Function at 0x54ac60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b73b4
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x63a404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x244], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], 0
call fcn.0054ef00
xor edi, edi
mov dword [ebp - 0x234], eax
push 0x3a
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x21c], 0x1c
call fcn.0056ea97
mov ecx, dword [ebp - 0x21c]
push 0xffffffffffffffff
push str.Attempting_to_launch_as_user
inc ecx
mov dword [ebp - 0x220], eax
push ecx
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.00584f75
mov ecx, dword [ebp - 0x21c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x21c], ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 4], edx
push eax
push 0x2d8
push str.OProcess::executeAsUser
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoprocess.cpp
push edx
call fcn.0054faa0
mov dword [ebp - 4], 0xffffffff
add esp, 0x2c
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x54ad48
push 2
push eax
call fcn.0056ea89
add esp, 8
lea eax, [ebp - 0x248]
push eax
push 1
push 2
push 0
push 0xf01ff
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x54b63a
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x54b584
push 0xa0
call fcn.0056e7bf
add esp, 4
mov dword [ebp - 0x24c], eax
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.00549210
mov edi, eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x54b4d1
mov dword [edi + 0x50], 0
xor ecx, ecx
mov dword [edi + 0x58], 0
mov eax, 1
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x7e], 0
mov dword [edi + 0x82], 0
mov dword [edi + 0x86], 0
mov dword [edi + 0x8a], 0
mov word [edi + 0x8e], cx
push ecx
mov word [edi + 0x7c], ax
lea eax, [ebp - 0x238]
mov dword [edi + 0x4c], 0x44
mov dword [edi + 0x54], str.WinSta0Default
mov dword [edi + 0x78], 1
push dword [ebp - 0x248]
mov dword [ebp - 0x238], ecx
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x54b464
xor eax, eax
lea ecx, [ebp - 0x240]
push str.http:__
call fcn.005447b0
mov dword [ebp - 4], 2
mov ecx, esi
push eax
mov dword [ebp - 0x234], 1
call fcn.00546600
test al, al
jne 0x54aec4
push str.https:__
lea ecx, [ebp - 0x220]
call fcn.005447b0
mov dword [ebp - 4], 3
mov ecx, esi
push eax
mov dword [ebp - 0x234], 3
call fcn.00546600
mov byte [ebp - 0x221], 0
test al, al
je 0x54aecb
mov byte [ebp - 0x221], 1
test byte [ebp - 0x234], 2
je 0x54aedf
lea ecx, [ebp - 0x220]
call fcn.004ffe40
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], 0xffffffff
call fcn.004ffe40
cmp byte [ebp - 0x221], 0
je 0x54b0ac
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str..html
push 2
push 0x400
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
jne 0x54b204
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00544840
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 4
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call ebx
mov ecx, str.chrome.exe
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x54af86
test dx, dx
je 0x54af82
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x54af86
add ecx, 4
add eax, 4
test dx, dx
jne 0x54af60
xor eax, eax
jmp 0x54af8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x54afbc
push str._s___new_window___s_
lea ecx, [ebp - 0x240]
call fcn.005447b0
push esi
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 5
push ecx
push eax
call fcn.00544d50
lea ecx, [ebp - 0x240]
jmp 0x54b051
lea eax, [ebp - 0x218]
push eax
call ebx
mov ecx, str.firefox.exe
nop word [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x54aff6
test dx, dx
je 0x54aff2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x54aff6
add ecx, 4
add eax, 4
test dx, dx
jne 0x54afd0
xor eax, eax
jmp 0x54affb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x54b029
push str._s__new_instance___s_
lea ecx, [ebp - 0x22c]
call fcn.005447b0
push esi
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 6
push ecx
push eax
call fcn.00544d50
lea ecx, [ebp - 0x22c]
jmp 0x54b051
push str._s___s_
lea ecx, [ebp - 0x250]
call fcn.005447b0
push esi
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 7
push ecx
push eax
call fcn.00544d50
lea ecx, [ebp - 0x250]
add esp, 0xc
mov byte [ebp - 4], 4
mov esi, eax
call fcn.004ffe40
mov ecx, esi
call fcn.00545f90
mov ebx, eax
test esi, esi
je 0x54b095
mov ecx, dword [esi]
test ecx, ecx
je 0x54b083
push 2
push ecx
call fcn.0056ea89
add esp, 8
mov dword [esi], 0
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056ea89
add esp, 8
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
call fcn.004ffe40
jmp 0x54b206
test ebx, ebx
je 0x54b190
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 4], 8
xor esi, esi
mov eax, dword [ebx + 4]
test eax, eax
je 0x54b16e
cmp esi, eax
jae 0x54b100
mov eax, dword [ebx]
test eax, eax
je 0x54b100
mov eax, dword [eax + esi*4]
test eax, eax
je 0x54b100
push eax
lea ecx, [ebp - 0x220]
call fcn.00545810
push 0x20
lea ecx, [ebp - 0x220]
call fcn.005454a0
mov eax, dword [ebx + 4]
inc esi
cmp esi, eax
jb 0x54b0da
cmp dword [ebp - 0x21c], 0
mov esi, dword [ebp - 0x244]
jle 0x54b166
push esi
lea ecx, [ebp - 0x22c]
call fcn.005448d0
push 0x20
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 9
call fcn.005454a0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00545810
lea ecx, [ebp - 0x22c]
call fcn.00545f90
lea ecx, [ebp - 0x22c]
mov ebx, eax
call fcn.004ffe40
mov ecx, dword [ebp - 0x220]
jmp 0x54b176
mov ecx, dword [ebp - 0x220]
jmp 0x54b174
mov esi, dword [ebp - 0x244]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x54b18c
push 2
push ecx
call fcn.0056ea89
add esp, 8
test ebx, ebx
jne 0x54b199
mov ecx, esi
call fcn.00545f90
mov ebx, eax
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x54b1b9
cmp dword [eax], 0
je 0x54b1b9
cmp dword [eax + 4], 0
jbe 0x54b1b9
mov ecx, eax
call fcn.00545f90
mov ecx, eax
jmp 0x54b208
mov ecx, esi
call fcn.00548420
mov esi, eax
test esi, esi
je 0x54b206
mov ecx, esi
call fcn.00545f90
mov dword [ebp - 0x230], eax
mov eax, dword [esi]
test eax, eax
je 0x54b1ea
push 2
push eax
call fcn.0056ea89
add esp, 8
mov dword [esi], 0
push 8
push esi
mov dword [esi + 4], 0
call fcn.0056ea89
mov ecx, dword [ebp - 0x230]
add esp, 8
jmp 0x54b208
xor ebx, ebx
xor ecx, ecx
cmp dword [ebp - 0x244], 0
je 0x54b3f4
lea eax, [edi + 0x90]
push eax
lea eax, [edi + 0x4c]
push eax
push ecx
push dword [ebp - 0x238]
push 0x430
push 0
push 0
push 0
push ebx
push 0
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x54b2b6
push str.Launched
lea ecx, [ebp - 0x240]
call fcn.005447b0
push eax
push 0x33a
push str.OProcess::executeAsUser
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoprocess.cpp
push 0
mov dword [ebp - 4], 0xa
call fcn.0054faa0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.004ffe40
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x238]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x54b6d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateProcessAsUser_Last_Error_Code:__d
lea ecx, [ebp - 0x240]
mov esi, eax
call fcn.005447b0
push esi
push eax
push 0x340
push str.OProcess::executeAsUser
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoprocess.cpp
push 0
mov dword [ebp - 4], 0xb
call fcn.0054faa0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.004ffe40
push 0
push 0
lea eax, [ebp - 0x230]
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push str.Error
lea ecx, [ebp - 0x220]
call fcn.005447b0
push 0
push esi
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0xc
call fcn.00545550
push 0x624918
lea ecx, [ebp - 0x22c]
call fcn.005447b0
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x220]
call fcn.00545810
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 0xc
call fcn.004ffe40
push dword [ebp - 0x230]
lea ecx, [ebp - 0x22c]
call fcn.00544840
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x220]
call fcn.00545810
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 0xc
call fcn.004ffe40
lea eax, [ebp - 0x220]
push eax
lea ecx, [edi + 0x3c]
call fcn.00545420
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
call fcn.004ffe40
push dword [ebp - 0x238]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x54b6d8
push str.Exe_Command_to_launch_as_user_is_invalid_null
lea ecx, [ebp - 0x240]
call fcn.005447b0
push eax
push 0x34f
push str.OProcess::executeAsUser
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoprocess.cpp
push 0
mov dword [ebp - 4], 0xf
call fcn.0054faa0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.004ffe40
push ecx
mov ecx, edi
call fcn.00504f70
push dword [ebp - 0x238]
xor edi, edi
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x54b6d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateEnvironmentBlock_Last_Error_Code:__d
lea ecx, [ebp - 0x240]
mov esi, eax
call fcn.005447b0
push esi
push eax
push 0x357
push str.OProcess::executeAsUser
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoprocess.cpp
push 0
mov dword [ebp - 4], 0x10
call fcn.0054faa0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.004ffe40
push ecx
mov ecx, edi
call fcn.00504f70
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x54b6d8
push 0x50
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x21c], 0x27
call fcn.0056ea97
mov ecx, dword [ebp - 0x21c]
push 0xffffffffffffffff
push str.Unable_to_create_OProcess_return_object
inc ecx
mov dword [ebp - 0x220], eax
push ecx
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00584f75
mov ecx, dword [ebp - 0x21c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x21c], ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0x11
push eax
push 0x35d
push str.OProcess::executeAsUser
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoprocess.cpp
push edx
call fcn.0054faa0
mov dword [ebp - 4], 0xffffffff
add esp, 0x2c
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x54b56d
push 2
push eax
call fcn.0056ea89
add esp, 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x54b6d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x58
mov esi, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x21c], 0x2b
call fcn.0056ea97
mov ecx, dword [ebp - 0x21c]
push 0xffffffffffffffff
push str.ImpersonateLoggedOnUser_Last_Error_Code:__d
inc ecx
mov dword [ebp - 0x220], eax
push ecx
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00584f75
mov ecx, dword [ebp - 0x21c]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x21c], ecx
push esi
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0x12
push eax
push 0x364
push str.OProcess::executeAsUser
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoprocess.cpp
push edx
call fcn.0054faa0
mov dword [ebp - 4], 0xffffffff
add esp, 0x30
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x54b629
push 2
push eax
call fcn.0056ea89
add esp, 8
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x54b6d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4a
mov esi, eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x228], 0x24
call fcn.0056ea97
mov ecx, dword [ebp - 0x228]
push 0xffffffffffffffff
push str.DuplicateTokenEx_Last_Error_Code:__d
inc ecx
mov dword [ebp - 0x22c], eax
push ecx
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00584f75
mov ecx, dword [ebp - 0x228]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x228], ecx
push esi
lea eax, [ebp - 0x22c]
mov dword [ebp - 4], 0x13
push eax
push 0x36c
push str.OProcess::executeAsUser
push str.d:jenkinsworkspaceclient3.lib.platformlibplatformlib_srcoprocess.cpp
push edx
call fcn.0054faa0
mov eax, dword [ebp - 0x22c]
add esp, 0x30
test eax, eax
je 0x54b6d8
push 2
push eax
call fcn.0056ea89
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e5b3
mov esp, ebp
pop ebp
ret