Function at 0x4136c0
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
push esi
push edi
xor edi, edi
push 0x44
mov esi, eax
lea eax, [esp + 0x24]
push edi
push eax
mov dword [esp + 0x18], edi
call fcn.0046e0e0
add esp, 0xc
cmp byte [esi + 8], 0
mov dword [esp + 0x20], 0x44
je 0x4136f9
mov dword [esp + 0x28], 0x49b4f8
xor ecx, ecx
cmp byte [esi + 1], cl
mov dword [esp + 0x4c], 1
setne cl
dec ecx
and ecx, 5
mov word [esp + 0x50], cx
cmp dword [esi + 0xc], edi
je 0x41371c
mov edi, 0x1000004
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4137d1
push 0
push eax
lea edx, [esp + 0x14]
push edx
or edi, 0x400
mov dword [esp + 0x18], 0
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x41378a
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41376e
push eax
call esi
test eax, eax
je 0x413785
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41377d
push eax
call esi
test eax, eax
je 0x413785
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0040a060
cmp dword [ebx + 0x14], 8
jb 0x413794
mov eax, dword [ebx]
jmp 0x413796
mov eax, ebx
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
push edx
movzx edx, byte [esi + 2]
push 0
push ecx
push edi
push edx
push 0
push 0
push eax
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ecx, dword [esp + 0xc]
push ecx
mov edi, eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test edi, edi
jne 0x413806
jmp 0x413759
cmp dword [ebx + 0x14], 8
jb 0x4137db
mov eax, dword [ebx]
jmp 0x4137dd
mov eax, ebx
lea edx, [esp + 0x10]
push edx
movzx edx, byte [esi + 2]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push edi
push edx
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x413759
mov eax, dword [esi + 0xc]
xor edi, edi
cmp eax, edi
je 0x413872
mov ecx, dword [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x413867
mov eax, dword [esp + 0x10]
push 1
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
test al, al
je 0x413843
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x41385c
push eax
call esi
test eax, eax
je 0x413785
mov eax, dword [esp + 0x10]
cmp eax, edi
jmp 0x413774
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [esi], 0
je 0x413884
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x413899
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x4138b2
push eax
call esi
test eax, eax
je 0x413785
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x4138c5
push eax
call esi
test eax, eax
je 0x413785
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret