Function at 0x41eec5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x43e00c]
xor eax, esp
mov dword [esp + 0x78], eax
and dword [esp + 0x20], 0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x30], eax
push edi
cmp byte [esi + 0x2c], 0
jne 0x41eefa
mov eax, 0x3f0
jmp 0x41f1aa
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0x18]
cdq
push 0x44
pop ecx
idiv ecx
mov ebx, dword [esi + 0x10]
mov edi, eax
sub ebx, dword [esi + 0xc]
mov eax, dword [esi + 4]
sub eax, dword [esi]
cdq
idiv ecx
and dword [esp + 0x20], 0
sar ebx, 3
mov edx, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
test edi, edi
je 0x41ef84
xor ecx, ecx
mov eax, edi
push 8
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004065b3
pop ecx
mov edi, eax
xor ecx, ecx
mov dword [esp + 0x20], edi
xor ebx, ebx
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0x18]
cdq
idiv dword [esp + 0x14]
cmp ecx, eax
jae 0x41ef7c
mov dword [edi + ecx*8 + 4], 0x10
mov eax, dword [esi + 0x18]
add eax, ebx
mov dword [edi + ecx*8], eax
inc ecx
push 0x44
pop eax
add ebx, eax
jmp 0x41ef55
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x14], edi
test edx, edx
je 0x41efd1
xor ecx, ecx
mov eax, edx
push 8
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004065b3
mov edx, dword [esp + 0x20]
mov edi, eax
pop ecx
xor ecx, ecx
mov dword [esp + 0x14], edi
test edx, edx
je 0x41efd1
xor ebx, ebx
and dword [edi + ecx*8 + 4], 0
mov eax, dword [esi]
add eax, ebx
mov dword [edi + ecx*8], eax
inc ecx
push 0x44
pop eax
add ebx, eax
cmp ecx, edx
jb 0x41efb7
mov ebx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x41f028
xor ecx, ecx
mov eax, ebx
push 0xc
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004065b3
and dword [esp + 0x34], 0
mov dword [esp + 0x1c], eax
pop ecx
test ebx, ebx
je 0x41f028
mov edi, dword [esp + 0x30]
mov edx, eax
and dword [edx + 8], 0
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + edi*8]
mov dword [edx], eax
lea edx, [edx + 0xc]
mov eax, dword [ecx + edi*8 + 4]
inc edi
mov dword [edx - 8], eax
cmp edi, ebx
jb 0x41f005
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
and dword [esp + 0x24], 0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
test edx, edx
jne 0x41f05b
test ecx, ecx
jne 0x41f05b
test ebx, ebx
jne 0x41f05b
lea eax, [esp + 0x24]
push eax
push 1
push 1
push ebx
push 0xf01ff
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x41f078
lea edi, [esp + 0x24]
push edi
mov edi, dword [esp + 0x18]
push edi
push ecx
push eax
push ebx
push dword [esp + 0x34]
push edx
push 2
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
call ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x41f097
push eax
call fcn.00406346
pop ecx
test edi, edi
je 0x41f0a2
push edi
call fcn.00406346
pop ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41f0b1
push eax
call fcn.00406346
pop ecx
cmp dword [esp + 0x14], 0
jne 0x41f0c1
mov eax, dword [esp + 0x28]
jmp 0x41f1aa
push dword [esp + 0x24]
and dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
call fcn.0040a3d1
cmp byte [esi + 0x2d], 0
je 0x41f132
mov ecx, dword [esp + 0x10]
call fcn.00410034
test al, al
je 0x41f12c
mov ecx, dword [esp + 0x10]
call fcn.0040ff4e
test al, al
je 0x41f12c
mov edx, dword [esi + 0x28]
mov ecx, dword [esp + 0x10]
call fcn.0041fe99
mov esi, eax
test esi, esi
jne 0x41f164
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push eax
push 0xf01ff
lea eax, [esp + 0x38]
push eax
call esi
push eax
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x41f155
call ebx
mov esi, eax
jmp 0x41f164
push 0x12
lea ecx, [esp + 0x3c]
call fcn.0040a6e6
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x38]
push 0x10000000
push 1
call fcn.0040fecb
pop ecx
pop ecx
jmp 0x41f0e2
push dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
call fcn.0040a3d1
xor esi, esi
cmp dword [esp + 0x10], 0
je 0x41f1a8
cmp dword [esp + 0x10], 0xffffffff
je 0x41f1a8
call fcn.004026b6
push eax
push dword [ebp + 4]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x18]
call fcn.0040f78c
mov edi, dword [esp + 0x18]
pop ecx
pop ecx
mov ecx, dword [0x43f2e0]
test ecx, ecx
jne 0x41f1a3
call fcn.0040f668
mov ecx, dword [0x43f2e0]
mov edx, dword [ecx]
push edi
call dword [edx]
mov eax, esi
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00406335
mov esp, ebp
pop ebp
ret 4