Function at 0x402202
Capabilities:
Create process on windows

Disassembly:
push 0x70
mov eax, 0x40a759
call fcn.00409829
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_316]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov byte [ebp - 4], 4
push 0x40
lea eax, [ebp - 0x78]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
call sub.MSVCR100.dll_memset
mov dword [ebp - 0x38], ebx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00401eaf
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401fa3
mov eax, dword [0x45d0e4]
add esp, 0x14
cmp eax, ebx
jne 0x40228f
xor ecx, ecx
jmp 0x402291
mov ecx, dword [eax]
mov edi, str.Execute_Delegation
test cl, 4
je 0x4022b0
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push str._s:_Command_line_before_merging:___s___permission_checked_d
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0x14
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push 0x2000
push eax
push dword [ebp + 8]
call fcn.00401e25
mov eax, dword [ebp - 0x20]
add esp, 0x10
push str.saplgpad.exe
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], eax
call dword [sym.imp.mfc100.dll_Ordinal_1316]
mov esi, 0x4338e8
push esi
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push str.saplogon.exe
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_1483]
mov eax, dword [0x45d0e4]
cmp eax, ebx
jne 0x402327
xor ecx, ecx
jmp 0x402329
mov ecx, dword [eax]
test cl, 4
je 0x402345
push dword [ebp - 0x10]
push edi
push str._s:_Command_line_passed_to_saplogon_is:___s_
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
mov eax, dword [0x45d0e4]
add esp, 0x10
xor esi, esi
inc esi
mov ecx, esi
mov word [ebp - 0x4c], cx
mov ecx, dword [ebp - 0x28]
dec ecx
mov dword [ebp - 0x7c], 0x44
mov dword [ebp - 0x50], esi
je 0x402739
dec ecx
je 0x4026ea
dec ecx
je 0x402583
cmp eax, ebx
jne 0x402378
xor ecx, ecx
jmp 0x40237a
mov ecx, dword [eax]
test cl, 4
je 0x40238e
push edi
push str._s:_Delegation_option:_default
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
call fcn.00402167
dec eax
dec eax
mov eax, dword [0x45d0e4]
je 0x402493
cmp eax, ebx
jne 0x4023a8
xor ecx, ecx
jmp 0x4023aa
mov ecx, dword [eax]
test cl, 4
je 0x4023be
push edi
push str._s:_Handle_default
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call esi
cmp eax, ebx
jne 0x402788
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x45d0e4]
cmp ecx, ebx
jne 0x4023f7
xor edx, edx
jmp 0x4023f9
mov edx, dword [ecx]
test dl, 6
je 0x40240e
push eax
push edi
push str._s:_Failed_to_start_saplogon.exe__rc___d____Use_SAP_Logon_Pad
push ecx
call sub.sapfewtr.dll_FEWTraceWarning
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call esi
cmp eax, ebx
jne 0x402788
push 2
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s:_Failed_to_start_both_saplogon.exe_and_saplgpad.exe__rc___d____No_delegation
push dword [0x45d0e4]
call sub.sapfewtr.dll_FEWTraceError
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, esi
call fcn.00409892
ret
cmp eax, ebx
jne 0x40249b
xor ecx, ecx
jmp 0x40249d
mov ecx, dword [eax]
test cl, 4
je 0x4024b1
push edi
push str._s:_saplgpad.exe_running
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x402788
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [0x45d0e4]
cmp ecx, ebx
jne 0x4024ea
xor edx, edx
jmp 0x4024ec
mov edx, dword [ecx]
test dl, 6
je 0x402501
push eax
push edi
push str._s:_Failed_to_start_saplgpad.exe__rc___d____Use_SAP_Logon
push ecx
call sub.sapfewtr.dll_FEWTraceWarning
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x402788
call esi
push eax
push edi
push str._s:_Failed_to_start_both_saplgpad.exe_and_saplogon.exe__rc___d____No_delegation
push dword [0x45d0e4]
call sub.sapfewtr.dll_FEWTraceError
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push 2
pop eax
jmp 0x40248d
cmp eax, ebx
jne 0x40258b
xor ecx, ecx
jmp 0x40258d
mov ecx, dword [eax]
test cl, 4
je 0x4025a1
push edi
push str._s:_Delegation_option:_inverse_default
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
call fcn.00402167
dec eax
mov eax, dword [0x45d0e4]
je 0x40263a
cmp eax, ebx
jne 0x4025ba
xor ecx, ecx
jmp 0x4025bc
mov ecx, dword [eax]
test cl, 4
je 0x4025d0
push edi
push str._s:_Handle_default
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call esi
cmp eax, ebx
jne 0x402788
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x45d0e4]
cmp ecx, ebx
jne 0x402609
xor edx, edx
jmp 0x40260b
mov edx, dword [ecx]
test dl, 6
je 0x402620
push eax
push edi
push str._s:_Failed_to_start_saplgpad.exe__rc___d____Use_SAP_Logon
push ecx
call sub.sapfewtr.dll_FEWTraceWarning
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
jmp 0x402423
cmp eax, ebx
jne 0x402642
xor ecx, ecx
jmp 0x402644
mov ecx, dword [eax]
test cl, 4
je 0x402658
push edi
push str._s:_saplogon.exe_running
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x402788
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [0x45d0e4]
cmp ecx, ebx
jne 0x402691
xor edx, edx
jmp 0x402693
mov edx, dword [ecx]
test dl, 6
je 0x4026a8
push eax
push edi
push str._s:_Failed_to_start_saplogon.exe__rc___d____Use_SAP_Logon_Pad
push ecx
call sub.sapfewtr.dll_FEWTraceWarning
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x402788
call esi
push eax
push edi
push str._s:_Failed_to_start_both_saplgpad.exe_and_saplogon.exe__rc___d____No_delegation
push dword [0x45d0e4]
call sub.sapfewtr.dll_FEWTraceError
add esp, 0x10
push 2
pop esi
jmp 0x40244b
cmp eax, ebx
jne 0x4026f2
xor ecx, ecx
jmp 0x4026f4
mov ecx, dword [eax]
test cl, 4
je 0x402708
push edi
push str._s:_Delegation_option:_SAP_Logon_Pad
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x402788
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s:_Failed_to_start_saplgpad.exe__rc___d____No_delegation
jmp 0x40243d
cmp eax, ebx
jne 0x402741
xor ecx, ecx
jmp 0x402743
mov ecx, dword [eax]
test cl, 4
je 0x402757
push edi
push str._s:_Delegation_option:_SAP_Logon
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x402788
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s:_Failed_to_start_saplogon.exe__rc___d____No_delegation
jmp 0x40243d
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x38], ebx
je 0x402798
push dword [ebp - 0x38]
call esi
cmp dword [ebp - 0x34], ebx
je 0x4027a2
push dword [ebp - 0x34]
call esi
xor esi, esi
jmp 0x40244b