Function at 0x42359d
Capabilities:
Create process on windows

Disassembly:
push 0x80
mov eax, 0x5b9e54
call fcn.00580b7e
lea esi, [ebp - 0x34]
call fcn.00475c10
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0x20], eax
xor ebx, ebx
inc ebx
cmp dword [0x6bc38c], ebx
jl 0x4235e4
push eax
push str.WD_session:__u
push 0x682340
push ebx
call fcn.00532652
add esp, 0x10
cmp dword [ebp - 0x20], 0xffffffff
je 0x423864
call fcn.00423430
mov esi, eax
cmp dword [0x6bc38c], ebx
jl 0x423611
push esi
push str.WD_TI_pid__u
push 0x682360
push ebx
call fcn.00532652
add esp, 0x10
cmp esi, 0xffffffff
je 0x423864
push esi
push ebx
mov edi, 0x1f0fff
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x42382f
and dword [ebp - 0x1c], 0
mov byte [ebp - 4], 3
lea esi, [ebp - 0x1c]
call fcn.0042658d
push eax
push 0xf01ff
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4237f8
cmp dword [ebp - 0x1c], 0
je 0x42381a
and dword [ebp - 0x18], 0
mov byte [ebp - 4], 4
mov ebx, dword [ebp - 0x1c]
lea esi, [ebp - 0x18]
call fcn.0042658d
push eax
push 1
push 1
xor esi, esi
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4237c0
cmp dword [ebp - 0x18], esi
je 0x4237e4
push 4
lea eax, [ebp - 0x20]
push eax
push 0xc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4237a4
mov ecx, dword [ebp - 0x20]
call fcn.00423477
mov ebx, eax
cmp dword [0x6bc38c], 1
jl 0x4236e7
xor eax, eax
cmp ebx, esi
setne al
push eax
push str.WD_env__i
push 0x68237c
push 1
call fcn.00532652
add esp, 0x10
mov dword [ebp - 0x28], 0x30
cmp ebx, esi
je 0x4236f9
mov dword [ebp - 0x28], 0x430
mov dword [ebp - 0x44], esi
xor eax, eax
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x8c], esi
push 0x40
push esi
lea eax, [ebp - 0x88]
push eax
call fcn.005780d0
add esp, 0xc
mov dword [ebp - 0x8c], 0x44
mov dword [ebp - 0x84], str.winsta0default
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push esi
push ebx
push dword [ebp - 0x28]
push esi
push esi
push esi
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, esi
jne 0x42377b
cmp dword [0x6bc38c], 1
jl 0x42377b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_CreateProcessAsUser__i
push 0x6823c8
push 1
call fcn.00532652
add esp, 0x10
cmp dword [ebp - 0x40], esi
je 0x423789
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x44], esi
je 0x423797
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
je 0x4237e4
push ebx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
jmp 0x4237e4
cmp dword [0x6bc38c], 1
jl 0x4237e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_SetTokenInformation__i
push 0x6823f4
jmp 0x4237da
cmp dword [0x6bc38c], 1
jl 0x4237e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_DuplicateTokenEx__i
push 0x68241c
push 1
call fcn.00532652
add esp, 0x10
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], esi
je 0x42381a
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42381a
cmp dword [0x6bc38c], ebx
jl 0x42381a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_OpenProcessToken__i
push 0x682444
push ebx
call fcn.00532652
add esp, 0x10
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], 0
je 0x423851
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x423851
cmp dword [0x6bc38c], ebx
jl 0x423851
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WD_OpenProcess__i
push str.Helper::runAsTI
push ebx
call fcn.00532652
add esp, 0x10
mov byte [ebp - 4], 1
cmp dword [ebp - 0x24], 0
je 0x423864
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x34]
call fcn.00475c50
call fcn.00580c23
ret