Function at 0x40d31f
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4225ff
call fcn.00414d1c
sub esp, 0x13c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x10
lea eax, [esp + 0x78]
push ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.00414400
push 0x44
pop esi
push esi
lea eax, [esp + 0x118]
push ebx
push eax
call fcn.00414400
mov dword [esp + 0x120], esi
mov esi, dword [esp + 0x178]
add esp, 0x18
mov eax, dword [esi]
push 0x20
mov eax, dword [eax]
and eax, 0xf000
pop ebp
cmp eax, 0x2000
je 0x40d388
cmp eax, 0x8000
jne 0x40d38b
add ebp, 0x60
jmp 0x40d38b
push 0x40
pop ebp
call fcn.0040d852
lea edi, [esi + 0x1c]
push edi
mov dword [esi + 0x10], eax
lea eax, [esp + 0x60]
push 0x4307e4
push eax
mov dword [esi + 0x14], edx
call fcn.0040a451
mov dword [esp + 0x160], ebx
push 0x4307e0
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0040a40a
mov ecx, eax
mov byte [esp + 0x16c], 1
lea eax, [esi + 0x34]
push eax
push ecx
lea eax, [esp + 0xf8]
push eax
call fcn.0040a3c9
add esp, 0x24
mov byte [esp + 0x154], 3
lea ecx, [esp + 0x2c]
call fcn.0040150a
mov byte [esp + 0x154], 4
lea ecx, [esp + 0x5c]
call fcn.0040150a
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0040a7d4
mov byte [esp + 0x15c], 5
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.0040a7d4
add esp, 0x10
mov byte [esp + 0x154], 6
cmp dword [edi + 0x14], 0x10
jb 0x40d43b
mov eax, dword [edi]
jmp 0x40d43d
mov eax, edi
push ebx
push eax
call fcn.00411929
pop ecx
pop ecx
test al, al
jne 0x40d5bc
push dword [0x42f228]
cmp dword [0x42f22c], 0x10
mov eax, 0x42f218
cmovae eax, dword [0x42f218]
push ebx
push eax
mov ecx, edi
call fcn.0040d7ea
cmp eax, 0xffffffff
jne 0x40d5bc
lea eax, [esp + 0x84]
push str.PATH
push eax
call fcn.00411f5e
mov byte [esp + 0x15c], 7
push 1
push 0x3b
push eax
lea eax, [esp + 0x70]
push eax
call fcn.00413406
add esp, 0x18
mov byte [esp + 0x154], 9
lea ecx, [esp + 0x84]
call fcn.0040150a
lea eax, [esp + 0x2c]
push str.SYSTEMROOT
push eax
call fcn.00411f5e
mov byte [esp + 0x15c], 0xa
cmp dword [esp + 0x48], 0x10
lea eax, [esp + 0x34]
cmovae eax, dword [esp + 0x34]
push eax
lea eax, [esp + 0x90]
push str._sSYSTEM32
push eax
call fcn.004078b1
add esp, 0x14
mov byte [esp + 0x154], 0xb
push eax
lea ecx, [esp + 0x60]
call fcn.0040dc73
mov byte [esp + 0x154], 0xa
lea ecx, [esp + 0x84]
call fcn.0040150a
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x60]
call fcn.0040dce0
cmp dword [edi + 0x14], 0x10
jb 0x40d530
mov edi, dword [edi]
lea eax, [esp + 0x5c]
push eax
push ebx
lea eax, [esp + 0xf8]
push edi
push eax
call fcn.00412950
mov byte [esp + 0x164], 0xc
push eax
lea eax, [esp + 0x98]
push eax
call fcn.0040a7d4
add esp, 0x18
mov byte [esp + 0x154], 0xd
push eax
lea ecx, [esp + 0x18]
call fcn.0040ab14
mov byte [esp + 0x154], 0xc
push ebx
push 1
lea ecx, [esp + 0x8c]
call fcn.00401ab9
mov byte [esp + 0x154], 0xa
lea ecx, [esp + 0xf0]
call fcn.0040150a
mov byte [esp + 0x154], 9
lea ecx, [esp + 0x2c]
call fcn.0040150a
mov byte [esp + 0x154], 6
lea ecx, [esp + 0x5c]
call fcn.0040bdf4
cmp dword [0x42f1c4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jne 0x40d5cf
push 0
call ebx
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
and ecx, 0x2b2
neg ecx
sbb ecx, ecx
add eax, eax
neg ecx
or eax, ecx
mov dword [0x42f1c0], eax
mov eax, dword [esi]
test dword [eax], 0x600
je 0x40d729
call fcn.00412614
test al, al
jne 0x40d729
push 0x3c
lea eax, [esp + 0xa0]
push 0
push eax
call fcn.00414400
mov edi, dword [0x42f1c4]
mov edx, dword [0x42f1c0]
add esp, 0xc
mov eax, 0x282
cmp edi, eax
cmove edi, eax
mov eax, edx
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov ecx, edx
not ecx
shl edi, 0x11
and ecx, 0x2b2
or edi, 1
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or eax, ecx
mov dword [0x42f1c4], edi
mov dword [0x42f1c0], eax
test edi, edi
jne 0x40d67f
push edi
call ebx
mov edi, dword [0x42f1c4]
inc edi
push 0x56
pop eax
cmove edi, eax
shl edi, 0x11
or edi, 1
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
cmp dword [esp + 0x58], 8
mov dword [esp + 0xac], eax
lea eax, [esp + 0x44]
cmovae eax, dword [esp + 0x44]
mov dword [esp + 0xb0], eax
lea eax, [esp + 0x9c]
push eax
mov dword [0x42f1c4], edi
mov dword [esp + 0xa0], 0x3c
mov dword [esp + 0xa4], 0x4140
mov dword [esp + 0xac], str.runas
mov dword [esp + 0xbc], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40d71f
cmp dword [esp + 0xbc], 0x20
jbe 0x40d71f
mov eax, dword [esi]
test byte [eax], 0x44
je 0x40d716
push 0
push dword [esp + 0xd8]
jmp 0x40d78b
mov eax, dword [esp + 0xd4]
jmp 0x40d779
mov eax, dword [esi]
test dword [eax], 0x400
jne 0x40d794
cmp dword [esp + 0x58], 8
lea ecx, [esp + 0x44]
cmovae ecx, dword [esp + 0x44]
cmp dword [esp + 0x28], 8
lea edx, [esp + 0x74]
push edx
lea edx, [esp + 0x10c]
push edx
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
xor edx, edx
push edx
push edx
push ebp
push edx
push edx
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40d77e
mov eax, dword [esi]
test byte [eax], 0x44
je 0x40d775
push 0
push dword [esp + 0x78]
jmp 0x40d78b
mov eax, dword [esp + 0x74]
mov dword [esi + 8], eax
jmp 0x40d794
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [esp + 0x14], eax
push 0
push esi
call fcn.0040c4a6
add esp, 0xc
mov byte [esp + 0x154], 5
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.00401ab9
mov byte [esp + 0x154], 4
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.00401ab9
or dword [esp + 0x154], 0xffffffff
lea ecx, [esp + 0xd8]
call fcn.0040150a
mov ecx, dword [esp + 0x14c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret