Function at 0x401281
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindow
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsIconic
sub esp, 4
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsIconic
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindow
sub esp, 4
cmp byte [ebx], 0x3f
je 0x401424
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp + 8], 0x2800
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_HeapAlloc
sub esp, 0xc
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [esp + 8], 0x2800
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
push eax
mov eax, 0x1e0f3
pop eax
mov eax, dword [section..data]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_IsChild
sub esp, 8
push ebp
mov ebp, 0x1240
pop ebp
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea edi, [ebp - 0x6c]
mov dword [esp], edi
call section..text
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsZoomed
sub esp, 4
push edx
mov edx, 0x341d0
pop edx
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea esi, [ebp - 0x28]
mov dword [esp], esi
call section..text
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [0x409008]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_HeapFree
sub esp, 0xc
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsZoomed
sub esp, 4
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowUnicode
sub esp, 4
jmp 0x40150c
call sub.KERNEL32.dll_GetLastError
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsIconic
sub esp, 4
mov dword [0x40900c], 0x403020
mov ebx, dword [0x409014]
add ebx, 1
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_HeapAlloc
sub esp, 0xc
mov dword [0x409020], eax
push edx
mov edx, 0x341d0
pop edx
push eax
mov eax, 0x1e0f3
pop eax
call sub.KERNEL32.dll_GetLastError
call fcn.00401091
mov dword [esp], eax
call fcn.00401a4a
mov ebx, eax
mov eax, dword [section..data]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_IsChild
sub esp, 8
test ebx, ebx
je 0x40150c
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsWindowUnicode
sub esp, 4
push edx
mov edx, 0x341d0
pop edx
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.0040181e
mov ebx, eax
push edx
mov edx, 0x341d0
pop edx
call fcn.00401214
mov eax, dword [section..data]
mov dword [esp], eax
call sub.USER32.dll_IsIconic
sub esp, 4
test ebx, ebx
je 0x401507
mov eax, dword [0x409010]
mov dword [esp + 4], eax
mov eax, dword [0x409020]
mov dword [esp], eax
call ebx
call sub.KERNEL32.dll_GetCurrentProcessId
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret