Function at 0x41c4b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x4a0d40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x208], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
call fcn.0041ad00
cmp eax, 7
je 0x41c4f0
cmp eax, 6
je 0x41c4f0
mov bl, 1
jmp 0x41c4f2
xor bl, bl
push dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push edi
push str.__s___s
push 0xffffffffffffffff
push 0xff
push eax
call fcn.0043b6d4
push 0x40
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x270], esi
xorps xmm0, xmm0
push 0
push eax
movdqu xmmword [ebp - 0x22c], xmm0
call fcn.0043b830
add esp, 0x24
test bl, bl
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x41c71f
push 0
push str.Progman
mov dword [ebp - 0x208], 0x3000
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], 0x3000
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x41c57c
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call fcn.0041c7c0
add esp, 8
test eax, eax
js 0x41c7a4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0041c7c0
mov esi, eax
add esp, 8
test esi, esi
js 0x41c7a2
mov ecx, dword [ebp - 0x208]
cmp ecx, 0x3000
jne 0x41c778
cmp dword [ebp - 0x20c], 0x2000
jne 0x41c717
push dword [ebp - 0x210]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x208], eax
test eax, eax
je 0x41c717
lea ecx, [ebp - 0x214]
push ecx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41c6fe
lea eax, [ebp - 0x218]
push eax
push 1
push 2
push 0
push 0xf01ff
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x41c650
call ebx
mov esi, eax
test esi, esi
jle 0x41c652
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41c6e3
push str.AdvApi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41c6bb
push str.CreateProcessWithTokenW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41c6bb
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x270]
push ecx
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x204]
push 0
push 0
push ecx
push 0
push 0
push dword [ebp - 0x218]
call eax
test eax, eax
jne 0x41c6c0
call ebx
mov esi, eax
test esi, esi
jle 0x41c6c0
movzx esi, si
or esi, 0x80070000
jmp 0x41c6c0
mov esi, 0x8000ffff
test edi, edi
je 0x41c6cb
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x218]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x214]
call edi
jmp 0x41c70f
call ebx
mov esi, eax
test esi, esi
jle 0x41c6f4
movzx esi, si
or esi, 0x80070000
push dword [ebp - 0x214]
call edi
jmp 0x41c70f
call ebx
mov esi, eax
test esi, esi
jle 0x41c70f
movzx esi, si
or esi, 0x80070000
push dword [ebp - 0x208]
call edi
test esi, esi
js 0x41c7a2
cmp dword [ebp - 0x224], 0
jne 0x41c7a2
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x21c]
lea eax, [ebp - 0x204]
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41c7a2
call ebx
test eax, eax
jle 0x41c7a4
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a20e
mov esp, ebp
pop ebp
ret
cmp ecx, 0x2000
jne 0x41c717
cmp dword [ebp - 0x20c], 0x3000
jne 0x41c717
pop edi
pop esi
mov eax, 0x80070005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a20e
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043a20e
mov esp, ebp
pop ebp
ret