Function at 0x404ab0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x115c
call fcn.00406900
mov eax, dword [0x40c014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
cmp byte [ebp + 0xc], al
push esi
mov esi, dword [ebp + 8]
setne al
push edi
push eax
push esi
mov edi, ecx
mov dword [ebp - 0x1150], esi
push str.DoRunProgram__s__d
push edi
mov dword [ebp - 0x1154], edi
call fcn.00402040
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x1158], ebx
test ebx, ebx
jne 0x404b3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadLibraryW_Kernel32.dll_Error:__d
push edi
call fcn.00402040
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004068e1
mov esp, ebp
pop ebp
ret 0xc
push str.WTSGetActiveConsoleSessionId
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1148], eax
test eax, eax
jne 0x404b83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSGetActiveConsoleSessionId_null:__d
push edi
call fcn.00402040
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004068e1
mov esp, ebp
pop ebp
ret 0xc
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x114c], eax
test eax, eax
jne 0x404ba6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadLibraryW_wtsapi32.dll_Error:__d
jmp 0x404b5e
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1088], eax
test eax, eax
jne 0x404be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSQueryUserToken_null:__d
push edi
call fcn.00402040
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esp, 0xc
push dword [ebp - 0x114c]
call esi
push ebx
call esi
jmp 0x404b6e
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x111c]
push eax
call dword [ebp - 0x1148]
push eax
call dword [ebp - 0x1088]
test eax, eax
jne 0x404c2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WTSQueryUserToken_fail:__d
push edi
call fcn.00402040
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esp, 0xc
push dword [ebp - 0x114c]
call esi
push ebx
call esi
jmp 0x404b6e
push 0
push dword [ebp - 0x111c]
lea eax, [ebp - 0x1118]
mov dword [ebp - 0x1118], 0
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x404c78
mov eax, dword [ebp - 0x111c]
test eax, eax
je 0x404c62
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x114c]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push ebx
call esi
jmp 0x404b6e
lea eax, [ebp - 0x108c]
mov dword [ebp - 0x1130], 0
push eax
push 4
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x108c], 4
push eax
push 0x13
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [ebp - 0x1130]
lea eax, [ebp - 0x10cc]
push 0x40
push 0
push eax
mov dword [ebp - 0x115c], ebx
call sub.VCRUNTIME140.dll_memset
push 0x40
lea eax, [ebp - 0x1110]
mov dword [ebp - 0x10d0], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x1114], 0x44
add esp, 0x18
mov dword [ebp - 0x112c], 0
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1124], eax
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], eax
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], eax
cmp byte [ebp + 0x10], al
jne 0x404d73
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x10d0]
push eax
push 0
push dword [ebp - 0x1118]
push 0x400
push 0
push 0
push 0
push esi
push 0
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.Non_Installer_CreateProcessAsUserW_hToken__d__d
jmp 0x4050a8
test ebx, ebx
je 0x404db6
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x10d0]
push eax
push 0
push dword [ebp - 0x1118]
push 0x400
push 0
push 0
push 0
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.CreateProcessAsUserW_hLinkedToken__d__d
jmp 0x4050a8
mov eax, dword [ebp - 0x111c]
test eax, eax
je 0x40506f
push eax
mov ecx, edi
call fcn.00405590
test eax, eax
je 0x404e14
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x10d0]
push eax
push 0
push dword [ebp - 0x1118]
push 0x400
push 0
push 0
push 0
push esi
push 0
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.CreateProcessAsUserW_hToken__d__d
jmp 0x4050a8
push 0x800
lea eax, [ebp - 0x1084]
mov byte [ebp - 0x1141], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x800
lea eax, [ebp - 0x884]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0x1088], 0
lea eax, [ebp - 0x1088]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x1148], eax
test eax, eax
je 0x40505a
cmp dword [ebp - 0x1088], 0
jle 0x40505a
lea eax, [ebp - 0x84]
push eax
call fcn.004052b0
add esp, 4
test eax, eax
je 0x405033
mov eax, dword [ebp - 0x1148]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [eax]
lea eax, [ebp - 0x1084]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1084]
push str.__LevelSystem__Service__Guid
push eax
call ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1084]
push eax
call ebx
mov eax, dword [ebp - 0x1148]
push dword [eax]
lea eax, [ebp - 0x884]
push eax
call esi
push str.__Service__Guid
lea eax, [ebp - 0x884]
push eax
call ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x884]
push eax
call ebx
mov eax, dword [ebp - 0x1088]
cmp eax, 1
jle 0x404f4a
mov edi, dword [ebp - 0x1148]
mov esi, 1
push 0x4090f8
lea eax, [ebp - 0x884]
push eax
call ebx
push dword [edi + esi*4]
lea eax, [ebp - 0x884]
push eax
call ebx
inc esi
cmp esi, dword [ebp - 0x1088]
jl 0x404f21
mov edi, dword [ebp - 0x1154]
mov esi, dword [ebp - 0x1150]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x1148]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [ebp - 0x1141], 0
jne 0x40506f
lea eax, [ebp - 0x84]
mov ecx, edi
push eax
call fcn.00404940
push eax
push str.CreateProcessInitEvent__d
push edi
call fcn.00402040
add esp, 0xc
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x10d0]
push eax
push 0
push dword [ebp - 0x1118]
lea eax, [ebp - 0x1084]
push 0x400
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call ebx
push eax
push esi
push str.CreateProcessW__d__d
push edi
call fcn.00402040
add esp, 0x10
lea eax, [ebp - 0x1140]
push eax
lea eax, [ebp - 0x1114]
push eax
push 0
push dword [ebp - 0x1118]
lea eax, [ebp - 0x884]
push 0x400
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x111c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x1154], eax
call ebx
mov ebx, dword [ebp - 0x1154]
push eax
push ebx
push str.CreateProcessAsUserW__d__d
push edi
call fcn.00402040
add esp, 0x10
test esi, esi
je 0x405056
test ebx, ebx
je 0x405056
mov ebx, 1
jmp 0x4050b1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push 0x4090fc
push edi
call fcn.00402040
add esp, 0xc
mov byte [ebp - 0x1141], 1
jmp 0x404f56
xor ebx, ebx
jmp 0x4050b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CommandLineToArgvW_Fail:__d
push edi
call fcn.00402040
add esp, 0xc
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x10d0]
push eax
push 0
push dword [ebp - 0x1118]
push 0x400
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.CreateProcessW__d__d
push edi
call fcn.00402040
add esp, 0x10
cmp byte [ebp + 0xc], 0
je 0x4050db
mov eax, dword [ebp - 0x1128]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4050cc
push 0xffffffffffffffff
push eax
call esi
mov eax, dword [ebp - 0x113c]
test eax, eax
je 0x4050db
push 0xffffffffffffffff
push eax
call esi
mov eax, dword [ebp - 0x112c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4050ee
push eax
call edi
mov eax, dword [ebp - 0x1128]
test eax, eax
je 0x4050fb
push eax
call edi
mov eax, dword [ebp - 0x1140]
test eax, eax
je 0x405108
push eax
call edi
mov eax, dword [ebp - 0x113c]
test eax, eax
je 0x405115
push eax
call edi
push dword [ebp - 0x1118]
call sub.USERENV.dll_DestroyEnvironmentBlock
push dword [ebp - 0x114c]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push dword [ebp - 0x1158]
call esi
mov eax, dword [ebp - 0x115c]
test eax, eax
je 0x405143
push eax
call edi
mov eax, dword [ebp - 0x111c]
test eax, eax
je 0x405150
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004068e1
mov esp, ebp
pop ebp
ret 0xc