Function at 0x40b260
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
push edi
mov ebp, ecx
push esi
push ebx
mov esi, edx
sub esp, 0x2ac
mov dword [esp + 0x3c], eax
call sym._GetCurrentProcess_0
lea edx, [esp + 0x4c]
mov dword [esp + 4], 0xf00ff
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._OpenProcessToken_12
sub esp, 0xc
test eax, eax
je 0x40b471
lea eax, [esp + 0x50]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2000000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._DuplicateTokenEx_24
sub esp, 0x18
test eax, eax
mov ebx, eax
je 0x40b440
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], 4
mov dword [esp + 4], 0xc
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sym._SetTokenInformation_16
sub esp, 0x10
test eax, eax
mov ebx, eax
je 0x40b4d0
lea ebx, [esp + 0x98]
mov dword [esp + 8], 0x104
mov dword [esp], 0
mov dword [esp + 4], ebx
call sym._GetModuleFileNameA_12
sub esp, 0xc
test eax, eax
je 0x40b495
lea edx, [esp + 0x54]
xor eax, eax
mov ecx, 0x11
cmp ebp, 3
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x5c], str.winsta0default
mov eax, 0x436f9c
je 0x40b36e
cmp ebp, 1
mov eax, 0x436f9f
je 0x40b36e
mov eax, 0x436f99
lea ebp, [esp + 0x19c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.__s___s
mov dword [esp + 4], 0x104
mov dword [esp], ebp
mov dword [esp + 0x38], edx
call sym.___mingw_snprintf
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x50]
mov dword [esp + 4], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0x20
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp], eax
call sym._CreateProcessAsUserA_44
sub esp, 0x2c
mov ebx, eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
test ebx, ebx
je 0x40b510
mov eax, dword [esp + 0x3c]
mov dword [esp], str.Process_HANDLE___d__PID___d_successfully_launched_for_session__d_r_n
mov ebx, 1
mov dword [esp + 0xc], eax
mov eax, dword [esi + 8]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x40b464
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
call sym._GetLastError_0
mov dword [esp], str.Call_to_DuplicateTokenEx_failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x2ac
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
call sym._GetLastError_0
mov dword [esp], str.Call_to_OpenProcessToken_failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x2ac
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
call sym._GetLastError_0
mov dword [esp], str.Unable_to_get_module__exe__pathname__call_to_GetModuleFileName_failed_with_error_code__d__r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x40b464
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
call sym._GetLastError_0
mov dword [esp], str.Call_to_SetTokenInformation_failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x2ac
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._GetLastError_0
mov dword [esp], str.Call_to_CreateProcessAsUserA_failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x40b464