Function at 0x4dbbc9
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Enumerate processes

Disassembly:
push ebp
sub esp, 0x264
lea ebp, [esp - 4]
mov eax, dword [0x59d300]
xor eax, ebp
mov dword [ebp + 0x264], eax
push 0x128
mov eax, 0x520c75
call fcn.00506664
mov eax, dword [ebp + 0x270]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x28], bl
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4dbe79
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
push esi
push 0x543368
lea eax, [ebp - 0xd8]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___app_name
push eax
mov dword [ebp - 4], ebx
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040b612
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 1
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe0]
call fcn.0040c22b
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dbfae
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
push dword [ebp - 0x50]
lea eax, [ebp - 0xd8]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___parameters
push eax
mov dword [ebp - 4], 9
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040b612
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0xa
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe0]
call fcn.0040c22b
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dc0e7
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
push dword [ebp + 0x274]
lea eax, [ebp - 0xd8]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___session_id
push eax
mov dword [ebp - 4], 0x12
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.00408e51
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x13
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xe0]
call fcn.0040c22b
or dword [ebp - 0x4c], 0xffffffff
xor eax, eax
xor ecx, ecx
mov edi, 0x54331c
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x54], eax
mov dword [ebp + 0x244], 7
mov dword [ebp + 0x240], eax
mov word [ebp + 0x230], cx
push eax
push 2
mov dword [ebp - 4], 0x1b
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4dc32b
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4dc219
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xd8]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___CreateToolhelp32Snapshot_failed.
push eax
mov byte [ebp - 4], 0x1c
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
mov byte [ebp - 4], 0x1d
lea edi, [ebp + 0x248]
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x1b
call fcn.0040c22b
push 0
push 1
lea esi, [ebp + 0x22c]
call fcn.0040dac5
mov eax, 0x3eb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x264]
xor ecx, ebp
call fcn.004ffa47
add ebp, 0x268
leave
ret
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 4], 2
call fcn.0040b935
mov byte [ebp - 4], 3
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x4dbeac
mov edi, dword [eax + 4]
jmp 0x4dbeaf
lea edi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push edi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___app_name
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040b612
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.0040dac5
lea eax, [ebp - 0x24]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dbf5c
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0xc3
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 2
call fcn.0040b8a0
or dword [ebp - 4], 0xffffffff
jmp 0x4dbc82
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 4], 0xb
call fcn.0040b935
mov byte [ebp - 4], 0xc
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x18], 8
jb 0x4dbfe1
mov esi, dword [eax + 4]
jmp 0x4dbfe4
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___parameters
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x50]
push eax
call fcn.0040b612
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0xc
call fcn.0040dac5
lea eax, [ebp - 0x24]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xe
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dc095
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0xc4
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xc
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0xb
call fcn.0040b8a0
or dword [ebp - 4], 0xffffffff
jmp 0x4dbd09
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 4], 0x14
call fcn.0040b935
mov byte [ebp - 4], 0x15
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x18], 8
jb 0x4dc11a
mov esi, dword [eax + 4]
jmp 0x4dc11d
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___session_id
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp + 0x274]
push eax
call fcn.00408e51
push 0
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x15
call fcn.0040dac5
lea eax, [ebp - 0x24]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x17
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dc1cf
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0xc5
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x18
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x15
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x14
call fcn.0040b8a0
jmp 0x4dbd91
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x1e
call fcn.0040b935
mov byte [ebp - 4], 0x1f
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x18], 8
jb 0x4dc249
mov esi, dword [eax + 4]
jmp 0x4dc24c
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push edi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___CreateToolhelp32Snapshot_failed.
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x1f
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x21
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dc2e1
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0xd4
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x22
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1f
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0xd8]
call fcn.0040b8a0
jmp 0x4dbe42
lea eax, [ebp]
push eax
push esi
mov dword [ebp], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4dc493
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dc38c
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xd8]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___Process32First_failed.
push eax
mov byte [ebp - 4], 0x25
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
mov byte [ebp - 4], 0x26
jmp 0x4dbe1d
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x27
call fcn.0040b935
mov byte [ebp - 4], 0x28
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x29
cmp dword [eax + 0x18], 8
jb 0x4dc3bc
mov esi, dword [eax + 4]
jmp 0x4dc3bf
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push edi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___Process32First_failed.
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x28
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x2a
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dc454
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0xda
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x2b
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x28
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
mov byte [ebp - 4], 0x27
jmp 0x4dc2f1
lea eax, [ebp + 0x24]
push str.explorer.exe
push eax
call fcn.00500f36
pop ecx
pop ecx
test eax, eax
jne 0x4dc798
and dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4dc798
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0x274]
jne 0x4dc798
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4c], ebx
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dc664
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
push ebx
push 0x543368
lea eax, [ebp - 0xd8]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___winlogonPid
push eax
mov byte [ebp - 4], 0x2e
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.00408e51
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x2f
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x1b
call fcn.0040c22b
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x134]
push 0
push eax
mov dword [ebp - 0x20], 0x30
call fcn.005060b0
xor eax, eax
lea edi, [ebp - 0xf0]
stosd dword es:[edi], eax
add esp, 0xc
push dword [ebp - 0x4c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
mov esi, 0x2000000
push esi
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x12c], str.winsta0default
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x54]
push ecx
push 0x201eb
push eax
mov dword [ebp - 0x4c], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4dca71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dc946
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
mov byte [ebp - 4], 0x40
push dword [ebp - 0x1c]
lea eax, [ebp - 0xd8]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___OpenProcessToken_failed
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004126c3
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x41
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x1b
call fcn.0040c22b
push dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x48]
call esi
push dword [ebp - 0x54]
call esi
mov edi, dword [ebp - 0x1c]
jmp 0x4dc81e
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x30
call fcn.0040b935
mov byte [ebp - 4], 0x31
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x32
cmp dword [eax + 0x18], 8
jb 0x4dc694
mov esi, dword [eax + 4]
jmp 0x4dc697
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push edi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___winlogonPid
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push eax
call fcn.00408e51
push 0
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x31
call fcn.0040dac5
lea eax, [ebp - 0x24]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x33
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dc740
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0xe4
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x34
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x31
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x30
call fcn.0040b8a0
mov dword [ebp - 4], 0x1b
jmp 0x4dc558
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4dc493
test bl, bl
jne 0x4dc558
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4dc834
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xd8]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___didnt_get_winlogonPid.
push eax
mov byte [ebp - 4], 0x37
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x38
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x1b
call fcn.0040c22b
mov edi, 0x3eb
push 0
push 1
lea esi, [ebp + 0x22c]
call fcn.0040dac5
mov eax, edi
jmp 0x4dbe56
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x39
call fcn.0040b935
mov byte [ebp - 4], 0x3a
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x3b
cmp dword [eax + 0x18], 8
jb 0x4dc864
mov esi, dword [eax + 4]
jmp 0x4dc867
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push edi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___didnt_get_winlogonPid.
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x3a
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x3c
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dc8fc
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0xec
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x3d
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x3a
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x39
call fcn.0040b8a0
jmp 0x4dc819
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x42
call fcn.0040b935
mov byte [ebp - 4], 0x43
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], bl
cmp dword [eax + 0x18], 8
jb 0x4dc975
mov esi, dword [eax + 4]
jmp 0x4dc978
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___OpenProcessToken_failed
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x1c]
push eax
call fcn.004126c3
push 0
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x43
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x45
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dca27
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0xfb
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x46
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x43
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x42
call fcn.0040b8a0
jmp 0x4dc647
lea eax, [ebp - 0x48]
push eax
xor edi, edi
inc edi
push edi
push edi
xor ebx, ebx
push ebx
push esi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4dcc41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
call fcn.0040dbda
cmp byte [eax], bl
jne 0x4dcb19
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
mov byte [ebp - 4], 0x49
push dword [ebp - 0x1c]
lea eax, [ebp - 0xd8]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___DuplicateTokenEx_failed
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004126c3
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x4a
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x1b
call fcn.0040c22b
jmp 0x4dc647
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x4b
call fcn.0040b935
mov byte [ebp - 4], 0x4c
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x4d
cmp dword [eax + 0x18], 8
jb 0x4dcb49
mov esi, dword [eax + 4]
jmp 0x4dcb4c
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___DuplicateTokenEx_failed
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x1c]
push eax
call fcn.004126c3
push ebx
push edi
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x4c
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x4e
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dcbf7
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0x101
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x4f
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push edi
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x4c
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x4b
call fcn.0040b8a0
jmp 0x4dcb14
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, 0x514
jne 0x4dcdd7
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dccc3
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0xd8]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___we_got_ERROR_NOT_ALL_ASSIGNED
push eax
mov byte [ebp - 4], 0x52
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x53
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x1b
call fcn.0040c22b
jmp 0x4dc647
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x54
call fcn.0040b935
mov byte [ebp - 4], 0x55
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x56
cmp dword [eax + 0x18], 8
jb 0x4dccf3
mov esi, dword [eax + 4]
jmp 0x4dccf6
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___we_got_ERROR_NOT_ALL_ASSIGNED
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x55
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x57
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dcd8d
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0x107
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x58
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x55
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x54
call fcn.0040b8a0
jmp 0x4dccbe
push 1
push dword [ebp - 0x48]
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x58], ebx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4dcdf5
mov dword [ebp - 0x20], 0x430
jmp 0x4dcdf8
mov dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x14]
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x22c]
call fcn.0040bd91
push 0x54199c
lea eax, [ebp + 0x22c]
push eax
call fcn.0040b547
mov eax, dword [ebp - 0x50]
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 0x22c]
call fcn.0040b405
mov eax, dword [ebp + 0x240]
xor ecx, ecx
push 2
add eax, 0xa
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ff331
cmp dword [ebp + 0x244], 8
pop ecx
mov ecx, dword [ebp + 0x230]
mov esi, eax
jae 0x4dce60
lea ecx, [ebp + 0x230]
mov edx, esi
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, bx
jne 0x4dce62
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x134]
push eax
push ebx
push dword [ebp - 0x58]
push dword [ebp - 0x20]
push ebx
push ebx
push ebx
push esi
push ebx
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x4dceb6
cmp byte [ebp - 0x28], 0
je 0x4dceb6
push 0xffffffffffffffff
push dword [ebp - 0xf0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call fcn.004ffb17
pop ecx
call edi
mov dword [ebp - 0x1c], eax
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dcfd1
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
mov byte [ebp - 4], 0x5b
cmp dword [ebp - 0x20], ebx
setne al
movzx eax, al
push eax
push 0x543368
lea eax, [ebp - 0xd8]
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___bResult
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004177b8
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x5c
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x1b
call fcn.0040c22b
call fcn.0040dbda
cmp byte [eax], 0
jne 0x4dd110
lea eax, [ebp - 0xe0]
push eax
call fcn.0040d9e1
mov byte [ebp - 4], 0x64
push dword [ebp - 0x1c]
lea eax, [ebp - 0xd8]
push 0x543368
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___error
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push eax
call fcn.004126c3
lea eax, [ebp + 0x248]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040bf31
lea edi, [ebp + 0x248]
mov byte [ebp - 4], 0x65
call fcn.0040ba4e
push 0
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 0x1b
call fcn.0040c22b
jmp 0x4dc647
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x5d
call fcn.0040b935
mov byte [ebp - 4], 0x5e
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x5f
cmp dword [eax + 0x18], 8
jb 0x4dd001
mov esi, dword [eax + 4]
jmp 0x4dd004
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___bResult
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
cmp dword [ebp - 0x20], ebx
pop ecx
pop ecx
setne cl
movzx ecx, cl
push ecx
push eax
call fcn.004177b8
push ebx
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x5e
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x60
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dd0b8
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0x136
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x61
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x5e
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x5d
call fcn.0040b8a0
mov dword [ebp - 4], 0x1b
jmp 0x4dcf4a
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x66
call fcn.0040b935
mov byte [ebp - 4], 0x67
call fcn.0040dbda
lea ecx, [ebp - 0x44]
call fcn.0040b84b
mov byte [ebp - 4], 0x68
cmp dword [eax + 0x18], 8
jb 0x4dd140
mov esi, dword [eax + 4]
jmp 0x4dd143
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CLocalSystemCommands::LaunchAppIntoDifferentSessionFromService___error
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543368
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push dword [ebp - 0x1c]
push eax
call fcn.004126c3
push 0
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 0x67
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x69
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4dd1f2
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040b831
push 0x137
push str..LocalSystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x6a
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x67
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x66
call fcn.0040b8a0
jmp 0x4dc647