Function at 0x41c750
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x40]
sub esp, 0x40
push 0xffffffffffffffff
push 0x4c1388
mov eax, dword fs:[0]
push eax
sub esp, 0x148
push ebx
push esi
push edi
mov eax, dword [0x57e030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp + 0x30], edi
mov eax, dword [edi + 0x3c]
xor esi, esi
cmp eax, esi
je 0x41c79b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x3c], esi
mov eax, dword [edi + 0x40]
cmp eax, esi
je 0x41c7ac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x40], esi
mov eax, dword [edi + 0x58]
push eax
call fcn.0041d6e0
mov ebx, dword [edi + 0x30]
add esp, 4
mov dword [ebp + 0x34], eax
cmp ebx, dword [edi + 0x34]
jbe 0x41c7c8
call fcn.00480e22
mov eax, dword [edi + 0x24]
cmp eax, esi
jne 0x41c8c3
call fcn.00480e22
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x41c7e4
call fcn.00480e22
mov esi, dword [edi + 0x14]
cmp esi, dword [edi + 0x18]
jbe 0x41c7f1
call fcn.00480e22
mov eax, dword [edi + 8]
test eax, eax
jne 0x41c8ca
call fcn.00480e22
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x41c80d
call fcn.00480e22
mov ecx, dword [ebp + 0x34]
push ecx
push ebx
push esi
mov esi, dword [edi + 0x58]
push str.Try_to_start___s__s__process_as_current_user_at__d_session
call fcn.004239b0
push 0x44
lea edx, [ebp - 0x54]
push 0
push edx
call fcn.00483dc0
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x48]
mov edx, dword [edi + 0x4c]
add esp, 0x1c
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
test eax, eax
jne 0x41c855
test ecx, ecx
jne 0x41c855
test edx, edx
je 0x41c85c
or dword [ebp - 0x28], 0x100
mov esi, dword [ebp - 0x28]
push esi
mov esi, dword [edi + 0x58]
push edx
push ecx
push eax
push 0x44
push str.sti:_cb___d__hStdError___p__hStdInput___p__hStdOutput___p__dwFlags___u
call fcn.00423a10
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov dword [ebp - 4], 0
mov esi, dword [edi + 0x58]
push ebx
push str.Try_OpenProcessToken__p_____
call fcn.00423a10
add esp, 8
lea eax, [ebp + 0x38]
push eax
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41c8d1
lea ecx, [ebp - 0x154]
push ecx
call fcn.00419ac0
push 0x56e788
lea edx, [ebp - 0x154]
push edx
call fcn.004841dc
mov eax, dword [eax]
jmp 0x41c7da
mov eax, dword [eax]
jmp 0x41c803
mov eax, dword [ebp + 0x38]
mov esi, dword [edi + 0x58]
push eax
push str.Try_DuplicateTokenEx__p___________
call fcn.00423a10
mov edx, dword [ebp + 0x38]
add esp, 8
lea ecx, [ebp + 0x3c]
push ecx
push 1
push 2
push 0
push 0x2000000
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x41c91f
lea eax, [ebp - 0x94]
push eax
call fcn.00419ac0
push 0x56e788
lea ecx, [ebp - 0x94]
push ecx
call fcn.004841dc
mov edx, dword [ebp + 0x3c]
mov esi, dword [edi + 0x58]
push edx
push str.Try_SetTokenInformation__p_______
call fcn.00423a10
mov ecx, dword [ebp + 0x3c]
add esp, 8
push 4
lea eax, [ebp + 0x34]
push eax
push 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x41c966
lea edx, [ebp - 0x114]
push edx
call fcn.00419ac0
push 0x56e788
lea eax, [ebp - 0x114]
push eax
call fcn.004841dc
lea ecx, [ebp]
push ecx
mov ecx, edi
call fcn.0041cdb0
mov byte [ebp - 4], 1
movzx edx, byte [edi + 0x54]
push edx
lea esi, [ebp]
call fcn.00404b20
mov esi, dword [edi + 0x58]
push eax
mov eax, dword [ebp + 0x3c]
push eax
push str.Try_CreateProcessAsUser__p__0___s__0__0___d__NORMAL_PRIORITY_CLASS__0__0__sti__pi_
call fcn.00423a10
movzx eax, byte [edi + 0x54]
add esp, 0x10
lea ecx, [ebp + 0x1c]
push ecx
lea edx, [ebp - 0x54]
push edx
push 0
push 0
push 0x20
push eax
push 0
push 0
lea esi, [ebp]
call fcn.00404b20
mov ecx, dword [ebp + 0x3c]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x41c9e4
lea edx, [ebp - 0xd4]
push edx
call fcn.00419ac0
push 0x56e788
lea eax, [ebp - 0xd4]
push eax
call fcn.004841dc
mov ecx, dword [ebp + 0x34]
push ecx
lea esi, [ebp]
call fcn.00404b20
mov esi, dword [edi + 0x58]
push eax
push str.Created___s__process_at__d_windows_session
call fcn.004239b0
add esp, 0xc
lea ecx, [ebp]
call fcn.00404ae0
mov edx, dword [ebp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp + 0x38]
push eax
call esi
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov dword [edi + 0x40], ecx
mov dword [edi + 0x3c], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x40
mov esp, ebp
pop ebp
ret