Function at 0x404520
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4268
call fcn.00409c40
mov eax, dword [0x42a130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x4264]
mov dword [ebp - 0x4268], 0
push 0
push eax
call fcn.00407e40
xorps xmm0, xmm0
push 0x5c
push 0x42c380
movdqu xmmword [ebp - 0x4224], xmm0
call fcn.00408924
mov esi, eax
add esp, 0x14
test esi, esi
je 0x404583
xor eax, eax
mov edi, 0x42c380
mov word [esi], ax
add esi, 2
jmp 0x40458d
mov esi, 0x42c380
mov edi, 0x455ac0
push 0x42c588
push 0x451680
lea eax, [ebp - 0x420c]
push 0x421988
push eax
call fcn.00407531
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
cmp byte [0x430796], 0
jne 0x40465c
cmp word [esi], 0
je 0x40465c
xor ecx, ecx
lea eax, [ebp - 0x4224]
cmp word [0x430588], cx
push eax
lea eax, [ebp - 0x4268]
push eax
mov eax, 0x430588
cmove eax, ecx
push eax
mov eax, dword [0x430798]
push ecx
or eax, 0x414
push eax
lea eax, [ebp - 0x420c]
push eax
xor eax, eax
cmp byte [0x42a10a], al
push ecx
setne al
push eax
push 0x4518a0
push edi
push esi
call dword [0x4307a4]
test eax, eax
jne 0x40476f
push 0x451680
push str._rPsExec_could_not_start__s:_n
call fcn.00407f6a
add eax, 0x40
push eax
call fcn.004082af
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
call esi
push eax
call fcn.00402ec0
add esp, 4
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004077dc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x4210]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp byte [0x430796], 0
je 0x4046e2
push dword [ebp - 0x4210]
call fcn.004024a0
mov edi, eax
add esp, 4
test edi, edi
jne 0x4046d8
push str._rPsExec_could_not_create_a_limited_user_token:_n
call fcn.00407f6a
add eax, 0x40
push eax
call fcn.004082af
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.00402ec0
add esp, 4
push dword [ebp - 0x4210]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004077dc
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x4210]
call ebx
jmp 0x4046e8
mov edi, dword [ebp - 0x4210]
xor ecx, ecx
lea eax, [ebp - 0x4224]
cmp word [0x430588], cx
push eax
lea eax, [ebp - 0x4268]
push eax
mov eax, 0x430588
cmove eax, ecx
push eax
mov eax, dword [0x430798]
push ecx
or eax, 0x414
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x420c]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x40476c
push 0x451680
push str._rPsExec_could_not_start__s:_n
call fcn.00407f6a
add eax, 0x40
push eax
call fcn.004082af
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
call esi
push eax
call fcn.00402ec0
add esp, 4
push edi
call ebx
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004077dc
mov esp, ebp
pop ebp
ret
push edi
call ebx
cmp dword [0x430798], 0x100000
jne 0x404789
push dword [ebp - 0x4224]
call fcn.004028e0
add esp, 4
mov eax, dword [0x43079c]
test eax, eax
je 0x40479f
push eax
push dword [ebp - 0x4224]
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push dword [ebp - 0x4220]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [0x430791], 0
jne 0x4047f5
push 0xffffffffffffffff
push dword [ebp - 0x4224]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x4214]
push eax
push dword [ebp - 0x4224]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x4214]
push 0x451680
push str._s_exited_with_error_code__d._n
call fcn.00407f6a
add eax, 0x40
push eax
call fcn.004082af
jmp 0x40481f
push dword [ebp - 0x421c]
push 0x451680
push str._s_started_with_process_ID__d._n
call fcn.00407f6a
add eax, 0x40
push eax
call fcn.004082af
mov eax, dword [ebp - 0x421c]
mov dword [ebp - 0x4214], eax
add esp, 0x10
push dword [ebp - 0x4220]
call ebx
push dword [ebp - 0x4224]
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4214]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004077dc
mov esp, ebp
pop ebp
ret