Function at 0x4091c6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
xor ebx, ebx
push str.Kernel32
xor esi, esi
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x409202
push str.GetProductInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4091fb
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x68]
push ebx
push eax
mov dword [ebp - 0x6c], ebx
call fcn.0041f640
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
cmp byte [ebp - 1], bl
je 0x4093ef
and dword [ebp - 8], esi
push 0
mov ebx, 0x3000
push str.Progman
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x409258
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call fcn.00408580
mov esi, eax
test esi, esi
pop ecx
pop ecx
jl 0x40942e
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00408580
mov esi, eax
test esi, esi
pop ecx
pop ecx
jl 0x40942e
cmp dword [ebp - 0xc], ebx
jne 0x4093d6
cmp dword [ebp - 0x10], 0x2000
jne 0x4093e9
push dword [ebp - 8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x4093e9
lea ecx, [ebp - 0x18]
push ecx
push 0x2000a
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4093af
lea eax, [ebp - 0x14]
push eax
push 1
push 2
push 0
push 0xf01ff
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40930d
call edi
test eax, eax
jg 0x4092fd
call edi
mov esi, eax
jmp 0x40930d
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x409388
push str.AdvApi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x40936d
push str.CreateProcessWithTokenW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40936d
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push dword [ebp - 0x14]
call eax
test eax, eax
jne 0x409372
call edi
test eax, eax
jg 0x40935b
call edi
mov esi, eax
jmp 0x409372
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x409372
mov esi, 0x8000ffff
test ebx, ebx
je 0x40937d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4093a4
call edi
test eax, eax
jg 0x409394
call edi
mov esi, eax
jmp 0x4093a4
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4093cb
call edi
test eax, eax
jg 0x4093bb
call edi
mov esi, eax
jmp 0x4093cb
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4093e9
cmp dword [ebp - 0xc], 0x2000
jne 0x4093e9
cmp dword [ebp - 0x10], ebx
jne 0x4093e9
mov esi, 0x80070005
test esi, esi
jl 0x40942e
xor ebx, ebx
cmp dword [ebp - 0x20], ebx
jne 0x40942e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40942e
call edi
test eax, eax
jg 0x40941e
call edi
mov esi, eax
jmp 0x40942e
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret