Function at 0x421e5a
Capabilities:
Create process on windows

Disassembly:
push 0x380
mov eax, 0x451808
call fcn.0044fbb5
mov esi, edx
mov dword [ebp - 0x298], esi
mov edi, ecx
mov dword [ebp - 0x28c], edi
call fcn.004236a4
push 4
mov ecx, eax
call fcn.0043a060
xor ebx, ebx
mov dword [ebp - 0x284], 0x18
test eax, eax
je 0x421ecd
call fcn.004236a4
mov ecx, eax
mov eax, dword [esi + 4]
sub eax, dword [esi]
cdq
idiv dword [ebp - 0x284]
push eax
push edi
push str.lpExePath:_s_param_size:_d
push str.CRemoteLauncher::Launch
push 0xda
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push ebx
push 4
push ebx
push ecx
call fcn.0043a100
add esp, 0x28
mov edi, dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
call edi
mov dword [ebp - 0x27c], eax
cmp eax, 0xffffffff
jne 0x421f36
call fcn.004236a4
push 3
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x421f26
call fcn.004236a4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.active_sid_invalid__try_later
push str.CRemoteLauncher::Launch
push 0xde
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push eax
push 3
push ebx
push esi
call fcn.0043a200
mov esi, dword [ebp - 0x298]
add esp, 0x20
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov dword [ebp - 0x27c], eax
cmp dword [ebp + 8], eax
je 0x421fed
call fcn.004236a4
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x421f80
call fcn.004236a4
push dword [ebp + 8]
push dword [ebp - 0x27c]
push str.sid_not_match__maybe_in_logon_session__active_sid__d___tray_sid__d_
push str.CRemoteLauncher::Launch
push 0xe4
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push ebx
push 4
push ebx
push eax
call fcn.0043a100
add esp, 0x28
mov dword [ebp - 0x290], ebx
lea ecx, [ebp - 0x290]
mov dword [ebp - 4], ebx
call fcn.00439850
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x27c]
call fcn.0041cdf2
mov byte [ebp - 4], 2
lea edx, [ebp - 0x58]
cmp dword [ebp - 0x44], 0x10
mov eax, dword [ebp - 0x290]
cmovae edx, dword [ebp - 0x58]
test eax, eax
je 0x421fd6
push dword [ebp - 0x48]
mov ecx, dword [eax]
push edx
push str.evtSessionNoEqual
push 0x45728c
push eax
call dword [ecx + 0x14]
lea ecx, [ebp - 0x58]
call fcn.004129af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.004205c5
push ecx
lea ecx, [ebp - 0x38c]
mov byte [ebp - 0x275], bl
call fcn.0042346a
mov edx, 0x45f59c
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x38c]
call fcn.004240c1
mov edi, dword [esi + 4]
mov esi, dword [esi]
jmp 0x422096
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x422027
mov edx, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x38c]
call fcn.00424688
pop ecx
mov edx, 0x45f59c
mov ecx, eax
call fcn.004240c1
mov edx, str.__joinmoderescue
mov ecx, esi
call fcn.00424249
test al, al
je 0x422091
mov byte [ebp - 0x275], 1
call fcn.004236a4
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x422091
call fcn.004236a4
push str.start_with_high_priority_for_rescue_mode_
push str.CRemoteLauncher::Launch
push 0xf2
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push ebx
push 4
push ebx
push eax
call fcn.0043a200
add esp, 0x20
push 0x18
pop eax
add esi, eax
cmp esi, edi
jne 0x42201d
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x388]
call fcn.00423dd9
cmp byte [ebp - 0x275], 0
push 0x30
pop eax
push 0x40
push ebx
mov dword [ebp - 0x2f4], 0x44
lea ecx, [eax + 0x60]
cmovne eax, ecx
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x2f0]
push eax
call fcn.0044fa15
xor eax, eax
lea edi, [ebp - 0x2ac]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x274]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004225b6
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
call fcn.00423a70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
sbb dl, dl
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
add dl, 1
cmovne edi, dword [ebp - 0x28]
lea esi, [ecx + eax*2]
jmp 0x42213b
movzx eax, word [edi]
push eax
call dword [0x455640]
pop ecx
test eax, eax
je 0x42213f
add edi, 2
cmp edi, esi
jne 0x422129
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.00423a33
lea edx, [ebp - 0x274]
lea ecx, [ebp - 0x28]
call fcn.00420bdb
mov dword [ebp - 0x294], ebx
mov dword [ebp - 0x280], ebx
mov byte [ebp - 4], 8
cmp dword [ebp - 0x164], 2
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4221ee
lea ecx, [ebp - 0x280]
call fcn.00422f19
push eax
push dword [ebp - 0x27c]
call dword [0x455524]
test eax, eax
jne 0x42237e
call fcn.004236a4
push 2
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x422558
call fcn.004236a4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSQueryUserToken_return_failed__last_err:_d
push str.CRemoteLauncher::Launch
push 0x109
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push 1
push 2
push 0x482c38
jmp 0x422370
lea ecx, [ebp - 0x294]
call fcn.00422f19
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
mov esi, 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x422259
call fcn.004236a4
push 2
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x422558
call fcn.004236a4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_return_failed__last_err:_d
push str.CRemoteLauncher::Launch
push 0x10f
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push 1
push 2
push 0x482c24
jmp 0x422370
lea ecx, [ebp - 0x280]
call fcn.00422f19
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4222c1
call fcn.004236a4
push 2
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x422558
call fcn.004236a4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DuplicateTokenEx_return_failed__last_err:_d
push str.CRemoteLauncher::Launch
push 0x115
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push 1
push 2
push 0x4829ac
jmp 0x422370
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x422314
call fcn.004236a4
push 2
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x422558
call fcn.004236a4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ImpersonateLoggedOnUser_return_failed__last_err:_d
push str.CRemoteLauncher::Launch
push 0x11a
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push 1
push 2
push 0x482c14
jmp 0x422370
push 4
lea eax, [ebp - 0x27c]
push eax
push 0xc
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x42237e
call fcn.004236a4
push 2
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x422558
call fcn.004236a4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetTokenInformation_return_failed__last_err:_d
push str.CRemoteLauncher::Launch
push 0x11f
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push 1
push 2
push 0x482c10
push esi
call fcn.0043a100
add esp, 0x24
jmp 0x422558
push ebx
push dword [ebp - 0x280]
lea eax, [ebp - 0x288]
mov dword [ebp - 0x288], ebx
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ecx, dword [ebp - 0x284]
test eax, eax
je 0x4223a8
or ecx, 0x400
cmp dword [ebp - 0x2c], 8
lea edx, [ebp - 0x2ac]
push edx
lea edx, [ebp - 0x2f4]
push edx
push ebx
push dword [ebp - 0x288]
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x28c]
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x284], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x18
mov esi, eax
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00423a70
mov ecx, esi
call fcn.00422857
add esp, 0x18
cmp dword [ebp - 0x288], 0
je 0x422420
push dword [ebp - 0x288]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov dword [ebp - 0x288], ebx
call fcn.004236a4
cmp dword [ebp - 0x284], 0
mov ecx, eax
jne 0x42247e
push 2
call fcn.0043a060
test eax, eax
je 0x422558
call fcn.004236a4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x28c]
push str.CreateProcessAsUser__s_failed:__d
push str.CRemoteLauncher::Launch
push 0x135
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push 1
push 2
push 0x4829a0
push esi
call fcn.0043a100
add esp, 0x28
jmp 0x422558
push 4
call fcn.0043a060
test eax, eax
je 0x4224cd
call fcn.004236a4
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
push ecx
push dword [ebp - 0x28c]
push dword [ebp - 0x2a4]
push dword [ebp - 0x27c]
push str.CreateProcessAsUser_sid_u__pid_u___s_n_s
push str.CRemoteLauncher::Launch
push 0x139
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceRemoteRemoteLauncher.cpp
push ebx
push 4
push ebx
push eax
call fcn.0043a100
add esp, 0x30
push dword [ebp - 0x2a8]
call edi
push ecx
push str.__modehost
lea ecx, [ebp - 0x40]
call fcn.00420155
cmp eax, 0xffffffff
je 0x42254e
mov edi, dword [ebp - 0x27c]
mov esi, dword [ebp - 0x2ac]
push 0x34
call fcn.0044e9c0
mov ebx, eax
pop ecx
mov dword [ebp - 0x29c], ebx
push dword [ebp - 0x28c]
mov byte [ebp - 4], 9
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
mov dword [ebx], 1
call fcn.00413997
push dword [ebp - 0x298]
mov byte [ebp - 4], 0xa
lea ecx, [ebx + 0x28]
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], edi
call fcn.00423788
mov ecx, ebx
call fcn.0041f922
mov ecx, ebx
call fcn.0041f800
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x422556
push dword [ebp - 0x2ac]
call edi
mov bl, 1
mov eax, dword [ebp - 0x280]
test eax, eax
je 0x42256a
cmp eax, 0xffffffff
je 0x42256a
push eax
call edi
mov eax, dword [ebp - 0x294]
test eax, eax
je 0x42257c
cmp eax, 0xffffffff
je 0x42257c
push eax
call edi
lea ecx, [ebp - 0x28]
call fcn.004023ee
lea ecx, [ebp - 0x274]
call fcn.00422770
lea ecx, [ebp - 0x40]
call fcn.004023ee
lea ecx, [ebp - 0x33c]
call fcn.0042343a
lea ecx, [ebp - 0x33c]
call dword [0x45536c]
mov al, bl
call fcn.0044fb73
ret