Function at 0x41cc83
Capabilities:
Create process on windows

Disassembly:
push 0xedc
mov eax, 0x421cfb
call fcn.004123b5
mov esi, ecx
mov dword [ebp - 0xe94], esi
cmp dword [esi + 4], 0xffffffff
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xe90], eax
mov dword [ebp - 0xe8c], edi
je 0x41ccf0
call fcn.0041cc6e
test al, al
jne 0x41ccf0
push 0x406e78
push 0x43
lea ecx, [ebp - 0x774]
call fcn.00417a68
mov esi, eax
mov ecx, 0xe2
lea edi, [ebp - 0x3ec]
rep movsd dword es:[edi], dword [esi]
push 0x422218
lea eax, [ebp - 0x3ec]
push eax
call fcn.00417a68
and dword [ebp - 0x1c], 0
push 7
pop eax
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], cx
and dword [ebp - 4], ecx
cmp dword [ebx + 0x10], ecx
je 0x41cd7e
cmp dword [edi + 0x10], ecx
je 0x41cd91
cmp dword [edi + 0x14], 8
jb 0x41cd1b
mov ecx, dword [edi]
jmp 0x41cd1d
mov ecx, edi
push 0x20
pop edx
cmp dx, word [ecx]
je 0x41cd7e
and dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
xor eax, eax
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x48]
push eax
push ebx
mov byte [ebp - 4], 1
call fcn.0041c5a0
push edi
lea eax, [ebp - 0x48]
push eax
push 0x406f10
lea eax, [ebp - 0x64]
push eax
call fcn.0041c0f5
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00417a68
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00417a68
push 0
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.00417a68
jmp 0x41cd91
cmp dword [edi + 0x10], 0
je 0x41cd91
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.00417a68
push 0x44
pop edi
push edi
lea eax, [ebp - 0xee8]
push 0
push eax
call fcn.0041300e
mov dword [ebp - 0xee8], edi
xor eax, eax
lea edi, [ebp - 0xea4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp byte [ebp + 8], 0
stosd dword es:[edi], eax
je 0x41ce7c
cmp dword [esi + 0x1c], 0
jne 0x41cdcc
xor eax, eax
jmp 0x41cdd7
lea eax, [esi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x41cdd7
mov eax, dword [eax]
cmp dword [ebp - 0x1c], 0
jne 0x41cde1
xor edi, edi
jmp 0x41cded
cmp dword [ebp - 0x18], 8
mov edi, dword [ebp - 0x2c]
jae 0x41cded
lea edi, [ebp - 0x2c]
cmp dword [ebx + 0x14], 8
jb 0x41cdfd
mov ecx, dword [ebx]
mov dword [ebp - 0xe88], ecx
jmp 0x41ce03
mov dword [ebp - 0xe88], ebx
mov esi, dword [ebp - 0xe90]
mov esi, dword [esi + 8]
lea ecx, [ebp - 0xea4]
push ecx
lea ecx, [ebp - 0xee8]
push ecx
push eax
push 0
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_GetPriorityClass]
or eax, 0x8000000
push eax
xor eax, eax
push eax
push eax
push eax
push edi
push dword [ebp - 0xe88]
push esi
call dword [sym.imp.advapi32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x41cf52
call dword [sym.imp.kernel32.dll_GetLastError]
cmp byte [ebp + 0x18], 0
mov esi, eax
je 0x41cf42
push dword [ebp - 0xe8c]
lea ecx, [ebp - 0x774]
push ebx
push 0x406f20
push esi
push 0xf
call fcn.00417a68
jmp 0x41ccd0
cmp dword [esi + 0x1c], 0
jne 0x41ce86
xor eax, eax
jmp 0x41ce91
lea eax, [esi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x41ce91
mov eax, dword [eax]
cmp dword [ebp - 0x1c], 0
jne 0x41ce9b
xor edi, edi
jmp 0x41cea7
cmp dword [ebp - 0x18], 8
mov edi, dword [ebp - 0x2c]
jae 0x41cea7
lea edi, [ebp - 0x2c]
cmp dword [ebx + 0x14], 8
jb 0x41ceb7
mov ecx, dword [ebx]
mov dword [ebp - 0xe88], ecx
jmp 0x41cebd
mov dword [ebp - 0xe88], ebx
lea ecx, [ebp - 0xea4]
push ecx
lea ecx, [ebp - 0xee8]
push ecx
push eax
push 0
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_GetPriorityClass]
or eax, 0x8000000
push eax
xor eax, eax
push eax
push eax
push eax
push edi
push dword [ebp - 0xe88]
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x41cf58
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
cmp byte [ebp + 0x18], 0
je 0x41cf40
push dword [ebp - 0xe8c]
push ebx
push 0x406fa0
call esi
push eax
push 0xf
lea ecx, [ebp - 0xe84]
call fcn.00417a68
mov esi, eax
mov ecx, 0xe2
lea edi, [ebp - 0xafc]
rep movsd dword es:[edi], dword [esi]
push 0x422218
lea eax, [ebp - 0xafc]
jmp 0x41ccea
mov esi, eax
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00417a68
mov eax, esi
jmp 0x41cf82
mov esi, dword [ebp - 0xe94]
mov eax, dword [ebp - 0xea4]
push dword [ebp - 0xea0]
mov dword [esi + 4], eax
mov dword [esi + 8], 0x103
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00417a68
xor eax, eax
call fcn.00412438
ret 0x14