Function at 0x10113cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x12bc
call fcn.1012e520
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x12b8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x20]
xor esi, esi
push 0x206
mov dword [esp + 0x50], ecx
mov dword [esp + 0x24], eax
or eax, 0xffffffff
lea ecx, [esp + 0xbe]
push esi
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x24], eax
mov word [esp + 0xc4], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x7fe
lea edx, [esp + 0x2c6]
push esi
push edx
mov word [esp + 0x2cc], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x7fe
lea eax, [esp + 0xac6]
push esi
push eax
mov word [esp + 0xacc], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x40
lea ecx, [esp + 0x78]
push esi
push ecx
mov dword [esp + 0x7c], esi
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x2710
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x2c0]
push edx
call fcn.10113990
mov edi, eax
cmp edi, esi
jne 0x10113e1f
push 0xfa
call fcn.10113800
add esp, 4
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push ebx
push edx
push str.GetModuleDir_NULL__szwWork__MAX_PATH_
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
jmp 0x1011435a
lea ecx, [esp + 0x2c0]
push ecx
lea edx, [esp + 0xbc]
push 0x104
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x1014bdb4
lea eax, [esp + 0xbc]
push 0x104
push eax
call edi
add esp, 0xc
push str.ABSpawn.exe
lea ecx, [esp + 0xbc]
push 0x104
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x2c0]
push edx
lea eax, [esp + 0xac4]
push 0x400
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push 0x1014bdb4
lea ecx, [esp + 0xac4]
push 0x400
push ecx
call edi
add esp, 0xc
push str.ABStater.exe
lea edx, [esp + 0xac4]
push 0x400
push edx
call edi
add esp, 0xc
push 0x44
lea eax, [esp + 0x74]
push esi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x800
mov eax, 1
lea ecx, [esp + 0x2c4]
push esi
push ecx
mov dword [esp + 0x7c], 0x44
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov word [esp + 0xac], ax
mov dword [esp + 0xa8], eax
mov dword [esp + 0x84], str.winsta0default
call sub.MSVCR80.dll_memset
xor edx, edx
add esp, 0xc
cmp ebx, esi
setne dl
mov edi, edx
cmp edi, esi
jne 0x10113f65
push 0x10c
call fcn.10113800
add esp, 4
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push ebx
push edx
push str.Cmdline___NULL
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
jmp 0x1011435a
push ebx
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0x2c8]
push str._s__s
push edx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x4c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], eax
call fcn.10113be0
mov edi, eax
cmp edi, esi
jne 0x10113fe3
push 0x13d
call fcn.10113800
add esp, 4
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
call sub.Comn.dll_GetObjectLog
mov edx, dword [esp + 0x24]
mov ecx, dword [eax]
push ebx
push edx
push str.GetLogonUserToken_hLogonToken__tchUser__tchPwd_
push str._s_return_code:_0x_08X___s.
push eax
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
jmp 0x1011435a
cmp dword [esp + 0x14], 0xffffffff
jne 0x10114016
push 0x13f
xor edi, edi
call fcn.10113800
add esp, 4
push eax
push str.FALSE
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
xor esi, esi
jmp 0x1011435a
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, esi
mov dword [esp + 0x3c], ebx
jne 0x10114056
push 0x15c
xor edi, edi
call fcn.10113800
add esp, 4
push eax
push str.FALSE
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
xor esi, esi
jmp 0x1011435a
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edi, eax
cmp edi, esi
jne 0x1011407d
push 0x15e
call fcn.10113800
add esp, 4
push eax
push str.InitializeSecurityDescriptor_pSD__SECURITY_DESCRIPTOR_REVISION_
jmp 0x1011422a
push esi
push esi
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edi, eax
cmp edi, esi
jne 0x101140a6
push 0x15f
call fcn.10113800
add esp, 4
push eax
push str.SetSecurityDescriptorDacl_pSD__TRUE__NULL__FALSE_
jmp 0x1011422a
mov ecx, dword [esp + 0x4c]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
call fcn.10114390
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 1
push 2
lea ecx, [esp + 0x60]
push ecx
push 0x2000000
push edx
mov dword [esp + 0x6c], 0x14
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 1
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
cmp edi, esi
jne 0x10114109
push 0x17d
call fcn.10113800
add esp, 4
push eax
push str.DuplicateTokenEx_hLogonToken__MAXIMUM_ALLOWED__processSA__SecurityImpersonation__TokenPrimary__hLinkToken_
jmp 0x1011422a
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x44]
push eax
push 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov edi, eax
cmp edi, esi
jne 0x1011413b
push 0x17e
call fcn.10113800
add esp, 4
push eax
push str.SetTokenInformation_hLinkToken__TokenSessionId__dwSession__sizeof_DWORD__
jmp 0x1011422a
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x44]
push edx
push 4
lea eax, [esp + 0x50]
push eax
push 0x12
push ecx
call ebx
mov edi, eax
cmp edi, esi
jne 0x10114174
push 0x180
call fcn.10113800
add esp, 4
push eax
push str.GetTokenInformation_hLinkToken__TokenElevationType__dwElecateType__sizeof_dwElecateType__dwLength_
jmp 0x1011422a
mov eax, dword [esp + 0x48]
cmp eax, 1
je 0x101141f0
cmp eax, 2
je 0x101141f0
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x44]
push eax
push 4
lea ecx, [esp + 0x58]
push ecx
push 0x13
push edx
call ebx
test eax, eax
jne 0x101141dc
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push 0x186
mov dword [esp + 0x20], eax
xor edi, edi
call fcn.10113800
add esp, 4
push eax
push str.bResult
call ebx
mov esi, eax
call fcn.100016d0
add esp, 8
xor esi, esi
jmp 0x1011435a
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x101141e8
push eax
call edi
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
push 1
push ecx
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x6c], 0x14
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
call sub.USERENV.dll_CreateEnvironmentBlock
mov edi, eax
cmp edi, esi
jne 0x10114241
push 0x191
call fcn.10113800
add esp, 4
push eax
push str.CreateEnvironmentBlock_pEnv__hLogonToken__TRUE_
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.100016d0
add esp, 8
xor esi, esi
jmp 0x10114356
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x74]
push ecx
push edx
push eax
push 0x4000410
push esi
lea ecx, [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x2e0]
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edx, dword [esp + 0x28]
push edx
mov edi, eax
call sub.USERENV.dll_DestroyEnvironmentBlock
cmp edi, esi
jne 0x101142bd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [esp + 0x20]
push 0x1a4
mov dword [ecx], eax
call fcn.10113800
add esp, 4
push eax
push str.bResult
call esi
mov esi, eax
call fcn.100016d0
add esp, 8
xor esi, esi
jmp 0x10114356
cmp dword [ebp + 0x18], esi
je 0x1011431d
mov edx, dword [esp + 0x2c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x1c], esi
je 0x1011431d
call sub.Comn.dll_GetObjectLog
mov edx, dword [esp + 0x1c]
mov ebx, eax
mov edi, dword [ebx]
push edx
push 0x1ab
add edi, 0xc
call fcn.10113800
add esp, 4
push eax
mov eax, dword [edi]
push str._s:_ExcuteBatScript_error__code:__d
push ebx
call eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
add esp, 0x10
xor edi, edi
mov dword [edx], ecx
mov eax, dword [esp + 0x2c]
or ebx, 0xffffffff
cmp eax, ebx
je 0x10114333
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x10114346
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
cmp edi, esi
jne 0x10114366
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x20]
mov dword [edx], eax
mov eax, dword [esp + 0x3c]
cmp eax, esi
je 0x10114375
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x12c4]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1012d370
mov esp, ebp
pop ebp
ret 0x1c