Function at 0x444bf2
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x404]
sub esp, 0x484
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x400], eax
push ebx
mov ebx, dword [ebp + 0x40c]
push esi
xor esi, esi
cmp ebx, esi
jne 0x444c22
xor eax, eax
jmp 0x444ddd
push edi
mov edi, 0x208
push edi
push ebx
call fcn.00465d05
cmp eax, edi
pop ecx
pop ecx
jl 0x444c3c
xor eax, eax
jmp 0x444ddc
xor eax, eax
push 0x410
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x12]
push esi
push eax
call fcn.00464d20
push edi
push ebx
lea eax, [ebp - 0x14]
push 0x209
push eax
call fcn.004667f9
add esp, 0x1c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call fcn.00404be0
lea ecx, [ebp - 0x24]
call fcn.0040a4c0
push esi
push str.firefox
lea ecx, [ebp - 0x24]
call fcn.00443f94
test eax, eax
jle 0x444cd0
xor eax, eax
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push esi
push eax
mov dword [ebp - 0x80], esi
call fcn.00464d20
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
jmp 0x444dcf
lea eax, [ebp - 0x20]
push eax
push 0x8b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp edi, esi
je 0x444dad
lea eax, [ebp - 0x18]
push eax
push 1
push 2
push esi
push esi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov edi, eax
cmp edi, esi
je 0x444dad
lea eax, [ebp - 0x1c]
push eax
push str.S_1_16_8192
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov edi, eax
cmp edi, esi
je 0x444dad
xor eax, eax
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x38], 0x20
mov dword [ebp - 0x3c], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x19
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov edi, eax
cmp edi, esi
je 0x444dad
xor eax, eax
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push esi
push eax
mov dword [ebp - 0x80], esi
call fcn.00464d20
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
cmp dword [ebp - 0x34], esi
je 0x444da3
push dword [ebp - 0x34]
call ebx
cmp dword [ebp - 0x30], esi
je 0x444dad
push dword [ebp - 0x30]
call ebx
cmp dword [ebp - 0x1c], esi
je 0x444dbb
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x18], esi
je 0x444dc5
push dword [ebp - 0x18]
call ebx
cmp dword [ebp - 0x20], esi
je 0x444dcf
push dword [ebp - 0x20]
call ebx
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004016d0
mov eax, edi
pop edi
mov ecx, dword [ebp + 0x400]
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x404
leave
ret