Function at 0x40c979
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f9ac
mov eax, dword fs:[0]
push eax
mov eax, 0x10dc
call fcn.0042f024
mov eax, dword [0x45b070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x1078]
mov dword [ebp - 0x10b0], eax
xor esi, esi
mov eax, dword [ebp + 0x24]
mov ebx, esi
mov dword [ebp - 0x10ac], eax
call fcn.004020b2
push eax
push ecx
push dword [0x434cec]
lea ecx, [ebp - 0x10c4]
call fcn.0040d9da
push 7
mov dword [ebp - 4], esi
xor eax, eax
pop ecx
mov dword [ebp - 0x1098], esi
mov dword [ebp - 0x1094], ecx
mov word [ebp - 0x10a8], ax
mov dword [ebp - 0x1080], esi
mov dword [ebp - 0x107c], ecx
mov word [ebp - 0x1090], ax
mov byte [ebp - 4], 2
call fcn.0041f74e
test al, al
je 0x40cae3
xor eax, eax
mov word [ebp - 0x1058], ax
lea eax, [ebp - 0x1058]
push 0x824
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1058]
push str.Microsoft.OfficeHelper
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x40cae3
test edi, edi
je 0x40cbbf
cmp word [edi], si
je 0x40cbbf
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x40ca6e
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x1090]
call fcn.0040a7db
lea edx, [ebp - 0x1090]
lea ecx, [ebp - 0x1070]
call fcn.0040c582
push eax
lea ecx, [ebp - 0x10a8]
call fcn.0040d4d3
lea ecx, [ebp - 0x1070]
call fcn.0040a89b
cmp dword [ebp - 0x1098], 0
je 0x40cae3
cmp dword [ebp - 0x1094], 8
lea ebx, [ebp - 0x10a8]
lea edi, [ebp - 0x1090]
cmovae ebx, dword [ebp - 0x10a8]
cmp dword [ebp - 0x107c], 8
cmovae edi, dword [ebp - 0x1090]
push dword [ebp - 0x10ac]
push dword [ebp - 0x10b0]
push esi
push esi
push 0x400
push esi
push esi
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x40cb7e
lea ecx, [ebp - 0x10e8]
call fcn.004020b2
push eax
push ecx
push dword [0x434ce8]
lea ecx, [ebp - 0x106c]
call fcn.0040d9da
cmp byte [ebp - 0x106c], 0
je 0x40cb7e
mov ecx, dword [ebp - 0x105c]
call fcn.0040d5c1
mov edi, eax
test edi, edi
je 0x40cb7e
cmp byte [ebp - 0x1064], 0
je 0x40cb64
mov ecx, dword [ebp - 0x105c]
call fcn.0040d5c1
test eax, eax
je 0x40cb64
mov ecx, dword [ebp - 0x1060]
mov edx, eax
call fcn.0040d940
push dword [ebp - 0x105c]
xor cl, cl
call fcn.0040f990
mov ecx, dword [ebp - 0x1068]
mov edx, edi
call fcn.0040d940
xor eax, eax
mov dword [ebp - method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov word [ebp - 0x105c], ax
mov edx, 0x851
lea eax, [ebp - 0x1068]
mov dword [ebp - 0x1064], str.Param
push eax
push str.HevCreateProcess_
push ecx
push 0x64
mov ecx, 0x170b0c5
mov dword [ebp - 0x1060], esi
call fcn.00401f81
lea ecx, [ebp - 0x1090]
call fcn.0040a89b
lea ecx, [ebp - 0x10a8]
call fcn.0040a89b
cmp byte [ebp - 0x10c4], 0
je 0x40cc2e
mov ecx, dword [ebp - 0x10b4]
call fcn.0040d5c1
mov edi, eax
test edi, edi
je 0x40cc2e
cmp byte [ebp - 0x10bc], 0
je 0x40cc14
mov ecx, dword [ebp - 0x10b4]
call fcn.0040d5c1
test eax, eax
je 0x40cc14
mov ecx, dword [ebp - 0x10b8]
mov edx, eax
call fcn.0040d940
push dword [ebp - 0x10b4]
xor cl, cl
call fcn.0040f990
mov ecx, dword [ebp - 0x10c0]
mov edx, edi
call fcn.0040d940
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042d667
leave
ret 0x20