Function at 0x42dc00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49e24b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
push ebx
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
cmp dword [0x4c9404], 0
jne 0x42dc53
xor al, al
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push edi
mov edx, esi
call fcn.0042dad0
add esp, 4
test al, al
je 0x42dc3b
xor bl, bl
cmp byte [ebp + 0x18], bl
jne 0x42dd47
cmp dword [ebp + 0x14], 4
jne 0x42dcae
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x42dd40
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
push edi
call fcn.0042d730
mov bl, al
add esp, 0x10
test bl, bl
jne 0x42df64
mov edx, dword [ebp + 0x10]
push edx
xor edi, edi
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x28], esi
cmp esi, edi
je 0x42df64
lea eax, [esp + 0x20]
push eax
push 0xf00ff
push esi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42df5d
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x42df5d
mov dword [esp + 0x18], edi
lea edi, [esp + 0x18]
call fcn.0042d6c0
test eax, eax
je 0x42df52
mov eax, dword [esp + 0x18]
xor esi, esi
cmp eax, esi
je 0x42df4e
push 1
push eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], esi
xor ebx, ebx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x42ddf0
mov ebx, 0x400
jmp 0x42ddf4
xor bl, bl
jmp 0x42dcae
call fcn.004171f0
mov esi, eax
mov eax, dword [ebp + 0x10]
call fcn.00419900
test al, al
jne 0x42dcae
push 0x44
lea ecx, [esp + 0x48]
push 0
push ecx
call fcn.0047c020
mov ecx, dword [ebp + 0xc]
add esp, 0xc
xor eax, eax
cmp word [edi], ax
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push 0x400
push 0
push 0
push 0
mov dword [esp + 0x64], 0x44
push ecx
jne 0x42ddce
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x1c], esi
cmp dword [0x4c940c], esi
je 0x42de9e
lea edx, [esp + 0x14]
push edx
mov ecx, str.S_1_16_
call fcn.004038d0
mov eax, dword [ebp + 0x14]
dec eax
mov dword [esp + 0x98], esi
cmp eax, 3
ja case.0x42de1f.4
jmp dword [eax*4 + 0x42df7c]
mov edx, str.12288
jmp 0x42de40
mov edx, str.8192
jmp 0x42de40
mov edx, str.4096
jmp 0x42de40
mov edx, str.16384
lea edi, [esp + 0x14]
call fcn.00403030
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x42de95
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x34], 0x20
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push edx
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea ecx, [esp + 0x14]
call fcn.00455380
push 0x44
lea ecx, [esp + 0x48]
push esi
push ecx
call fcn.0047c020
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x4c], str.winsta0default
cmp word [eax], si
jne 0x42def3
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x34]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x48]
push eax
push esi
push ecx
push ebx
push esi
push esi
push esi
push edx
push esi
jmp 0x42df0c
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x48]
push edx
mov edx, dword [ebp + 0xc]
push esi
push ecx
push ebx
push esi
push esi
push esi
push edx
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
mov eax, dword [esp + 0x1c]
setne bl
cmp eax, esi
je 0x42df2b
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test bl, bl
je 0x42df43
mov ecx, dword [esp + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x34]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret