Function at 0x40c01c
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40c024
push ecx
push ebx
push esi
push edi
mov eax, 0x40bf6c
call fcn.00405218
mov ebx, 0x40ebe4
mov esi, 0x40eb5c
xor eax, eax
push ebp
push 0x40c4f4
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040b0a0
call fcn.0040b324
call sub.kernel32.dll_GetTickCount
mov dword [0x40ebe0], eax
mov ecx, 0x40eb70
mov eax, 0x40c504
mov edx, 0xa
call fcn.0040a130
test al, al
je 0x40c4d9
call fcn.0040aba0
cmp byte [0x40eb79], 0
je 0x40c09b
mov eax, 0x40c50c
mov dl, 1
call fcn.00406380
cmp byte [0x40eb78], 0
je 0x40c118
mov eax, dword [0x40eb70]
call fcn.00406054
mov edi, eax
mov dword [esi + 8], edi
push edi
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [esi], eax
mov eax, dword [esi + 8]
call fcn.004061a8
mov edi, eax
mov dword [esi + 0xc], edi
push edi
push 0
push 0x1f03ff
call sub.kernel32.dll_OpenThread
mov dword [esi + 4], eax
cmp dword [esi + 8], 0
jne 0x40c10a
cmp byte [0x40eb7c], 0
jne 0x40c4d9
push 0x10
push 0x40c520
push 0x40c52c
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x40c4d9
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_DebugActiveProcess
jmp 0x40c4bb
push esi
push 0x40eb18
push 0
push 0
push 3
push 0
push 0
push 0
push 0
mov eax, dword [0x40ebdc]
call fcn.00404244
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40c4bb
cmp byte [0x40eb7c], 0
jne 0x40c4d9
push 0x10
push 0x40c520
push 0x40c550
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x40c4d9
mov eax, dword [0x40eb81]
push eax
push ebx
call sub.kernel32.dll_WaitForDebugEvent
test eax, eax
jne 0x40c196
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x79
jne 0x40c4c8
cmp dword [esi + 8], 0
je 0x40c4d9
jmp 0x40c4bb
mov eax, dword [ebx]
dec eax
je 0x40c348
sub eax, 2
je 0x40c1b5
sub eax, 2
je 0x40c4a0
dec eax
je 0x40c1e3
jmp 0x40c4a9
cmp dword [0x40eb74], 0
jne 0x40c1cc
cmp byte [0x40eb7b], 0
jne 0x40c1cc
call fcn.0040b5e8
push 0x10002
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40c4bb
cmp dword [0x40eb74], 0
jne 0x40c1f9
cmp byte [0x40eb7b], 0
je 0x40c331
cmp word [ebx + 0x20], 1
sete byte [0x40ed20]
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x40ed20
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x1c]
call fcn.0040be34
mov edx, dword [ebp - 0x14]
mov eax, 0x40ed1c
call fcn.00403dfc
cmp dword [0x40ed1c], 0
je 0x40c268
cmp byte [0x40ed20], 0
je 0x40c250
mov eax, 0x40ed1c
call fcn.0040429c
mov edx, eax
mov eax, 0x40ed18
call fcn.00403fd0
jmp 0x40c27e
mov eax, 0x40ed1c
call fcn.0040429c
mov edx, eax
mov eax, 0x40ed18
call fcn.00403fa0
jmp 0x40c27e
mov eax, 0x40ed1c
call fcn.0040429c
mov edx, eax
mov eax, 0x40ed18
call fcn.00403fa0
cmp byte [0x40eb7b], 0
je 0x40c2e0
lea edx, [ebp - 0x1c]
mov eax, dword [0x40ed18]
call fcn.00406328
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00406238
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x40c588
call fcn.00406238
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00404190
jne 0x40c2e0
push 0x40c594
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x40ed10], eax
mov edx, dword [0x40ed10]
mov eax, dword [esi]
call fcn.0040beac
mov byte [0x40ed14], al
lea edx, [ebp - 0x28]
mov eax, dword [0x40ed18]
call fcn.00406328
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00406238
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x40eb74]
call fcn.00406238
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00404190
jne 0x40c331
mov byte [0x40d118], 1
mov eax, dword [ebx + 0x10]
mov dword [0x40ed24], eax
cmp byte [0x40eb7b], 0
jne 0x40c331
call fcn.0040b5e8
push 0x10002
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40c4bb
mov eax, dword [ebx + 0xc]
sub eax, 0x80000003
je 0x40c38d
dec eax
je 0x40c438
sub eax, 0x40000001
jne 0x40c48c
cmp dword [ebx + 0x5c], 0
je 0x40c381
push 0x80010001
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40c4bb
mov byte [0x40d114], 1
jmp 0x40c4bb
cmp dword [ebx + 0x5c], 0
je 0x40c421
mov eax, dword [ebx + 0x18]
cmp eax, dword [0x40ed10]
jne 0x40c40a
mov dword [0x40ec44], 0x10003
push 0x40ec44
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_GetThreadContext
push 0x40eb6c
push 1
push 0x40ed14
mov eax, dword [0x40ed10]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_WriteProcessMemory
cmp dword [0x40eb74], 0
je 0x40c3ed
cmp byte [0x40d118], 0
je 0x40c3f2
call fcn.0040b5e8
jmp 0x40c3f2
call fcn.0040b5e8
or dword [0x40ed04], 0x100
push 0x40ec44
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_SetThreadContext
push 0x10002
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40c4bb
push 0x80010001
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40c4bb
cmp dword [ebx + 0x5c], 0
je 0x40c478
mov dword [0x40ec44], 0x10001
push 0x40ec44
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_GetThreadContext
push 0x40ec44
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_SetThreadContext
push 0x10002
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40c4bb
push 0x80010001
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40c4bb
push 0x80010001
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x40c4bb
mov byte [0x40d114], 1
jmp 0x40c4bb
push 0x80010001
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ContinueDebugEvent
cmp byte [0x40d114], 0
je 0x40c169
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c4fb
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.00403dcc
ret