Function at 0x4165fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x206c
call fcn.00569440
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2008], edi
mov dword [ebp - 0x2014], eax
je 0x416972
call fcn.0042aae1
test al, al
je 0x416654
stc
or edi, esp
push ss
sub al, 0x69
wait
invalid
call fcn.0042aa57
test al, al
je 0x416673
hlt
xor ebx, ebx
lea eax, [ebp - 0x2004]
push 0x2000
push ebx
push eax
mov dword [ebp - 0x2010], ebx
mov dword [ebp - 0x200c], ebx
call fcn.0056f390
push dword [ebp - 0x2014]
lea eax, [ebp - 0x2004]
push edi
push str.__s___s
push eax
call fcn.00408d5e
add esp, 0x1c
call fcn.0042ab6b
test al, al
je 0x4166d8
popfd
iretd
push str.EXPLORER.EXE
call fcn.00415ade
pop ecx
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2018], eax
test eax, eax
je 0x4168c3
lea ecx, [ebp - 0x2010]
mov esi, 0xf01ff
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4168c3
lea eax, [ebp - 0x200c]
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4168c3
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41678a
push 0x5a3574
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x416783
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4168c3
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x206c]
push ebx
push eax
call fcn.0056f390
push 0x10
lea eax, [ebp - 0x2028]
push ebx
push eax
call fcn.0056f390
add esp, 0x18
mov dword [ebp - 0x206c], esi
call fcn.0042aa9c
test al, al
je 0x4167d0
jb 0x4167e1
invalid
call fcn.0042ad4e
test al, al
je 0x4167f5
retf 0x4191
xchg esp, eax
int3
call fcn.0042af76
test al, al
je 0x416813
mov edx, 0x9ad361a5
jns 0x4167a4
mov esp, 0xa479016d
dec eax
scasd eax, dword es:[edi]
mov dh, 0xa9
dec esi
add ecx, 0xffffffa3
push 5
pop eax
xor ebx, ebx
mov dword [ebp - 0x2064], str.WinSta0Default
mov word [ebp - 0x203c], ax
mov dword [ebp - 0x2040], 1
mov dword [ebp - 0x2008], ebx
call fcn.0042ab6b
test al, al
je 0x416863
fadd qword [edi - 0x52]
add byte [ebp - 0x6e], 0xa
jmp 0x4167e0
push ebx
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2008]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4168c3
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x206c]
push eax
push ebx
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push 0x430
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4168c3
cmp dword [ebp - 0x2008], 0
je 0x4168c3
push dword [ebp - 0x2008]
call sub.USERENV.dll_DestroyEnvironmentBlock
call fcn.0042aea7
test al, al
je 0x4168e8
cmp byte [ebx], bh
mov edi, 0x46cc979d
js 0x4168e7
fistp qword [esp + ecx*4 - 0x364d24bc]
fdivr dword [esi]
int3
out dx, al
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x4168fe
cmp eax, 0xffffffff
je 0x4168fe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042af76
test al, al
je 0x416922
and dword [esi], ebp
pop esi
jmp 0x4168be
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x416938
cmp eax, 0xffffffff
je 0x416938
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2018], 0
jne 0x416949
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042aea7
test al, al
je 0x41696e
stosb byte es:[edi], al
sbb al, 0x97
test eax, 0x97d98f59
cld
adc ebp, ebx
jne 0x416956
pop ecx
invalid
test al, 5
jno 0x4168f2
add eax, 0x80c0d65b
mov al, byte [0xccf60da6]
xor al, al
jmp 0x416987
push 0
push 0
push 0
push eax
push edi
call fcn.004162cc
add esp, 0x14
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret