8
push 1
lea ecx, [ebp - 0x3f0]
push ecx
call fcn.004013b0
add esp, 8
push 0x44
push 0
lea edx, [ebp - 0x440]
push edx
call fcn.00404770
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x440], 0x44
mov ecx, dword [str._X_http:__SERVBDD:80_]
mov dword [ebp - 0x4b4], ecx
mov edx, dword [ebp - 0x4b4]
mov dword [ebp - 0x4b8], edx
mov eax, dword [ebp - 0x4b4]
mov cx, word [eax]
mov word [ebp - 0x4ba], cx
add dword [ebp - 0x4b4], 2
cmp word [ebp - 0x4ba], 0
jne 0x401a72
mov edx, dword [ebp - 0x4b4]
sub edx, dword [ebp - 0x4b8]
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4c4], edx
lea ecx, [ebp - 0x3f0]
add ecx, 0xfffffffe
mov dword [ebp - 0x4c8], ecx
mov edx, dword [ebp - 0x4c8]
mov ax, word [edx + 2]
mov word [ebp - 0x4ca], ax
add dword [ebp - 0x4c8], 2
cmp word [ebp - 0x4ca], 0
jne 0x401ac0
mov edi, dword [ebp - 0x4c8]
mov esi, dword [ebp - 0x4c0]
mov edx, dword [ebp - 0x4c4]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, esp
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x440]
push ecx
push 0
push 0
push 0x4000000
push 1
push 0
push 0
lea edx, [ebp - 0x3f0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.004175bb
test eax, eax
jne 0x401b85
push 0
push str.Failed_to_create_process_.net_:
call fcn.00401140
add esp, 8
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004175bb
push eax
push 0x4211f8
lea eax, [ebp - 0x474]
push eax
call fcn.004010b0
add esp, 0xc
push 1
lea ecx, [ebp - 0x474]
push ecx
call fcn.00401140
add esp, 8
xor eax, eax
jmp 0x401be3
push 1
push str.Process_.net_OK
call fcn.00401140
add esp, 8
mov esi, esp
mov edx, dword [ebp - 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004175bb
push 1
push str.CloseHandle_piProcessInfo.hThread_OK
call fcn.00401140
add esp, 8
mov esi, esp
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004175bb
push 1
push str.CloseHandle_piProcessInfo.hProcess_OK
call fcn.00401140
add esp, 8
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x401c14]
call fcn.00417567
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004037ab
add esp, 0x4cc
cmp ebp, esp
call fcn.004175bb
mov esp, ebp
pop ebp
ret