Function at 0x403b80
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4147d0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x864
mov eax, dword [0x4491d8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 4], 0
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x874], str.EVvBRSeTgbWFdU4Eiy87ivy6EaQ24uhs7YaaaPMoTfKxcupDf5vF29hhJ0ysD8HznBrqWiOmBkPIu4DYX9jxFujOLsBgamImq1bVNlsQAOYxwl2thdCG0Jr7AXPV6H2HoohAbME6KBycehcyaKEtHOkFFpDSk2F4FYIIxdeqH6uMX44hSeGEtsobee1obqYBP0A1hYMkLeljybTmP84nU9WqckwFteE6EI0AIbLrVsbDhnj9F0edB86machMt6GX6odUdItwVIHyREcDclH35pM5sL2HPTqhmjuSWe0tcwaHtjQtrH3eOLMO7y3gKOwIPMeKc7hmPPoELQOTFEWsgLHVPyfePf0D58Ta5z5nEaMPN81QjJaQLHWW4g2e8T92UE0bIx0Peynz8bFR0AuTHEMvVJsNaHCvkJbfbIrdKwH7Klm9ALPsmsjogv8mSUplvI7buzF8c8Ux7fYx7VcPYIpyBCedK0NrRYycBnJkaWKT6JJuQGBGKPQ3cHwyBIsk0VnUu7zH14w34Wc9fHe4PUa7YNnuN4kdIYulYxTjM55MPidfWEfpmRM5BxG06mHT2xUQVegif7UNDr0cOdYzloUrp3WVJ7cS93Hf7s50PN3Dcj51W5MLOSBQsXg5qaKhuX3GijxQGh6LG6lpzX7CLyK5vrg5hAEMFMaI8BGsHdgyIhWGbBv85o331actTJvPwXmliVqypMkdlyqNrKxHD72N9jRHldfs534RmGq34GCR8XCme9U8ge5xKzF56S6ixvI2T0dUF95z1JHBDAoBKXnBpbzQ8TGGmTSXpJakRSddrobpVRNFNoVtpR76PGUzaMbblzsA377AiJRjBL4j8iCMGSrO4T1xNIkB7W79hDqoTPWrm9cQle6hX0eTatzPih6v63WAlGpe4YSD5Pf54vSQAuL8RCukT4mBAOEBI5Sy1MulQFm5NeiyF9UapO0w5H3WR0J5A8eJt5UC0xMq5hvAXi7zrNCAsNc1a5u1QCr1y1Dc0kPYlfvf0JoN8yhkU2TGDj5x6T4yRWrsyVS6Yw60WQjc1mb9t2jcrIvXCPfouxsoBgormhWtHu309KP9qtHbD5yGqMEsUH9FehU6MqwoR0ni0w92e4pFgXSicCCx6DhyKT4zwE8DKiB8wJibwvP7jFVulL0nsKYYI7wHMpSfmMEo6JNzdwsiJj2607fxRNFwNT7LJTJopnYSA6xQlPQrpHh7V6lyEJ8oXeDpv8vmiwFhgHFideF7ctCGHEVLzOsrj94FbONC8amaSEHPirClS0R4ugbtQx59cEoYKv2KKLg0Emt2ghvsfrAFeTPNbFID8NI9esvuGkb8eub40xcgYHe2x3fPHhuIQEcpwIjG8ktPJVgNB2FTJs4RLHkvYELLjh5ly7mn2O6dHUAImAWU99bYUpyE4nkRELGW8cqH1iBjbRhWL49gK0umIc1YrhcGdeqC4k5WqN54CwPfwksf7XK7DCl75sLzxLL86BJyhVefWR30we9AENxuMKLymiNvoyiDVTD6lKiAx83hSHypP0fT2b6I8qi6JHBGeQRh3Q8EeRiLTC7e2P6RS0IRGJFAHprfyRiXwkaXhPBM5VkTzmb3CPzbOoATGQADw8E9EOoQr54i9zMIJmmhbNdJIQ7yddUBBxuWXtoATV9U0u8nLpnvdzKu4LBJ6InfhPcEJVjliXBTMF7UQPJQ6iThW9IhgA05XsYHTnT8I1z8N6xN9JQvSETQWcwBU6R03ERC8trUIdr8ALkRJ0TSkQDP7pkQqucjOpJ7NsRwjU06RIpmGfUuTAvKSyNKm2dFAvh2Y2BDUMjNzXQTYQKYL5x1dEXFw2hazs0lrqITtIOIQzNvA06bO6jUuY9ETMNgWyfaDoQMkSfW1ArzrBs0CRYFw80lECiNSSeLLdaGhIFdC85UmncwscjkDSv3dTj1qfUyHDtSCWuSqf3IcKsYilASxlYI9VvzDe94207x4wqXm6OyHXfJQ8JcsS4VSaL6yX6ceHP6GVe2RafkMhRvyTPe4vLq1D7wfxyQKMDlx9SgxrxI4cLSnp5qOKWs1Si4nUbe5YDwSyOhI4KGQLjdTYjtnfM38VOf1mEyPoCt7aqNkyPHM6q3cSsRszEYsgvVRkFc528NNGz7bRVwcw30LqdTX3sx2OpkkuVydTvYEwF4YpvhXxaLsM1HUFAEKXRXmHa6FsoMd8a8ctOTmeDJ33aQOWGbh7pm1hEtDz92XyAFrOtieidO5h7ImIA66txF2b8nKg99Fiz3esu7EYVciHD03iFWGLtzY3KqV1c8we1EKiO03ii433EhqbPbtT14ogJBugSKQ0kp8GDQwrJI7XS38zxKIbhvnojY9rzDbTqPlttXKSMwD7Oz0oGeDrCBIcJHWQlf7WL3hU2V6dVR93GYXfKKjUGlPFhYrO7PqRkIGKkGxhIjBhwd8tH2Fjl3NYe8sBvx13y7f9ErJ6Gpij72H40oAMKqkxSwhoVhWEs3vKxOVVoQVzX34MFFOVlqITyBynAPpuxWTDMH3conErrFJ2dl0PNpYSzUmDpLI5PNLmukEyjMUgzblVErE16YKti56f6vmFRckSWhVPI1CkdDHmyycqqahR5LCf8jWcGfHGNpH6g22TXXJNYSVuifstjL8zKgeiSHTDTYtAySP9eTwxvc55rQQRnUfcWe6jxRN7owkLhI4f70gudPIxTWETG9YXxYzheBdTFU3i4KajxGjjIIPDVPFxFsHI14QW7pLhom11CgYnbabm9lhC67n2LVdgGRfMMh6Wunh1EDKssuuF9MQaeKSLrIFiDAdUqQB4bQuyRj5xzy21QHbpn1Vo94ExGjkfFkEfTX17YOYvu2HQXkNXSvVHoi6DrRmiHtvzodLmKLQhWvzlEtbRo9SJFMmahYakfDgzEtn9WPtDsjQlCxCBKduIv1bHiaLltKXdWT5AkM3ngDQq5uk98h36qxFJqNjY9jvUM0KXHr7epw4RMQqTUguuYYmJj38CtqGAXAUJRKFRFN7DYLUIMqrJK386nVDlfJeyxQJCEG3WCaKqpWFVFj7SixkcPjqVHuGAPf1vUkY3A6TBnEuhNPobfhAlCOdSFwxXqBcttODHEXzfGK10CdM4bf1NsXQlpdalc4mPepvrGTXaCGOKS1rbJr6OR5meMxMTe6f63owFjTpP2slEz8bpzXEx5kR964AeVudWQaYPTMmrfFVkYKpMl0X77GGldUznWnhjxbzfCcpT9uPKCqeyIMECMVdRvNGRdd4i3YpfoCkO5Farj2leoEM5BK1oQ1KERMRdlbW6SlXsWxUk6K7q52JvUANkDps9ocDznv40zvoRbY1Nj8x3uomPOJqMNsqdtTU78H17E5KJEweHxYg9mjPV7jRzK97b7DVKBErA8OltQchkGxy0sqKGshgdr6UOywwBNgotImDdGDHrPhm6yr8SepRTkv7miYc2KyiNX8cKE5Yfn2d8pcjgyj6zo6Rt7K4wuDYz8qLDIjun00jWQx4ympwR8ddj3UTQ6DEHhke4pHrWCDwFFrzpjYN5xM6qpS8WDPU5bKzYHe0xpMkzIUmqQ8Lg9imTLpOWcxKystW1aocaPAPaQ6ncdJp80NIcYwCdSayTq5FvPkUhCwO8TbWelAP9EXNg7DTgOa6ScX9tfG0NJoFnLpN00eiq916vytDS88ycDnXFwL88sls0m91UG5bN7J0MW4q0YFsuonOxdoU6hPQkxP8oEn2QCxNocNxNxvLnSSBes0OW0EcPiV1JXavNimG5rnRCXrPpfAhASAerEUqgv4XfpkrCgKH57PW3ukm6r4YbBIoKz4bwbRD9zBLVbOP3WxXOk8uUaG0eiysykTHJf57CKxC8dgU6RaJWGRHhSEKI8PuTKuRdJwPQ5tcg3mFM7JIzOEUxO1NkMRqmYheuC6DUqDT5RWKacB15YFp4YDOotx4Vn2ViVLMQn3f3ntFHQqn4taS58dFYTk94APNyHzRGnySmOWPj8daiztoRNfkSjggFw6ipYFVmzRBSUVypiipLA3ozh6TzsYU6lzucPenMRtnbWA1MUkLFQlKlCWEdAGubvk8smz0P0IgyFG
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.0040a400
add esp, 0xc
mov dword [ebp - 0x86c], str.J72QzXO3v5ThpWc7hlAvVbaATYzjlY0IMB2pU6BkTGzUKaIoMYhwkqeh60WbPxYkevTgjlPcz9MqGJXEE4TUvAEY6GQxxLaRkok8df43fsnxP7WfvUWjDPeSIxFQyuqgwO2707Lnm9PTgXY86RVMO6wjvAprqL24roQH11bO3ea3thIVsgtK97XLGnDx8VxtWIHMyMncac3hjBEbsCppjO52EI0iXjP47XB1hyOnr7McXFb5pVm1bWkX07dUfKoUpDXaxKc8dnSjroX9y1HgaLrIlgDoUOBqAsjjWD2dPqWvFqGDuApLVqlWpxrueqC5oPUH9nuhR1fUEvoIxcyUDATM9DsdpBVigVdhjHCqahCRmtyyOdpLWyPMNz8GGtrrqOKJ8UkdPDESNc2fr8ml41hh9TXynBNOM5Efg4zhuhIOW6ip2dwp3xMeTowhwUzVvYUUAh7Lu7RdPltMSmd5dVGaEDSfhMwE2qGBmC0w1bQwOvjCYbWQsCnYiExQSeWqUbjUX3lSipKYoSyA2anVdz91RNDFzhAExRh9m48GN3g12NnkwAjeolc3LLWtA6vGYWdk0MfchILehIinGyHmt6BmGeklpL39Mv87E9h0s1KPqWIBHr53ar7IdO47JscgnubWr7VL61Ys2r9hka9sqdnOuWOckM7pMO8tw0kK8Mdbc9hm1FpCLYEfguNbUO5hoI7I2IO3XNRoJFVdDDS99TCyb65LW9Vu1JAneaPaYnaBc8uavVXjI9XINazOzT6uWDmMEhRYxwbvQ6UmlImYPSu3JRYkEFzG00XtyPwswq5Ru9ep2MX9RA2FfSYqicgtdo1Qdh0xRjRLdQ3RyKkWikxvE4Fipw26eiRDL27dRSgewPGvpKN3dfMIRBVWyfQriIUx21KGSNP2NOcnWr4KriNv6yoxQRGdnsDVkFEAw2NbsDXojjV3i0xtSinst0S6fcFVt5u2FR3SRaOslFnBBqRGXwMdykdIpoOkQRLzhVhyje9xdHD2xUVda8B6amLRBb7eXJKvNuK4i9AGmL32xOhO5C2XEPgmJxAkG7jKThcpyzPeYwrdDQLr7UQhE3bOhkt9q78PrtTSPcr2GSX7LCOQt4VbbUwj18eP6nJwxBKWSIqSQESVokEgGwKYfsJRqpqbc7DYBumiwW8wCqAAuHtmw2sfUKFrOqNIH8bTgiROwLlGAGUGsiBPWCALnUSDJSOqBY5U9C1C5uTgN4HMLWoXQAJQjxoUxmorUIFA4s7aFqY2DCgP0PP34AAYDF9coSs9F9Fc7f0tcnj2sH1eWo7qaXGqyIcatH8xSxnBt3JeNlNaKXj7gf9YlW6JCMNt0swqkkMaOLOkWYym2vspq9w4kEhHHAqPlcDmF5BMrffWpyTAVOHOIWxAONSGN3nIAeKlEtmNpPU0LSegmNmQjPIyYFfusRN0lGoweJKK8orYmSH6TvopgiS4feQX7FghcLOcSSWjueXIvFW18Kyz9QFEJ0RzpAOJh2giGd3MvkG1DbXVOhRozmR8ST1X1PVsuR2rhG3YsXpSan9DvDwCDj9Lj6I1BGpvwwF0LMN8TLBxxohWvfPHYI6fY8YMSxvU6JcKxs0NhvjuIf5BwbzW4DXsJ6uEYncAzLYHxJp9PazMzHYIEh90HpqWYYirySaIUcbJTeYiio1c0T2fbo2VWtl8xs6M1IV4TLQUcMw547onE1Fg2XyrnNGJIQHGNRVr329XzSGKOu7cdnJQQceP8Qm23LzlmpTEFoonDy30t4dHojs158GbQH5Hm9Qc8w3qQ32gzq51nFvOiRCTXLREL1NpExeTmpGE7pBsEVGCaQIUCB1ikCJ2UFeGb9Q04U9O4sduPtrnAbwvFLHkp2cb7U7bSy5aniJeXbD0SAdt3xPfYYdqRbxsBOiJxAqQ7qqxCqwX3mYKdbhY8Vr296cWa3qIep3L6jyqBSD45wFx2H5IGqHuqCLq2Q7UguLO92Ssd3QGhk1AHX6JfkF8
push 0x44a320
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x403c93
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00409d9c
mov esp, ebp
pop ebp
ret