Function at 0x40c0b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x441552
mov eax, dword fs:[0]
push eax
sub esp, 0x3bc
mov eax, dword [0x44f3c0]
xor eax, esp
mov dword [esp + 0x3b4], eax
push ebx
push ebp
push esi
mov eax, dword [0x44f3c0]
xor eax, esp
push eax
lea eax, [esp + 0x3cc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3dc]
xor ebx, ebx
or ebp, 0xffffffff
mov dword [esp + 0x1c], ebx
cmp eax, ebp
jne 0x40c104
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [esp + 0x2c]
push ecx
push eax
mov dword [esp + 0x34], ebx
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x40c179
call fcn.00414b50
cmp eax, 2
jg 0x40c15d
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xa7
push str..ServiceMain.cpp
lea ecx, [esp + 0x58]
call fcn.00416e80
mov dword [esp + 0x3d4], ebx
add eax, 0xc
push str.Failed_to_create_LMworker.exe_process__WTSQueryUserToken_failed
mov ebx, 1
push eax
mov dword [esp + 0x24], ebx
call fcn.004041d0
add esp, 8
mov dword [esp + 0x3d4], ebp
test bl, 1
je 0x40c172
lea ecx, [esp + 0x48]
call fcn.00416ed0
xor al, al
jmp 0x40c56b
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
call fcn.0040b220
cmp esi, ebp
je 0x40c192
mov dword [esp + 0x14], esi
lea edx, [esp + 0x20]
push edx
mov esi, 1
push esi
push 2
push ebx
mov dword [esp + 0x3e4], esi
mov eax, dword [esp + 0x3c]
push 0x2000000
push eax
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40c232
call fcn.00414b50
cmp eax, 2
jg 0x40c206
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xb2
push str..ServiceMain.cpp
lea ecx, [esp + 0x58]
call fcn.00416e80
add eax, 0xc
push str.Failed_to_create_LMworker.exe_process__DuplicateTokenEx_failed
mov byte [esp + 0x3d8], 2
mov ebx, 2
push eax
mov dword [esp + 0x24], ebx
call fcn.004041d0
add esp, 8
mov dword [esp + 0x3d4], esi
test bl, 2
je 0x40c21b
lea ecx, [esp + 0x48]
call fcn.00416ed0
lea ecx, [esp + 0x14]
mov dword [esp + 0x3d4], ebp
call fcn.0040b220
xor al, al
jmp 0x40c56b
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.0040b220
cmp esi, ebp
je 0x40c24b
mov dword [esp + 0x18], esi
mov byte [esp + 0x3d4], 3
call fcn.004176c0
cmp eax, 2
jle 0x40c3db
lea ecx, [esp + 0x24]
push ecx
push str.S_1_16_12288
mov dword [esp + 0x2c], ebx
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x40c304
call fcn.00414b50
cmp eax, 2
jg 0x40c2c3
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xbc
push str..ServiceMain.cpp
lea ecx, [esp + 0x58]
call fcn.00416e80
add eax, 0xc
push str.Failed_to_create_LMworker.exe_process__ConvertStringSidToSidW_failed
mov byte [esp + 0x3d8], 4
mov ebx, 4
push eax
mov dword [esp + 0x24], ebx
call fcn.004041d0
add esp, 8
test bl, 4
mov dword [esp + 0x3d4], 3
je 0x40c2dc
lea ecx, [esp + 0x48]
call fcn.00416ed0
lea ecx, [esp + 0x18]
mov byte [esp + 0x3d4], 1
call fcn.0040b220
lea ecx, [esp + 0x14]
mov dword [esp + 0x3d4], ebp
call fcn.0040b220
xor al, al
jmp 0x40c56b
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
push eax
mov dword [esp + 0x38], 0x20
mov dword [esp + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x34]
push edx
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x40c3d0
call fcn.00414b50
cmp eax, 2
jg 0x40c384
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xc7
push str..ServiceMain.cpp
lea ecx, [esp + 0x58]
call fcn.00416e80
add eax, 0xc
push str.Failed_to_create_LMworker.exe_process__SetTokenInformation_failed
mov byte [esp + 0x3d8], 5
mov ebx, 8
push eax
mov dword [esp + 0x24], ebx
call fcn.004041d0
add esp, 8
mov dword [esp + 0x3d4], 3
test bl, 8
je 0x40c39d
lea ecx, [esp + 0x48]
call fcn.00416ed0
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x18]
mov byte [esp + 0x3d4], 1
call fcn.0040b220
lea ecx, [esp + 0x14]
mov dword [esp + 0x3d4], ebp
call fcn.0040b220
xor al, al
jmp 0x40c56b
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x20]
push ebx
push eax
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], ebx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x40c442
call fcn.00414b50
cmp eax, 2
jg 0x40c43a
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0xd0
push str..ServiceMain.cpp
lea ecx, [esp + 0x58]
call fcn.00416e80
add eax, 0xc
push str.Failed_to_create_LMworker.exe_process__CreateEnvironmentBlock_failed
mov byte [esp + 0x3d8], 6
mov ebx, 0x10
push eax
mov dword [esp + 0x24], ebx
call fcn.004041d0
add esp, 8
test bl, 0x10
jmp 0x40c2c6
push 0x40
lea edx, [esp + 0xe4]
push ebx
push edx
call fcn.004270d0
xor eax, eax
mov esi, 3
add esp, 0xc
mov dword [esp + 0x3d4], esi
cmp dword [edi + 0x18], 8
mov dword [esp + 0xdc], 0x44
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
jb 0x40c489
mov eax, dword [edi + 4]
jmp 0x40c48c
lea eax, [edi + 4]
push eax
lea eax, [esp + 0x1c0]
push 0x104
push eax
call fcn.00425a92
mov eax, dword [esp + 0x34]
add esp, 0xc
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0xe0]
push edx
mov edx, dword [esp + 0x28]
push ebx
push eax
push 0x430
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1dc]
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
call fcn.00414b50
test eax, eax
jg 0x40c526
call sub.KERNEL32.dll_GetLastError
push eax
push ebx
push 0xdf
push str..ServiceMain.cpp
lea ecx, [esp + 0x138]
call fcn.00416e80
mov byte [esp + 0x3d4], 8
mov ecx, dword [esp + 0x40]
push ecx
push ecx
add eax, 0xc
push str.DSIWMI_ServiceMain::ServiceMain___process_id_
mov ebx, 0x40
push eax
mov dword [esp + 0x2c], ebx
call fcn.004041d0
add esp, 0xc
mov ecx, eax
call fcn.0040f5b0
mov dword [esp + 0x3d4], esi
test bl, 0x40
je 0x40c53e
lea ecx, [esp + 0x128]
call fcn.00416ed0
mov edx, dword [esp + 0x28]
push edx
call sub.USERENV.dll_DestroyEnvironmentBlock
lea ecx, [esp + 0x18]
mov byte [esp + 0x3d4], 1
call fcn.0040b220
lea ecx, [esp + 0x14]
mov dword [esp + 0x3d4], ebp
call fcn.0040b220
mov al, 1
mov ecx, dword [esp + 0x3cc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3b4]
xor ecx, esp
call fcn.00424b47
add esp, 0x3c8
ret