Function at 0x42f1ea
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call fcn.0043d81c
test al, al
je 0x42f224
aas
mov ah, 0x5c
imul eax, dword [0xd0942a28], 0x3d
inc esi
or al, 0xca
jae 0x42f245
invalid
lea eax, [ebp - 0xc]
mov esi, 0xf01ff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42f355
lea eax, [ebp - 0x14]
in al, dx
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x42f355
push str.Kernel32.dll
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42f2a7
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42f2a0
sal byte [esi + ebx - 1], 0xd0
call eax
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x42f358
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.0043d342
test al, al
je 0x42f2c4
xlatb
sub esp, dword [edx]
sahf
cmc
invalid
call fcn.0043d5f4
test al, al
je 0x42f2e9
cli
les eax, [ecx]
and dword [esi + eax], ecx
aas
dec eax
cmp al, 0x3b
adc ch, dl
fucomi st(0)
dec ebp
mov word [esi], ds
rcl dword [eax + edi], cl
cli
invalid
call fcn.0043d81c
test al, al
je 0x42f307
dec edi
cmp al, cl
jnp 0x42f27f
push ecx
push ds
mov dword [0x84b837d4], eax
cmpsd dword [esi], dword es:[edi]
ljmp 0xb60d
xor ebx, ebx
push str.Wtsapi32.dll
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x42f46d
push 0x5a81d0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42f3a8
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push ecx
push dword [ebp - 0x18]
call eax
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
push dword [ebp - 0x10]
test eax, eax
jne 0x42f3a2
invalid
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], ebx
call fcn.0043d6c3
test al, al
je 0x42f372
lahf
or ebx, edi
scasb al, byte es:[edi]
mov dl, cl
loop 0x42f370
jne 0x42f3ce
fbstp tbyte [eax]
in eax, dx
stosb byte es:[edi], al
jne 0x42f376
add eax, 0xec458b05
add eax, 0x85ec458b
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x42f385
sal byte [esp + ecx - 0x7d], 0xf8
push dword [edi + eax + 0x50]
cmp eax, 0xffffffff
je 0x42f385
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x42f398
cmp ecx, 0xffffffff
je 0x42f398
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0043d411
test al, al
je 0x42f3d2
jnp 0x42f346
imul edi, dword [ecx - 0x301e81ee], 0x3b8eb31d
sti
mov eax, dword [0x618a017f]
mov dh, 0xf7
xchg esp, eax
mov ecx, 0xf05b1e43
enter 0xffffffffffffb6d6, 0x21
mov dh, 0x21
xor ebx, ebx
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00446360
push 0x10
add byte [edx + 0x10], ch
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.00446360
add esp, 0x18
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], str.WinSta0Default
mov dword [ebp - 0x40], 1
push 5
pop eax
mov word [ebp - 0x3c], ax
call fcn.0043d81c
test al, al
je 0x42f42d
rol byte [ebp - 0x6d], 0xcd
je 0x42f3df
inc ecx
xor dword [0xf85cb421], 0x41b802f
sub esi, dword [eax + 0x15b441b0]
push ss
into
push 0x33
fisttp dword [ebp - 0x72af27bb]
inc ebp
xchg esp, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 8]
push 0x430
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x42f355
cmp dword [ebp - 8], 0
je 0x42f464
push dword [ebp - 8]
call sub.USERENV.dll_DestroyEnvironmentBlock
mov byte [ebp - 4], 1
jmp 0x42f358
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x42f3a8
push dword [ebp - 0xc]
jmp 0x42f34f