Function at 0x4160d0
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push ebx
push esi
push edi
xor ebx, ebx
push 0x44
lea eax, [esp + 0x24]
push ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0049d850
mov esi, dword [ebp + 0xc]
add esp, 0xc
mov dword [esp + 0x20], 0x44
cmp byte [esi + 8], bl
je 0x41610a
mov dword [esp + 0x28], 0x597794
xor ecx, ecx
cmp byte [esi + 1], bl
mov dword [esp + 0x4c], 1
setne cl
xor edi, edi
dec ecx
and ecx, 5
mov word [esp + 0x50], cx
cmp dword [esi + 0xc], ebx
je 0x41612f
mov edi, 0x1000004
cmp byte [esi + 0x10], bl
je 0x41613a
or edi, 0x1000000
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4161ed
push ebx
push eax
lea edx, [esp + 0x14]
push edx
or edi, 0x400
mov dword [esp + 0x18], ebx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x41619b
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x416187
push eax
call esi
test eax, eax
je 0x416196
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4161e4
push eax
call esi
test eax, eax
jne 0x4161e4
call fcn.00415ae0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4161a6
mov eax, dword [eax]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
push edx
movzx edx, byte [esi + 2]
push ebx
push ecx
push edi
push edx
push ebx
push ebx
push eax
mov eax, dword [esi + 4]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ecx, dword [esp + 0xc]
push ecx
mov edi, eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp edi, ebx
jne 0x41624d
lea ecx, [esp + 0x10]
call fcn.00421120
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4161f8
mov eax, dword [eax]
lea edx, [esp + 0x10]
push edx
movzx edx, byte [esi + 2]
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push edi
push edx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41624d
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x416231
push eax
call esi
test eax, eax
je 0x416196
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4161e4
push eax
call esi
test eax, eax
je 0x416196
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4162a9
mov ecx, dword [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x41629e
mov eax, dword [esp + 0x10]
push 1
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
cmp al, bl
je 0x4161db
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x10]
call fcn.00421120
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [esi], bl
je 0x4162ba
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
je 0x4162cf
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x4162e8
push eax
call esi
test eax, eax
je 0x416196
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4162fb
push eax
call esi
test eax, eax
je 0x416196
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret