Function at 0x4a56f3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
push esi
push edi
lea ecx, [ebp - 0x3c]
mov ebx, eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x4c], esi
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x90]
push esi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
call sub.MSVCR80.dll_memset
xor eax, eax
inc eax
mov dword [ebp - 0x68], eax
mov word [ebp - 0x64], ax
xor eax, eax
add esp, 0xc
cmp word [ebx], 0x22
mov dword [ebp - 0x94], 0x44
setne al
mov edi, eax
cmp edi, esi
je 0x4a576c
push 0x510ad8
lea ecx, [ebp - 0x3c]
call dword [0x4d95ec]
push ebx
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp edi, esi
je 0x4a5788
push 0x510ad8
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [ebp + 8], esi
je 0x4a57a7
push 0x510cd4
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push dword [ebp + 8]
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [ebp - 0x14]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push eax
call edi
test eax, eax
jne 0x4a57cf
mov dword [ebp - 8], 0xfffffff9
jmp 0x4a5a6d
lea eax, [ebp + 8]
push eax
push 1
push dword [ebp - 0x14]
lea ebx, [ebp - 0x20]
mov dword [ebp + 8], esi
call fcn.004a50c3
add esp, 0xc
test eax, eax
jne 0x4a57f6
mov dword [ebp - 8], 0xfffffff8
jmp 0x4a5a6d
mov eax, dword [ebp - 0x20]
push dword [eax]
call fcn.004a5032
test eax, eax
pop ecx
je 0x4a58a6
lea edi, [ebp - 0x10]
call fcn.004a52d6
test eax, eax
jne 0x4a5821
mov dword [ebp - 8], 0xfffffffe
jmp 0x4a5a6d
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
call fcn.004a5372
test eax, eax
pop ecx
pop ecx
jne 0x4a583f
mov dword [ebp - 8], 0xfffffffd
jmp 0x4a5a6d
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, esi
je 0x4a5a6d
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x4a587d
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4a5a6d
jmp 0x4a5a57
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call fcn.004a4f4f
add esp, 0xc
test eax, eax
je 0x4a5a66
cmp dword [ebp + 8], 2
jne 0x4a5a28
cmp dword [ebp - 0x18], 6
jb 0x4a5a28
push dword [ebp - 0x14]
call fcn.004a5053
pop ecx
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, esi
jne 0x4a58fe
mov dword [ebp - 8], 0xfffffff6
jmp 0x4a5a6d
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0x4a591c
mov dword [ebp - 8], 0xfffffff5
jmp 0x4a5a6d
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x4a593e
mov dword [ebp - 8], 0xfffffff3
jmp 0x4a5a6d
lea ecx, [ebp + 8]
push ecx
push 2
push eax
mov dword [ebp + 8], esi
call edi
test eax, eax
je 0x4a5a1d
lea eax, [ebp - 0xc]
push eax
push 1
push 2
push esi
push 0x18b
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4a5a14
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x4a5a14
push str.CreateProcessWithTokenW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x4a5a0d
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x4a59a4
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebp - 0xc]
call edi
cmp eax, esi
jne 0x4a59fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x422
jne 0x4a5a0d
call fcn.004a5b35
test eax, eax
je 0x4a5a0d
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x4a59e0
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebp - 0xc]
call edi
cmp eax, esi
je 0x4a5a0d
push dword [ebp - 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x4c]
call edi
mov dword [ebp - 8], esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a5a6d
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x4a5a34
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4a5a6d
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x48]
call edi
push dword [ebp - 0x4c]
call edi
mov dword [ebp - 8], esi
jmp 0x4a5a6d
mov dword [ebp - 8], 0xfffffff4
cmp dword [ebp - 0x14], esi
je 0x4a5a7b
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], esi
je 0x4a5a89
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x20], esi
je 0x4a5a98
push dword [ebp - 0x20]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
push 0x1fe
lea eax, [ebp - 0x292]
push esi
push eax
mov word [ebp - 0x294], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push dword [ebp - 8]
lea eax, [ebp - 0x294]
push str.from1ver0.3errcode_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [ebp - 0x1c]
call fcn.004038c8
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x4a5ae7
mov eax, dword [edi]
push str.duba_createprocess_by_svc
mov ecx, edi
call dword [eax + 0xc]
lea eax, [ebp - 0x294]
push eax
lea esi, [ebp - 0x1c]
call fcn.00431590
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
pop ecx
jae 0x4a5b03
lea eax, [ebp - 0x38]
test edi, edi
je 0x4a5b24
mov edx, dword [edi]
push eax
push 0x5125e0
mov ecx, edi
call dword [edx + 0x18]
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x20]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
lea ecx, [ebp - 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret