Function at 0x477b50
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Impersonate user
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push 0x20
push 1
call fcn.00491e51
xor ebx, ebx
add esp, 8
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.0047d840
push ebx
lea ecx, [ebp - 0x58]
call fcn.00416420
mov eax, dword [0x513fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x513fec
call edx
add eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [0x513fec]
mov edx, dword [eax + 0xc]
mov ecx, 0x513fec
call edx
lea edi, [eax + 0x10]
push str._________Inside_ExecuteWithTokenEx_Method___________n
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x1c], ebx
call fcn.00423960
mov esi, dword [ebp + 0x1c]
push esi
push str.ExecuteWithTokenEx_:_showUI_is__d_n
call fcn.00423db0
mov eax, dword [ebp + 0x2c]
push eax
push str.ExecuteWithTokenEx_:_enableLogging_is__d_n
call fcn.00423db0
add esp, 0x14
cmp dword [0x515dac], ebx
je 0x477c53
mov ecx, dword [ebp + 0x10]
push ecx
push str.ExecuteWithTokenEx_:_Shutdown_is_in_Progress._So_returning_without_executing_the_process__s_._n
call fcn.00423ad0
lea eax, [edi - 0x10]
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x477c15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477c34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x58]
call fcn.004166c0
lea ecx, [ebp - 0xe8]
call fcn.0047d8c0
pop edi
pop esi
mov eax, 0x4d5
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x44
lea ecx, [ebp - 0x9c]
push ebx
push ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call fcn.00492ac0
add esp, 0xc
mov dword [ebp - 0x9c], 0x44
cmp esi, ebx
je 0x477ca7
push str.Inside_showUI_is_true_n
call fcn.00423db0
mov edx, 1
mov word [ebp - 0x6c], dx
mov dword [ebp - 0x94], str.winsta0default
mov dword [ebp - 0x18], 0x4000410
jmp 0x477cb8
push str.Inside_showUI_is_false_n
call fcn.00423db0
mov dword [ebp - 0x18], 0xc000400
add esp, 4
cmp dword [ebp + 0x2c], ebx
je 0x477d5e
cmp dword [0x515c74], ebx
jne 0x477d5e
push str.Inside_enableLogging_is_true_n
mov dword [ebp - 0x70], 0x101
call fcn.00423db0
mov esi, dword [ebp + 0x30]
add esp, 4
push ebx
xor eax, eax
push 0x80
push 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0xc0000000
push esi
mov dword [ebp - 0x2c], 0xc
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x30], edi
cmp edi, 0xffffffff
je 0x477d47
push esi
push str.ExecuteWithTokenEx_:__s_file_opened_sucess.._n
call fcn.00423db0
add esp, 8
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x60], edi
jmp 0x477d65
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.ExecuteWithTokenEx_:_Unable_to_create_log_file__s__d_n
call fcn.00423db0
add esp, 0xc
jmp 0x477d65
mov dword [ebp - 0x70], 1
mov edi, dword [ebp + 0xc]
mov ecx, 1
mov word [ebp - 0x6c], cx
cmp edi, ebx
je 0x477eb7
push 0x1000
push ecx
call fcn.00491e51
add esp, 8
mov esi, eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x477de6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.ExecuteWithTokenEx:_Failed_to_get_the_CurrentWorkingDirectory__n
mov dword [ebp - 4], eax
call fcn.00423ad0
mov edx, dword [ebp - 4]
push edx
call fcn.004635b0
mov eax, dword [ebp - 4]
push eax
call fcn.00463420
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042bfe0
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x478301
mov eax, dword [ebp - 4]
cmp eax, 0x1000
jbe 0x477e16
push eax
push str.ExecuteWithTokenEx_:_CurrentWorkingDirectory_Buffer_overflow._Need_to_allocate_the_length_for__d_chars__n
call fcn.00423ad0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00463420
mov edx, dword [ebp + 0x14]
push eax
push edx
call fcn.0042bfe0
add esp, 0x14
jmp 0x4782eb
cmp dword [ebp + 0x10], ebx
je 0x477ea2
push esi
push str.ExecuteWithTokenEx_:_Current_Working_Directory_:__s__n
call fcn.00423db0
mov ecx, dword [ebp + 0x10]
push ecx
push str.ExecuteWithTokenEx_:_Executing_Application_Source_:__s__n
call fcn.00423db0
push edi
push str.ExecuteWithTokenEx_:_Set_Working_Directory_:__s__n
call fcn.00423db0
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x477eb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push str.ExecuteWithTokenEx_:_Failed_to_set_the_WorkingDirectory__s__n
mov dword [ebp - 4], eax
call fcn.00423ad0
mov edx, dword [ebp - 4]
push edx
call fcn.004635b0
push esi
call fcn.0048efd8
mov eax, dword [ebp - 4]
push eax
call fcn.00463420
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042bfe0
add esp, 0x1c
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00401ed0
lea ecx, [ebp - 8]
call fcn.00401ed0
jmp 0x47832c
push eax
call fcn.00463420
mov edx, dword [ebp + 0x14]
push eax
push edx
call fcn.0042bfe0
add esp, 0xc
jmp 0x477e8a
cmp dword [ebp + 0x20], ebx
je 0x477f6f
mov eax, dword [ebp + 8]
push 1
push eax
lea ecx, [ebp - 0x14]
push ecx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x477ee2
push str.ExecuteWithTokenEx_:_EnvironmentBlock_Created_sucessfully__n
call fcn.00423db0
add esp, 4
jmp 0x477f04
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
call fcn.00463420
add esp, 4
push eax
call esi
push eax
push str.ExecuteWithTokenEx_:_Error_in_EnvironmentBlock_Creation_with_error__d___s
call fcn.00423db0
add esp, 0xc
mov esi, dword [ebp - 0x20]
lea edx, [ebp - 0x10]
push edx
lea eax, [esi + 8]
mov dword [esi], 0x20
mov dword [esi + 4], 1
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.004830a0
add esp, 0xc
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov edx, dword [ebp + 8]
push esi
push edx
call dword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
je 0x477f52
push str.ExecuteWithTokenEx_:_profile_Loaded_sucessfully__n
call fcn.00423db0
add esp, 4
jmp 0x477f6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.00463420
push eax
push esi
push str.ExecuteWithTokenEx_:_Error_in_Loading_profile_with_error__d___s
call fcn.00423db0
add esp, 0x10
cmp dword [ebp + 0x24], 3
jne 0x47805c
cmp dword [0x513c54], 2
jne 0x477fac
mov eax, dword [0x515c78]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov eax, dword [0x515d78]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
call fcn.00462a10
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x477fbc
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00462b00
add esp, 8
mov edi, dword [ebp + 0x28]
mov esi, dword [edi]
cmp esi, ebx
je 0x4780ec
mov ecx, 0x4fb68d
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x477ff0
cmp dl, bl
je 0x477fec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x477ff0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x477fd0
xor eax, eax
jmp 0x477ff5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4780ec
mov ecx, dword [edi + 4]
mov edx, dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
push ebx
push 2
push ecx
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x478033
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonate_:_Logon_User_Error_:_d_n_n
mov dword [ebp - 4], eax
call fcn.00423ad0
add esp, 8
jmp 0x478244
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x4780dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.impersonate_:_Impersonate_Logged_on_User_Error_:_x_n_n
call fcn.00423ad0
mov edi, dword [ebp + 0xc]
add esp, 8
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x40]
push edx
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp + 0x2c]
push edi
mov edi, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ebx
push ebx
push edi
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
cmp dword [ebp + 0x24], 3
mov esi, eax
jne 0x4780a9
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x4780a3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp esi, ebx
jne 0x478109
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenEx_:_Failed_to_Create_the_Process__d_n
mov dword [ebp - 4], eax
call fcn.00423ad0
mov edx, dword [ebp - 4]
push edx
call fcn.00463420
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042bfe0
add esp, 0x14
jmp 0x478244
push ebx
push str.Impersonate_:_Successfully_impersonated_the_logged_on_user_with__s__n
call fcn.00423db0
jmp 0x478056
mov ecx, dword [ebp + 0x14]
push str.Administrator_credentials_unavailable
push ecx
mov dword [ebp - 4], 1
call fcn.0042bfe0
add esp, 8
jmp 0x478244
mov esi, dword [ebp + 0x18]
cmp esi, ebx
jne 0x47812b
push ebx
mov dword [ebp - 4], ebx
call fcn.00463420
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042bfe0
add esp, 0xc
jmp 0x478244
mov eax, dword [ebp - 0x40]
mov edx, esi
imul edx, edx, 0xea60
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x47815c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenEx_:_WaitForSingleObject_Failed_with_error_code__d__n
call fcn.00423ad0
add esp, 8
jmp 0x478244
cmp eax, ebx
je 0x4781c3
push esi
push edi
push str.ExecuteWithTokenEx_:_Terminating_the_Process_for_application__s_as_time_is_exceeded__d_Minutes__n
mov dword [ebp - 4], 0x102
call fcn.00423db0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00463420
mov edx, dword [ebp + 0x14]
push eax
push edx
call fcn.0042bfe0
mov eax, dword [ebp - 0x40]
add esp, 0x18
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4781aa
push str.ExecuteWithTokenEx_:_The_process_has_been_successfully_terminated_..___n
call fcn.00423db0
add esp, 4
jmp 0x478244
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenEx_:_The_process_termination_is_failed_with_error_code_:__d__n
call fcn.00423ad0
add esp, 8
jmp 0x478244
mov edx, dword [ebp - 0x40]
lea ecx, [ebp - 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x478201
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenEx_:_Unable_to_find_the_exit_code_for_the_application_and_the_error_code_is_:__d__n
mov dword [ebp - 4], eax
call fcn.00423db0
mov eax, dword [ebp - 4]
push eax
call fcn.00463420
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042bfe0
add esp, 0x14
jmp 0x478244
mov edx, dword [ebp - 4]
push edx
call fcn.00463420
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042bfe0
mov ecx, dword [ebp - 4]
push ecx
push str.ExecuteWithTokenEx_:_Exit_code_of_the_process_:__d__n
call fcn.00423db0
mov eax, dword [ebp - 4]
add esp, 0x14
cmp eax, 0xbc2
je 0x478241
cmp eax, 0x669
je 0x478241
cmp eax, ebx
je 0x478241
cmp eax, 0x5e4
jne 0x478244
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x20], ebx
je 0x4782c3
mov edx, dword [ebp - 0x14]
push edx
call sub.USERENV.dll_DestroyEnvironmentBlock
test eax, eax
je 0x478265
push str.ExecuteWithToken_:_EnvironmentBlock_destroyed_sucessfully__n
call fcn.00423db0
add esp, 4
jmp 0x478282
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.00463420
push eax
push esi
push str.ExecuteWithToken_:_Error_in_destroying_EnvironmentBlock__with_error__d___s
call fcn.00423db0
add esp, 0x10
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
test eax, eax
je 0x4782a6
push str.ExecuteWithToken_:_Profile_Unloaded_sucessfully__n
call fcn.00423db0
add esp, 4
jmp 0x4782c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.00463420
push eax
push esi
push str.ExecuteWithToken_:_Error_in_Unloading_profile_with_error__d___s
call fcn.00423db0
add esp, 0x10
cmp dword [ebp + 0x2c], ebx
je 0x4782d2
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x24], 3
jne 0x4782de
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push str.__________End_Of_ExecuteInUserSession_Method___________n
call fcn.00423960
add esp, 4
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47830d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47832c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x58]
call fcn.004166c0
lea ecx, [ebp - 0xe8]
call fcn.0047d8c0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret