Function at 0x401281
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsIconic
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowVisible
sub esp, 4
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentThreadId
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowVisible
sub esp, 4
cmp byte [ebx], 0x3f
je 0x401424
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp + 8], 0x2800
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_HeapAlloc
sub esp, 0xc
mov ebx, eax
call sub.KERNEL32.dll_GetLastError
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsZoomed
sub esp, 4
mov dword [esp + 8], 0x2800
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowVisible
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindow
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowVisible
sub esp, 4
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea edi, [ebp - 0x6c]
mov dword [esp], edi
call section..text
push edx
mov edx, 0x341d0
pop edx
call sub.KERNEL32.dll_GetCurrentThreadId
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea esi, [ebp - 0x28]
mov dword [esp], esi
call section..text
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowUnicode
sub esp, 4
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [0x409008]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_HeapFree
sub esp, 0xc
call sub.KERNEL32.dll_GetCurrentThreadId
push eax
mov eax, 0x1e0f3
pop eax
jmp 0x401502
call sub.KERNEL32.dll_GetLastError
push ebp
mov ebp, 0x1240
pop ebp
mov dword [0x40900c], 0x403020
mov ebx, dword [0x409014]
add ebx, 1
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_HeapAlloc
sub esp, 0xc
mov dword [0x409020], eax
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsZoomed
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowUnicode
sub esp, 4
call fcn.00401109
mov dword [esp], eax
call fcn.00401a29
mov ebx, eax
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindow
sub esp, 4
test ebx, ebx
je 0x401502
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.00401804
mov ebx, eax
push eax
mov eax, 0x1e0f3
pop eax
call fcn.00401091
call sub.KERNEL32.dll_GetCurrentThreadId
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowVisible
sub esp, 4
test ebx, ebx
je 0x4014f6
mov eax, dword [0x409010]
mov dword [esp + 4], eax
mov eax, dword [0x409020]
mov dword [esp], eax
call ebx
call sub.KERNEL32.dll_GetCurrentProcessId
push edx
mov edx, 0x341d0
pop edx
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret