Function at 0xc5405c
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x680
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
mov esi, ecx
mov dword [ebp - 0x624], edx
push 0
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x62c], eax
call dword [sym.imp.api_ms_win_core_job_l2_1_0.dll_CreateJobObjectW]
mov ebx, eax
mov dword [ebp - 0x620], ebx
test ebx, ebx
jne 0xc540c7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc540b7
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc54335
mov esi, 0x80004005
jmp 0xc54335
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test byte [0xc96fc1], 0x20
mov edi, eax
je 0xc540f0
push esi
mov edx, 0xa143d0
call fcn.00a4d165
mov esi, 0x80004005
test edi, edi
je 0xc5432d
mov eax, 0x104
cmp edi, eax
jae 0xc5432d
push 0xa276d4
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
test eax, eax
js 0xc5432d
push dword [ebp - 0x628]
lea eax, [ebp - 0x61c]
push 0x400
push 0xa27650
push 0x208
push eax
call fcn.00a60c0c
add esp, 0x14
test eax, eax
js 0xc5432d
push 0x40
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x680], 0x44
push 0
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x63c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x63c]
push eax
xor edi, edi
lea eax, [ebp - 0x680]
push eax
push edi
push edi
push 4
push edi
push edi
push edi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0xc541d0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc541c0
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc5432d
mov esi, 0x80004005
jmp 0xc5432d
push dword [ebp - 0x63c]
push ebx
call dword [sym.imp.api_ms_win_core_job_l2_1_0.dll_AssignProcessToJobObject]
test eax, eax
je 0xc542e9
test byte [ebp - 0x624], 2
mov esi, edi
je 0xc54297
mov ecx, ebx
call fcn.00c54015
mov ebx, eax
test ebx, ebx
jne 0xc5422e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc54218
movzx esi, si
or esi, 0x80070000
test esi, esi
mov ebx, dword [ebp - 0x620]
js 0xc542bd
mov esi, 0x80004005
jmp 0xc542bd
lea eax, [ebp - 0x62c]
push eax
push edi
push ebx
push 0xc53fe0
push edi
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov edi, eax
test edi, edi
je 0xc5426a
push dword [ebp - 0x638]
xor esi, esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
push 0xffffffffffffffff
mov edx, edi
call fcn.00a4d587
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0xc54288
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc54281
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc54288
mov esi, 0x80004005
push ebx
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ebx, dword [ebp - 0x620]
jmp 0xc542bd
push dword [ebp - 0x638]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
test byte [ebp - 0x624], 0x40
je 0xc542bd
mov edx, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0x62c]
call fcn.00a4ca80
test byte [0xc96fc1], 0x20
je 0xc542e3
push dword [ebp - 0x628]
push dword [ebp - 0x63c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
push eax
mov edx, 0xa14898
call fcn.00a4d0d7
test esi, esi
jns 0xc54315
jmp 0xc54307
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc54300
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc54307
mov esi, 0x80004005
push 5
push dword [ebp - 0x63c]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
push dword [ebp - 0x63c]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [ebp - 0x638]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push ebx
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 4