Function at 0x4b5790
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
push esi
push edi
push 0x44
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c], edx
xorps xmm0, xmm0
mov dword [esp + 0x24], ecx
push 0
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x3c], xmm0
call fcn.005869c0
mov esi, dword [ebp + 0xc]
add esp, 0xc
cmp esi, 5
je 0x4b57fe
test esi, esi
je 0x4b58fe
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x4b583b
test esi, esi
je 0x4b58fe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
push ecx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4b5843
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x2d6
mov edx, 0x61e4cc
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4b5890
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x2d7
mov edx, 0x61e4ec
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp esi, 5
push 4
cmove eax, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 0xc
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x4b58ed
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x2d9
mov edx, 0x61e50c
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 2
mov eax, str.Winsta0Winlogon
cmovne eax, dword [esp + 0x50]
mov dword [esp + 0x50], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x4b59c3
mov eax, dword [edi]
test eax, eax
je 0x4b59c3
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x4b5923
mov dword [esp + 0xc], eax
jmp 0x4b59c3
xor esi, esi
mov eax, edi
xor ecx, ecx
mov dword [esp + 0x24], ecx
nop dword [eax]
mov eax, dword [eax]
test eax, eax
je 0x4b5948
push 0x104
push eax
call fcn.0058cca6
mov ecx, dword [esp + 0x2c]
add esp, 8
inc esi
inc eax
add ecx, eax
cmp dword [edi + esi*4], 0
mov dword [esp + 0x24], ecx
lea eax, [edi + esi*4]
jne 0x4b5930
lea eax, [esi - 1]
add eax, ecx
push eax
mov dword [esp + 0x30], eax
call fcn.0058d200
mov edx, dword [edi]
xor ecx, ecx
add esp, 4
mov dword [esp + 0xc], eax
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], 1
test edx, edx
je 0x4b59c3
push edx
test esi, esi
mov edx, 0x61e540
mov eax, 0x6234c7
cmovne eax, edx
push eax
mov eax, dword [esp + 0x34]
sub eax, ecx
push str._s_s
push eax
mov eax, dword [esp + 0x1c]
add eax, ecx
push eax
call fcn.00401140
mov ecx, dword [esp + 0x2c]
inc esi
add ecx, eax
add esp, 0x14
mov dword [esp + 0x18], ecx
mov edx, dword [edi + esi*4]
test edx, edx
jne 0x4b5985
push 0x44
call fcn.0058d200
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
je 0x4b5c90
push 0x44
push 0
push esi
call fcn.005869c0
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov dword [esi], 0x34
mov dword [esi + 4], 0
mov eax, dword [0x61c4d0]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
add esi, 0x10
cmp edi, 4
je 0x4b5a29
push edx
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004b53e0
mov edx, dword [ebp + 0x14]
add esp, 8
mov dword [esi + 0x20], eax
mov dword [eax + 0x1c], esi
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], ecx
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x30], eax
mov dword [esp + 0x48], 0x44
cmp edi, 4
je 0x4b5b28
push edx
push ecx
call fcn.004b53e0
add esp, 8
mov dword [esi + 0x18], eax
mov dword [eax + 0x1c], esi
push dword [ebp + 0x14]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004b53e0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 8
mov dword [esi + 0x1c], eax
mov dword [eax + 0x1c], esi
mov eax, dword [esi + 0x18]
mov esi, dword [eax + 0x3c]
add eax, 0x3c
push 2
push 0
push 0
push eax
call edi
push eax
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
push 2
push 0
push 0
mov eax, dword [ecx + 0x2c]
add eax, 0x38
push eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
push 2
push 0
push 0
mov eax, dword [eax + 0x30]
add eax, 0x38
push eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov edi, dword [ebp + 0xc]
add esi, 0x10
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x3c]
mov dword [esp + 0x88], eax
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x38]
mov dword [esp + 0x80], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x3c]
or dword [esp + 0x74], 0x100
mov dword [esp + 0x84], eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
push dword [esp + 0x2c]
push dword [esp + 0x4c]
test edi, edi
jne 0x4b5bf2
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4b5c09
cmp dword [esp + 0x24], 0
je 0x4b5b72
push dword [esp + 0xc]
call fcn.0058bf82
add esp, 4
cmp edi, 4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4b5bb3
mov eax, dword [esi + 0x1c]
push dword [eax + 0x3c]
call edi
mov eax, dword [esi + 0x1c]
mov dword [eax + 0x3c], 0
mov eax, dword [esi + 0x20]
push dword [eax + 0x3c]
call edi
mov eax, dword [esi + 0x20]
mov dword [eax + 0x3c], 0
mov eax, dword [esi + 0x18]
push dword [eax + 0x38]
call edi
mov eax, dword [esi + 0x18]
mov dword [eax + 0x38], 0
mov eax, dword [esp + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4b5bc5
push eax
call edi
mov eax, dword [esp + 0x38]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b5bdf
push eax
call edi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b5bea
push eax
call edi
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x4b5b5f
cmp edi, 4
je 0x4b5c21
mov ecx, dword [esi + 0x20]
call fcn.004b52e0
mov ecx, dword [esi + 0x1c]
call fcn.004b52e0
mov ecx, dword [esi + 0x18]
call fcn.004b52e0
cmp dword [esp + 0x24], 0
je 0x4b5c34
push dword [esp + 0xc]
call fcn.0058bf82
add esp, 4
mov ecx, esi
call fcn.004ae5d0
test eax, eax
je 0x4b5c68
cmp dword [esi - 4], 0
jne 0x4b5c68
cmp dword [esi - 0xc], 0
jbe 0x4b5c55
mov eax, dword [esi - 0x10]
xorps xmm0, xmm0
movups xmmword [eax + esi], xmm0
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push eax
movups xmmword [eax], xmm0
call fcn.0058bf82
add esp, 4
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4b5c79
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b583b
push eax
call esi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x46d
mov edx, 0x61c474
xor ecx, ecx
call fcn.004b47e0
add esp, 0xc
push 0x46d
push 0x61c490
push 0x61c4ac
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.00587d2d
int3