Function at 0xcdb1b0
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x63c], edx
push ebx
push ebx
mov dword [ebp - 0x620], ecx
mov dword [ebp - 0x640], eax
call dword [sym.imp.api_ms_win_core_job_l2_1_0.dll_CreateJobObjectW]
mov edi, eax
mov dword [ebp - 0x624], edi
test edi, edi
je 0xcdb472
mov ecx, edi
mov esi, ebx
call fcn.00cdb167
mov dword [ebp - 0x644], eax
test eax, eax
je 0xcdb469
lea ecx, [ebp - 0x648]
push ecx
push 4
push eax
push 0xcdb130
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0xcdb252
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xcdb242
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xcdb45d
mov esi, 0x80004005
jmp 0xcdb45d
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test dword [0xd0a5c0], 0x2000
mov dword [ebp - 0x638], eax
je 0xcdb28c
push dword [ebp - 0x620]
mov edx, 0xb3d8c0
call fcn.00b90dd1
mov eax, dword [ebp - 0x638]
mov esi, 0x80004005
test eax, eax
je 0xcdb42f
mov ecx, 0x104
cmp eax, ecx
jae 0xcdb42f
push 0xb49c68
push ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
test eax, eax
js 0xcdb42f
push dword [ebp - 0x620]
lea eax, [ebp - 0x61c]
push 0x400
push 0xb49c00
push 0x208
push eax
call fcn.00b55e8f
add esp, 0x14
test eax, eax
js 0xcdb42f
push 0x40
lea eax, [ebp - 0x688]
mov dword [ebp - 0x68c], 0x44
push 0
push eax
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x634]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x68c]
push eax
xor eax, eax
push eax
push eax
push 4
push eax
push eax
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0xcdb36c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xcdb359
movzx eax, ax
or eax, 0x80070000
test eax, eax
mov edi, dword [ebp - 0x624]
jns 0xcdb42f
mov esi, eax
jmp 0xcdb42f
push dword [ebp - 0x634]
mov edi, dword [ebp - 0x624]
push edi
call dword [sym.imp.api_ms_win_core_job_l2_1_0.dll_AssignProcessToJobObject]
test eax, eax
je 0xcdb3ed
push dword [ebp - 0x630]
xor esi, esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
mov eax, dword [ebp - 0x63c]
test al, 2
je 0xcdb3ad
push 0xffffffffffffffff
mov edx, ebx
call fcn.00bc026b
jmp 0xcdb3c2
test al, 0x40
je 0xcdb3c2
mov edx, dword [ebp - 0x634]
mov ecx, dword [ebp - 0x640]
call fcn.00b8e006
test dword [0xd0a5c0], 0x2000
je 0xcdb413
push dword [ebp - 0x620]
push dword [ebp - 0x634]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
push eax
mov edx, 0xb3dd00
call fcn.00b80c4c
jmp 0xcdb413
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xcdb401
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xcdb405
mov esi, eax
push 5
push dword [ebp - 0x634]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
push dword [ebp - 0x634]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [ebp - 0x630]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
jns 0xcdb456
push 5
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
test dword [0xd0a5c0], 0x2000
je 0xcdb456
push dword [ebp - 0x620]
mov edx, 0xb3dd00
push 0
call fcn.00b80c4c
push ebx
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [ebp - 0x644]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0xcdb490
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xcdb489
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xcdb490
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 4