Function at 0x4d9f13
Capabilities:
Enumerate processes
Parse pe header

Disassembly:
push ebp
sub esp, 0x264
lea ebp, [esp - 4]
mov eax, dword [0x59d300]
xor eax, ebp
mov dword [ebp + 0x264], eax
push 0x14c
mov eax, 0x5210f3
call fcn.00506664
mov eax, dword [ebp + 0x270]
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x48], bl
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4da1e1
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
push edi
push 0x543368
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___app_name
push eax
mov dword [ebp - 4], ebx
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040b612
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 1
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe8]
call fcn.0040c22b
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4da313
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
push dword [ebp - 0x24]
lea eax, [ebp - 0xe0]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___parameters
push eax
mov dword [ebp - 4], 9
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040b612
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0xa
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe8]
call fcn.0040c22b
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4da449
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
push dword [ebp + 0x274]
lea eax, [ebp - 0xe0]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___session_id
push eax
mov dword [ebp - 4], 0x12
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.00408e51
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x13
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe8]
call fcn.0040c22b
or dword [ebp - 0x4c], 0xffffffff
push 0x54199c
push dword [ebp - 0x44]
xor edi, edi
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x60], edi
call fcn.0040aaf4
push dword [ebp - 0x24]
mov dword [ebp - 4], 0x1b
push eax
lea eax, [ebp + 0x22c]
push eax
call fcn.00417b0a
add esp, 0x18
push edi
push 1
lea esi, [ebp - 0x114]
mov byte [ebp - 4], 0x1d
call fcn.0040dac5
push edi
push 2
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4da691
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4da580
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___CreateToolhelp32Snapshot_failed.
push eax
mov byte [ebp - 4], 0x1e
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
mov byte [ebp - 4], 0x1f
lea edi, [ebp + 0x248]
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
push 0
push 1
lea esi, [ebp + 0x22c]
call fcn.0040dac5
mov eax, 0x3eb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x264]
xor ecx, ebp
call fcn.004ffa47
add ebp, 0x268
leave
ret
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 4], 2
call fcn.0040b935
mov byte [ebp - 4], 3
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x4da214
mov esi, dword [eax + 4]
jmp 0x4da217
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___app_name
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push edi
push eax
call fcn.0040b612
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0040dac5
lea eax, [ebp - 0x20]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4da2c1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x3e
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 2
call fcn.0040b8a0
or dword [ebp - 4], 0xffffffff
jmp 0x4d9fcc
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 4], 0xb
call fcn.0040b935
mov byte [ebp - 4], 0xc
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x18], 8
jb 0x4da346
mov esi, dword [eax + 4]
jmp 0x4da349
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___parameters
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x24]
push eax
call fcn.0040b612
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0xc
call fcn.0040dac5
lea eax, [ebp - 0x20]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xe
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4da3f7
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x3f
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xf
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xc
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0xb
call fcn.0040b8a0
or dword [ebp - 4], 0xffffffff
jmp 0x4da053
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 4], 0x14
call fcn.0040b935
mov byte [ebp - 4], 0x15
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x18], 8
jb 0x4da47c
mov esi, dword [eax + 4]
jmp 0x4da47f
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___session_id
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp + 0x274]
push eax
call fcn.00408e51
push 0
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x15
call fcn.0040dac5
lea eax, [ebp - 0x20]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x17
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4da52e
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x40
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x18
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x15
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x14
call fcn.0040b8a0
or dword [ebp - 4], 0xffffffff
jmp 0x4da0db
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x20
call fcn.0040b935
mov byte [ebp - 4], 0x21
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x22
cmp dword [eax + 0x18], 8
jb 0x4da5b0
mov esi, dword [eax + 4]
jmp 0x4da5b3
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___CreateToolhelp32Snapshot_failed.
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push edi
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x21
call fcn.0040dac5
lea eax, [ebp - 0x20]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x23
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4da647
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x50
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x24
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push edi
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x21
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0xe0]
call fcn.0040b8a0
jmp 0x4da1aa
lea eax, [ebp]
push eax
push esi
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4da7f8
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4da6f2
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___Process32First_failed.
push eax
mov byte [ebp - 4], 0x27
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
mov byte [ebp - 4], 0x28
jmp 0x4da185
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x29
call fcn.0040b935
mov byte [ebp - 4], 0x2a
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x2b
cmp dword [eax + 0x18], 8
jb 0x4da722
mov esi, dword [eax + 4]
jmp 0x4da725
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___Process32First_failed.
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push edi
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x2a
call fcn.0040dac5
lea eax, [ebp - 0x20]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x2c
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4da7b9
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x56
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x2d
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push edi
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x2a
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
mov byte [ebp - 4], 0x29
jmp 0x4da657
lea eax, [ebp + 0x24]
push str.explorer.exe
push eax
call fcn.00500f36
pop ecx
pop ecx
test eax, eax
jne 0x4daafe
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x44], edi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4daafe
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp + 0x274]
jne 0x4daafe
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4c], edi
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4da9c9
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
push edi
push 0x543368
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___winlogonPid
push eax
mov byte [ebp - 4], 0x30
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.00408e51
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x31
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x158]
push 0
push eax
mov dword [ebp - 0x44], 0x30
call fcn.005060b0
xor eax, eax
lea edi, [ebp - 0xf8]
stosd dword es:[edi], eax
add esp, 0xc
push dword [ebp - 0x4c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
mov esi, 0x2000000
push esi
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x150], str.winsta0default
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x60]
push ecx
push 0x2000a
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4dadd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dacab
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
push dword [ebp - 0x24]
lea eax, [ebp - 0xe0]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___OpenProcessToken_failed
push eax
mov byte [ebp - 4], 0x42
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004126c3
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x43
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x58]
call esi
push dword [ebp - 0x60]
call esi
mov edi, dword [ebp - 0x24]
jmp 0x4dab84
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x32
call fcn.0040b935
mov byte [ebp - 4], 0x33
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x34
cmp dword [eax + 0x18], 8
jb 0x4da9f9
mov esi, dword [eax + 4]
jmp 0x4da9fc
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___winlogonPid
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push edi
push eax
call fcn.00408e51
push 0
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x33
call fcn.0040dac5
lea eax, [ebp - 0x20]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x35
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4daaa6
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x60
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x36
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x33
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x32
call fcn.0040b8a0
mov dword [ebp - 4], 0x1d
jmp 0x4da8bd
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4da7f8
test bl, bl
jne 0x4da8bd
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4dab9a
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___didnt_get_winlogonPid.
push eax
mov byte [ebp - 4], 0x39
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x3a
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
mov edi, 0x3eb
push 0
push 1
lea esi, [ebp + 0x22c]
call fcn.0040dac5
mov eax, edi
jmp 0x4da1be
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x3b
call fcn.0040b935
mov byte [ebp - 4], 0x3c
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x3d
cmp dword [eax + 0x18], 8
jb 0x4dabca
mov esi, dword [eax + 4]
jmp 0x4dabcd
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___didnt_get_winlogonPid.
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push edi
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x3c
call fcn.0040dac5
lea eax, [ebp - 0x20]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x3e
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dac61
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x68
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x3f
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push edi
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x3c
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x3b
call fcn.0040b8a0
jmp 0x4dab7f
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], bl
call fcn.0040b935
mov byte [ebp - 4], 0x45
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x46
cmp dword [eax + 0x18], 8
jb 0x4dacda
mov esi, dword [eax + 4]
jmp 0x4dacdd
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___OpenProcessToken_failed
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x24]
push eax
call fcn.004126c3
push 0
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x45
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x47
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dad89
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x76
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x48
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x45
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], bl
call fcn.0040b8a0
jmp 0x4da9ac
lea eax, [ebp - 0x58]
push eax
xor edi, edi
inc edi
push edi
push edi
xor ebx, ebx
push ebx
push esi
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4daf9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4dae7a
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
push dword [ebp - 0x24]
lea eax, [ebp - 0xe0]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___DuplicateTokenEx_failed
push eax
mov byte [ebp - 4], 0x4b
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004126c3
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x4c
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
jmp 0x4da9ac
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x4d
call fcn.0040b935
mov byte [ebp - 4], 0x4e
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x4f
cmp dword [eax + 0x18], 8
jb 0x4daeaa
mov esi, dword [eax + 4]
jmp 0x4daead
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___DuplicateTokenEx_failed
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x24]
push eax
call fcn.004126c3
push ebx
push edi
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x4e
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x50
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4daf55
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x7c
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x51
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push edi
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x4e
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x4d
call fcn.0040b8a0
jmp 0x4dae75
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp eax, 0x514
jne 0x4db131
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4db01f
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___we_got_ERROR_NOT_ALL_ASSIGNED
push eax
mov byte [ebp - 4], 0x54
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x55
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
jmp 0x4da9ac
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x56
call fcn.0040b935
mov byte [ebp - 4], 0x57
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x58
cmp dword [eax + 0x18], 8
jb 0x4db04f
mov esi, dword [eax + 4]
jmp 0x4db052
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___we_got_ERROR_NOT_ALL_ASSIGNED
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push edi
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x57
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x59
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4db0e7
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x82
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x5a
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push edi
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x57
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x56
call fcn.0040b8a0
jmp 0x4db01a
push edi
push dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], ebx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4db14e
mov dword [ebp - 0x44], 0x430
jmp 0x4db151
mov dword [ebp - 0x5c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x4c], eax
cmp eax, ebx
je 0x4db3b4
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4db4c3
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___LoadLibrary_Advapi32.dll
push eax
mov byte [ebp - 4], 0x5d
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x5e
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
push str.CreateProcessWithTokenW
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4db33a
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4db5e3
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___CreateProcessWithTokenW
push eax
mov byte [ebp - 4], 0x66
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x67
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
cmp dword [ebp + 0x244], 8
mov eax, dword [ebp + 0x230]
jae 0x4db273
lea eax, [ebp + 0x230]
lea ecx, [ebp - 0xf8]
push ecx
lea ecx, [ebp - 0x158]
push ecx
xor ebx, ebx
push ebx
push dword [ebp - 0x5c]
push dword [ebp - 0x44]
push eax
push ebx
push 1
push dword [ebp - 0x58]
call dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4db707
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
mov byte [ebp - 4], 0x6f
push dword [ebp - 0x50]
lea eax, [ebp - 0xe0]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___CreateProcessWithTokenW_Result:
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004126c3
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x70
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
cmp dword [ebp - 0x50], 0
je 0x4db33a
cmp byte [ebp - 0x48], 0
je 0x4db33a
push 0xffffffffffffffff
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4db83f
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___FreeLibrary_Advapi32.dll
push eax
mov byte [ebp - 4], 0x78
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x79
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
xor edi, edi
xor ebx, ebx
inc edi
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4db963
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
mov byte [ebp - 4], 0x81
cmp dword [ebp - 0x50], ebx
setne al
movzx eax, al
push eax
push 0x543368
lea eax, [ebp - 0xe0]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___bResult
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004177b8
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x82
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dbaa0
lea eax, [ebp - 0xe8]
push eax
call fcn.0040d9e1
push dword [ebp - 0x24]
lea eax, [ebp - 0xe0]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___error
push eax
mov byte [ebp - 4], 0x8a
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004126c3
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x8b
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1d
call fcn.0040c22b
jmp 0x4da9ac
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x5f
call fcn.0040b935
mov byte [ebp - 4], 0x60
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x61
cmp dword [eax + 0x18], 8
jb 0x4db4f3
mov esi, dword [eax + 4]
jmp 0x4db4f6
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___LoadLibrary_Advapi32.dll
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push edi
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x60
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x62
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4db58b
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x93
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x63
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push edi
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x60
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x5f
call fcn.0040b8a0
mov dword [ebp - 4], 0x1d
jmp 0x4db1d9
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x68
call fcn.0040b935
mov byte [ebp - 4], 0x69
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x6a
cmp dword [eax + 0x18], 8
jb 0x4db613
mov esi, dword [eax + 4]
jmp 0x4db616
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___CreateProcessWithTokenW
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x69
call fcn.0040dac5
lea eax, [ebp - 0x54]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x6b
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4db6af
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0x98
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x6c
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x69
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x68
call fcn.0040b8a0
mov dword [ebp - 4], 0x1d
jmp 0x4db25e
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x71
call fcn.0040b935
mov byte [ebp - 4], 0x72
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x73
cmp dword [eax + 0x18], 8
jb 0x4db737
mov esi, dword [eax + 4]
jmp 0x4db73a
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___CreateProcessWithTokenW_Result:
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x50]
push eax
call fcn.004126c3
push ebx
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x72
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x74
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4db7e7
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0xa6
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x75
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x72
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x71
call fcn.0040b8a0
mov dword [ebp - 4], 0x1d
jmp 0x4db320
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x7a
call fcn.0040b935
mov byte [ebp - 4], 0x7b
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x7c
cmp dword [eax + 0x18], 8
jb 0x4db86f
mov esi, dword [eax + 4]
jmp 0x4db872
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___FreeLibrary_Advapi32.dll
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x7b
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x7d
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4db90b
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0xaf
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x7e
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x7b
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x7a
call fcn.0040b8a0
mov dword [ebp - 4], 0x1d
jmp 0x4db3af
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x83
call fcn.0040b935
mov byte [ebp - 4], 0x84
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x85
cmp dword [eax + 0x18], 8
jb 0x4db993
mov esi, dword [eax + 4]
jmp 0x4db996
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___bResult
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
cmp dword [ebp - 0x50], ebx
pop ecx
pop ecx
setne cl
movzx ecx, cl
push ecx
push eax
call fcn.004177b8
push ebx
push edi
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x84
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x86
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dba48
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0xb5
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x87
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push edi
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x84
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x83
call fcn.0040b8a0
mov dword [ebp - 4], 0x1d
jmp 0x4db43c
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x8c
call fcn.0040b935
mov byte [ebp - 4], 0x8d
call fcn.0040dbda
lea ecx, [ebp - 0x40]
call fcn.0040b84b
mov byte [ebp - 4], 0x8e
cmp dword [eax + 0x18], 8
jb 0x4dbad0
mov esi, dword [eax + 4]
jmp 0x4dbad3
lea esi, [eax + 4]
lea eax, [ebp - 0xe0]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSession___error
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x24]
push eax
call fcn.004126c3
push 0
push 1
lea esi, [ebp - 0x40]
mov byte [ebp - 4], 0x8d
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x8f
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dbb82
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040b831
push 0xb6
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x90
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x40]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x8d
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x8c
call fcn.0040b8a0
jmp 0x4da9ac