Function at 0x1003972
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x940
mov eax, dword [0x10070b8]
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [eax], ebx
cmp dword [edi + 0x48], ebx
mov dword [ebp - 0x8e8], eax
je 0x10039ae
push dword [edi]
push 0x1001a48
push ebx
push 0x269
jmp 0x10039e1
lea eax, [ebp - 0x8fc]
push eax
push 0x4c0
lea eax, [ebp - 0x8d8]
push eax
push 8
push dword [edi]
push ecx
call sub.WINSTA.dll_WinStationQueryInformationW
test al, al
jne 0x10039f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10019e8
push ebx
push 0x274
push 0x1001470
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x14
xor eax, eax
jmp 0x1003cca
push esi
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x474]
push eax
push 0x10019b0
push ebx
push 0x27c
mov esi, 0x1001470
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x1c
lea eax, [ebp - 0x8e0]
push eax
push dword [edi]
call fcn.0100589f
test eax, eax
jne 0x1003a8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6a6
jne 0x1003a67
cmp dword [edi], ebx
jne 0x1003a6b
push 0xf01ff
push 0x10019a0
call fcn.0100593e
cmp eax, ebx
mov dword [ebp - 0x8e0], eax
jne 0x1003a65
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1003a67
xor eax, eax
cmp eax, ebx
je 0x1003a8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001948
push ebx
push 0x296
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x14
xor eax, eax
jmp 0x1003cc9
lea eax, [ebp - 0x8dc]
push eax
push 1
push 2
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1003abe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10018f8
push ebx
push 0x29e
jmp 0x1003a7d
xor eax, eax
lea edi, [ebp - 0x8f8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x940]
rep stosd dword es:[edi], eax
push 0x10018d0
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x940], 0x44
mov word [ebp - 0x910], 5
mov dword [ebp - 0x938], 0x10018b0
call fcn.01005a63
test al, al
jne 0x1003b19
push 0x1001868
push ebx
push 0x2aa
jmp 0x1003c2d
lea eax, [ebp - 0x8f8]
push eax
lea eax, [ebp - 0x940]
push eax
mov eax, dword [0x1007300]
push ebx
push ebx
push 8
push ebx
push ebx
push ebx
push dword [eax]
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x8dc]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1003b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1001808
push ebx
push 0x2be
jmp 0x1003c87
mov eax, dword [ebp - 0x8e8]
mov dword [eax], 1
push 0x493e0
lea eax, [ebp - 0x8e4]
push eax
push dword [ebp - 0x8f8]
call fcn.010037c6
cmp eax, ebx
je 0x1003ba9
cmp eax, 0x102
je 0x1003ba9
push eax
push 0x10017cc
push ebx
push 0x2c6
jmp 0x1003a7d
cmp dword [ebp - 0x8e4], ebx
je 0x1003bc8
push dword [ebp - 0x8e4]
push eax
push 0x1001780
push ebx
push 0x2cb
jmp 0x1003c87
xor eax, eax
lea edi, [ebp - 0x8f8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0x11
pop ecx
lea edi, [ebp - 0x940]
rep stosd dword es:[edi], eax
mov eax, dword [0x1007300]
mov dword [ebp - 0x940], 0x44
mov word [ebp - 0x910], 5
mov dword [ebp - 0x938], 0x10018b0
mov eax, dword [eax + 0x20]
cmp eax, ebx
je 0x1003cb2
lea ecx, [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x210]
push ecx
call eax
test eax, eax
jne 0x1003c3b
push 0x1001740
push ebx
push 0x2dc
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x10
jmp 0x1003a86
lea eax, [ebp - 0x8f8]
push eax
lea eax, [ebp - 0x940]
push eax
push ebx
push ebx
push 8
push ebx
push ebx
push ebx
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x8dc]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1003c95
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1001808
push ebx
push 0x2ee
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x18
jmp 0x1003a86
lea eax, [ebp - 0x210]
push eax
push 0x10016e8
push ebx
push 0x2f3
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x14
jmp 0x1003cc6
push 0x1001698
push ebx
push 0x2f5
push esi
call sub.SYSSETUP.dll_pSetupDebugPrint
add esp, 0x10
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01005458
leave
ret 0xc