Function at 0x440f30
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x51b629
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
test ebx, ebx
mov eax, dword [0x565e78]
push ebp
mov ebp, dword [esp + 0x178]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x6690]
mov dword [esp + 0x16c], eax
jne 0x440fb7
push str.Service.exe
push 0x56b5e8
push 0x5418c4
push 0x56c448
call fcn.004b3891
movzx eax, byte [esp + 0x194]
mov ecx, dword [0x56bb0c]
push eax
push edi
push ecx
push ebp
push 0x56c448
lea edx, [esp + 0x8c]
push str.__s____u__u__u__u_
push edx
call fcn.004b3891
add esp, 0x2c
jmp 0x441064
cmp ebx, 1
jne 0x440ff9
push 0x541560
push 0x56b5e8
push 0x5418c4
push 0x56c238
call fcn.004b3891
mov eax, dword [0x56bb0c]
push edi
push eax
push ebp
push 0x56c238
lea ecx, [esp + 0x88]
push str.__s____u__u__u_
push ecx
call fcn.004b3891
add esp, 0x28
jmp 0x441064
cmp ebx, 2
jne 0x44103b
push str.Shop.exe
push 0x56b5e8
push 0x5418c4
push 0x56c340
call fcn.004b3891
mov edx, dword [0x56bb0c]
push edi
push edx
push 0x56c340
lea eax, [esp + 0x84]
push str.__s____u__u_
push eax
call fcn.004b3891
add esp, 0x24
jmp 0x441064
cmp ebx, 3
jne 0x4411d8
mov ecx, dword [0x56bb0c]
push edi
push ecx
call fcn.00441580
push eax
lea edx, [esp + 0x74]
push str.__s____u__u_
push edx
call fcn.004b3891
add esp, 0x14
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00441200
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x56b5e8
push 0
push 4
push 0
push 0
push 0
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4411c5
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esi + 0x6640], ecx
mov dword [esi + 0x6644], edx
call fcn.004fa853
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x178], 0
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push str.0A8FF394_9874_402e_9922_B87DB6D64403._u
push ecx
call fcn.00405820
push 0x18
call fcn.004fa746
mov edi, eax
add esp, 0x10
mov dword [esp + 0x20], edi
test edi, edi
mov byte [esp + 0x178], 1
mov ebp, dword [esp + 0xc]
je 0x44112f
push 0x10000
push ebp
mov ecx, edi
call dword [sym.imp.client_io.dll_public:_void___thiscall_io_proxy::constructor_char_const___unsigned_long_int_]
mov dword [edi + 8], 0x53cfb4
mov dword [edi], 0x53cfc8
mov dword [edi + 8], 0x53cfc4
jmp 0x441131
xor edi, edi
test edi, edi
mov byte [esp + 0x178], 0
je 0x441142
lea eax, [edi + 8]
jmp 0x441144
xor eax, eax
push eax
mov ecx, edi
call dword [sym.imp.client_io.dll_public:_void___thiscall_io_proxy::add_xy_handler_class_protocol_handler_class_io_proxy___]
cmp ebx, 1
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0x470
mov dword [esi + 0x6648], edi
mov dword [edi + 0xc], 1
jne 0x441179
mov edx, dword [esi + 0x6648]
mov dword [edx + 0xc], 2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea eax, [ebp - 0x10]
mov dword [esp + 0x178], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4411c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, 1
jmp 0x4411da
push 0x10
push 0x5415ec
push 0x5415d8
mov ecx, esi
call fcn.004f7862
xor al, al
mov ecx, dword [esp + 0x170]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x164]
pop ebp
call fcn.004b6cac
add esp, 0x170
ret 8