Function at 0x409b90
Capabilities:
Create process on windows
Get session information
Get session user name
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417578
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x427024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0x80], 0
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x409c0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_get_ssid_:__d
push str.fxstd::fxwshelper
call fcn.00402740
add esp, 0xc
jmp 0x409ecf
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], esi
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x80]
push eax
push 5
push dword [ebp - 0x14]
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
jne 0x409c5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_query_session_info_:__d
push str.fxstd::fxwshelper
call fcn.00402740
add esp, 0xc
xor esi, esi
jmp 0x409ea9
mov edx, dword [ebp - 0x80]
cmp word [edx], 0
jne 0x409c67
xor ecx, ecx
jmp 0x409c7f
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409c70
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.00405240
push dword [ebp - 0x80]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x20], 0
jne 0x409cb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_get_ss_user_:__d
push str.fxstd::fxwshelper
call fcn.00402740
add esp, 0xc
xor esi, esi
jmp 0x409ea9
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x30]
push eax
call fcn.00405340
mov ecx, dword [ebp - 0x14]
call fcn.00409910
add esp, 0x18
test eax, eax
jne 0x409d0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_get_pid_:__d
push str.fxstd::fxwshelper
call fcn.00402740
add esp, 0xc
xor esi, esi
jmp 0x409ea9
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x409d3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_open_:__d
push str.fxstd::fxwshelper
call fcn.00402740
add esp, 0xc
xor esi, esi
jmp 0x409ea9
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
push 0x2000000
push edi
mov dword [ebp - 0x84], 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x409d8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_open_token_:__d
push str.fxstd::fxwshelper
call fcn.00402740
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x409ea9
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea eax, [ebp - 0x84]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x409dd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_open_dup_:__d
push str.fxstd::fxwshelper
call fcn.00402740
add esp, 0xc
push dword [ebp - 0x7c]
call edi
xor esi, esi
jmp 0x409ea9
push dword [ebp - 0x7c]
call edi
push 0x40
lea eax, [ebp - 0x74]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x94], xmm0
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0x30]
xor ecx, ecx
inc eax
mov dword [ebp - 0x78], 0x44
add esp, 0xc
mov dword [ebp - 0x4c], 1
mov edx, 2
mov word [ebp - 0x48], bx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00415dff
add esp, 4
lea ecx, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
mov ebx, eax
mov eax, dword [ebp + 0x30]
cmovae ecx, dword [ebp + 0x20]
test eax, eax
je 0x409e4b
push eax
push ecx
inc eax
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wmemcpy_s]
mov eax, dword [ebp + 0x30]
add esp, 0x10
xor ecx, ecx
mov word [ebx + eax*2], cx
lea ecx, [ebp - 0x94]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x78]
push ecx
push 0
push 0
push 0
push ebx
push eax
push 0
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x409e98
cmp dword [ebp - 0x8c], 0
je 0x409e98
push dword [ebp - 0x90]
call edi
mov esi, dword [ebp - 0x94]
push ebx
call fcn.00415b4c
add esp, 4
push dword [ebp - 0x84]
call edi
mov eax, dword [ebp - 0x1c]
cmp eax, 8
jb 0x409ebb
inc eax
push eax
push dword [ebp - 0x30]
call fcn.00405b30
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x409ee1
inc eax
push eax
push dword [ebp + 8]
call fcn.00405b30
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
cmp ecx, 8
jb 0x409f07
inc ecx
push ecx
push dword [ebp + 0x20]
call fcn.00405b30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415b3b
mov esp, ebp
pop ebp
ret