Function at 0x4050f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e651b
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x50b0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x94], 0
push eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x9c], 0
push eax
push 1
xor edi, edi
push edi
push edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
test eax, eax
jne 0x405167
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_enumerate_sessons___d__n
call fcn.00406230
add esp, 8
or edi, 0xffffffff
jmp 0x4051be
push dword [ebp - 0x9c]
push str.session_count:__d_n
call fcn.00406230
mov edx, dword [ebp - 0x9c]
add esp, 8
mov esi, dword [ebp - 0x94]
xor eax, eax
test edx, edx
je 0x4051b8
lea ecx, [esi + 8]
nop
cmp dword [ecx], edi
je 0x40519e
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x405190
jmp 0x4051b8
lea eax, [eax + eax*2]
mov edi, dword [esi + eax*4]
push edi
push str.Found_active_session__d_n
call fcn.00406230
mov esi, dword [ebp - 0x94]
add esp, 8
push esi
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0x164], 0x4eb0a8
mov dword [ebp - 0x154], 0x4eb0b0
mov dword [ebp - 0xfc], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push 0
lea eax, [ebp - 0x14c]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x94], 1
call fcn.004026e0
mov eax, dword [ebp - 0x164]
push 8
mov dword [ebp - 4], 1
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x168], eax
mov dword [ebp - method.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004bf24b
mov esi, eax
add esp, 4
test esi, esi
je 0x405266
push 1
mov byte [ebp - 4], 2
call fcn.004ab76b
add esp, 4
mov dword [esi + 4], eax
jmp 0x405268
xor esi, esi
lea eax, [ebp - 0x148]
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x144]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x134]
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x124]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
push 0x44
lea eax, [ebp - 0x1a8]
mov dword [ebp - 4], 3
push 0
push eax
call fcn.004c20c0
add esp, 0xc
lea ecx, [ebp - 0x90]
xorps xmm0, xmm0
movups xmmword [ebp - 0xb4], xmm0
call fcn.00402b70
mov byte [ebp - 4], 4
mov dword [ebp - 0xa0], 0
test edi, edi
jne 0x405363
push 0x4eb0b8
call fcn.00406230
add esp, 4
jmp 0x405584
lea eax, [ebp - 0x154]
push str.ie4uinit__show
push eax
call fcn.00401390
add esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x164]
push eax
call fcn.0040de80
mov eax, dword [eax + 0x10]
lea eax, [eax*2 + 2]
push eax
call fcn.004c4c06
add esp, 4
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00403870
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x164]
call fcn.0040de80
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x164]
call fcn.0040de80
cmp dword [eax + 0x14], 8
jb 0x4053d3
mov eax, dword [eax]
mov ecx, dword [ebp - 0x94]
push dword [ecx + 0x10]
push eax
push esi
call fcn.004c9354
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00403870
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.00403870
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x164]
call fcn.0040de80
xor ecx, ecx
mov eax, dword [eax + 0x10]
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x40]
call fcn.00403870
lea eax, [ebp - 0x98]
push eax
push edi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x405448
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.Failed_to_get_token__d_n
call fcn.00406230
add esp, 8
or edi, 0xffffffff
jmp 0x405555
push 1
push dword [ebp - 0x98]
lea eax, [ebp - 0xa0]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x40547d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.Failed_to_create_environment_block___d__n
call fcn.00406230
add esp, 8
or edi, 0xffffffff
jmp 0x405555
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x1a8]
push eax
push 0
push dword [ebp - 0xa0]
push 0x410
push 0
push 0
push 0
push esi
push 0
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4054d0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push edi
push esi
push str.Failed_to_create_process_as_session_id:__s___d__d__n
call fcn.00406230
add esp, 0x10
or edi, 0xffffffff
jmp 0x405555
push 0x2710
push dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x4054f8
push str.Failed_to_wait_single_object_n
call fcn.00406230
add esp, 4
or edi, 0xffffffff
jmp 0x405555
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x405529
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.Failed_to_get_exit_code_for_installer_process___d__n
call fcn.00406230
add esp, 8
or edi, 0xffffffff
jmp 0x405555
push dword [ebp - 0xb4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0xb0]
call edi
push dword [ebp - 0xa4]
push esi
push str._s_exit_with_code__d_n
call fcn.00406230
add esp, 0xc
xor edi, edi
test esi, esi
je 0x405562
push esi
call fcn.004c4beb
add esp, 4
mov eax, dword [ebp - 0x98]
cmp eax, 0xffffffff
je 0x405574
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x405584
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
lea ecx, [ebp - 0x90]
call fcn.00403b90
lea ecx, [ebp - 0x164]
call fcn.00404300
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf6e8
mov esp, ebp
pop ebp
ret