Function at 0x43ef62
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x2b0
mov eax, dword [0x48644c]
xor eax, ebp
mov dword [ebp + 0x22c], eax
mov eax, dword [ebp + 0x23c]
push ebx
mov ebx, dword [ebp + 0x238]
push esi
push edi
lea ecx, [ebp + 0x10]
mov dword [ebp + 4], eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push esi
push eax
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
mov dword [ebp], esi
mov dword [ebp + 8], esi
call sub.MSVCR80.dll_memset
xor eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
xor eax, eax
add esp, 0xc
cmp word [ebx], 0x22
mov dword [ebp - 0x80], 0x44
setne al
mov edi, eax
cmp edi, esi
je 0x43eff4
push 0x4738b0
lea ecx, [ebp + 0x10]
call dword [0x46c2d8]
push ebx
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp edi, esi
je 0x43f010
push 0x4738b0
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [ebp + 4], esi
je 0x43f02f
push 0x46d808
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push dword [ebp + 4]
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [ebp]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push eax
call ebx
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x43f05d
mov dword [ebp + 0xc], 0xfffffff9
jmp 0x43f2d8
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp]
mov dword [ebp - 0x3c], esi
call fcn.00431e31
add esp, 0x10
test eax, eax
jne 0x43f085
mov dword [ebp + 0xc], 0xfffffff8
jmp 0x43f2d8
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.00431cba
test eax, eax
pop ecx
je 0x43f122
lea eax, [ebp - 0x2c]
push eax
call fcn.004329ea
test eax, eax
pop ecx
jne 0x43f0b2
mov dword [ebp + 0xc], 0xfffffffe
jmp 0x43f2d8
push dword [ebp - 0x2c]
lea eax, [ebp - 0x18]
push eax
call fcn.00432a8e
test eax, eax
pop ecx
pop ecx
jne 0x43f0d0
mov dword [ebp + 0xc], 0xfffffffd
jmp 0x43f2d8
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x43f2d8
lea ecx, [ebp + 8]
push ecx
push 0xf01ff
push eax
call ebx
push dword [ebp - 8]
call edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x43f2be
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x34], esi
call fcn.00431b34
add esp, 0xc
test eax, eax
je 0x43f2d1
cmp dword [ebp - 0x30], 2
jne 0x43f29f
cmp dword [ebp - 0xc], 6
jb 0x43f29f
push 1
push str.SeIncreaseQuotaPrivilege
push dword [ebp]
call fcn.00431cdb
add esp, 0xc
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, esi
jne 0x43f183
mov dword [ebp + 0xc], 0xfffffff6
jmp 0x43f2d8
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0x43f1a1
mov dword [ebp + 0xc], 0xfffffff5
jmp 0x43f2d8
push dword [ebp - 8]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x43f1c3
mov dword [ebp + 0xc], 0xfffffff3
jmp 0x43f2d8
lea ecx, [ebp + 4]
push ecx
push 2
push eax
mov dword [ebp + 4], esi
call ebx
test eax, eax
je 0x43f298
lea eax, [ebp + 8]
push eax
push 1
push 2
push esi
push 0x18b
push dword [ebp + 4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x43f293
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
mov dword [ebp - 0x38], eax
je 0x43f293
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, esi
je 0x43f28a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push esi
push esi
push dword [ebp + 8]
call ebx
cmp eax, esi
jne 0x43f27d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x422
jne 0x43f28a
push 3
push str.seclogon
call fcn.0043ecc3
test eax, eax
pop ecx
pop ecx
je 0x43f28a
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push esi
push esi
push dword [ebp + 8]
call ebx
cmp eax, esi
je 0x43f28a
push dword [ebp - 0x24]
call edi
push dword [ebp - 0x28]
call edi
mov dword [ebp + 0xc], esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp + 4]
call edi
push dword [ebp - 0x10]
call edi
jmp 0x43f2d8
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43f2d8
push dword [ebp - 0x24]
call edi
push dword [ebp - 0x28]
call edi
mov dword [ebp + 0xc], esi
jmp 0x43f2d8
mov dword [ebp + 0xc], 0xfffffff4
cmp dword [ebp], esi
je 0x43f2e2
push dword [ebp]
call edi
cmp dword [ebp + 8], esi
je 0x43f2ec
push dword [ebp + 8]
call edi
cmp dword [ebp - 4], esi
je 0x43f2fa
push dword [ebp - 4]
call sub.MSVCR80.dll_free
pop ecx
push 0x1fe
lea eax, [ebp + 0x2e]
push esi
push eax
mov word [ebp + 0x2c], si
call sub.MSVCR80.dll_memset
push dword [ebp + 0xc]
lea eax, [ebp + 0x2c]
push str.from1ver0.3errcode_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.00435452
mov ecx, dword [ebp - 0x10]
cmp ecx, esi
je 0x43f33b
mov eax, dword [ecx]
push str.duba_createprocess_by_svc
call dword [eax + 0xc]
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0043ed68
pop ecx
pop ecx
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
mov edi, dword [ebp - 0x10]
cmp edi, esi
je 0x43f376
mov edx, dword [edi]
push eax
push 0x4737bc
mov ecx, edi
call dword [edx + 0x18]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x20]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp + 0x22c]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ec6
add ebp, 0x230
leave
ret