Function at 0x41a607
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x2b0
mov eax, dword [0x5e5710]
xor eax, ebp
mov dword [ebp + 0x22c], eax
mov eax, dword [ebp + 0x23c]
push ebx
mov ebx, dword [ebp + 0x238]
push esi
push edi
lea ecx, [ebp + 0x10]
mov dword [ebp + 4], eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push esi
push eax
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
mov dword [ebp], esi
mov dword [ebp + 8], esi
call sub.MSVCR80.dll_memset
xor eax, eax
inc eax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
xor eax, eax
add esp, 0xc
cmp word [ebx], 0x22
mov dword [ebp - 0x80], 0x44
setne al
mov edi, eax
cmp edi, esi
je 0x41a699
push 0x58b0f0
lea ecx, [ebp + 0x10]
call dword [0x586418]
push ebx
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp edi, esi
je 0x41a6b5
push 0x58b0f0
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [ebp + 4], esi
je 0x41a6d4
push 0x58b0ec
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push dword [ebp + 4]
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [ebp]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push eax
call ebx
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x41a702
mov dword [ebp + 0xc], 0xfffffff9
jmp 0x41a97d
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp]
mov dword [ebp - 0x3c], esi
call fcn.0044e3cb
add esp, 0x10
test eax, eax
jne 0x41a72a
mov dword [ebp + 0xc], 0xfffffff8
jmp 0x41a97d
mov eax, dword [ebp - 4]
push dword [eax]
call fcn.0044e254
test eax, eax
pop ecx
je 0x41a7c7
lea eax, [ebp - 0x2c]
push eax
call fcn.0044edb4
test eax, eax
pop ecx
jne 0x41a757
mov dword [ebp + 0xc], 0xfffffffe
jmp 0x41a97d
push dword [ebp - 0x2c]
lea eax, [ebp - 0x18]
push eax
call fcn.0044ee58
test eax, eax
pop ecx
pop ecx
jne 0x41a775
mov dword [ebp + 0xc], 0xfffffffd
jmp 0x41a97d
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 8], eax
je 0x41a97d
lea ecx, [ebp + 8]
push ecx
push 0xf01ff
push eax
call ebx
push dword [ebp - 8]
call edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x41a963
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x34], esi
call fcn.0044e0ef
add esp, 0xc
test eax, eax
je 0x41a976
cmp dword [ebp - 0x30], 2
jne 0x41a944
cmp dword [ebp - 0xc], 6
jb 0x41a944
push 1
push str.SeIncreaseQuotaPrivilege
push dword [ebp]
call fcn.0044e275
add esp, 0xc
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, esi
jne 0x41a828
mov dword [ebp + 0xc], 0xfffffff6
jmp 0x41a97d
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0x41a846
mov dword [ebp + 0xc], 0xfffffff5
jmp 0x41a97d
push dword [ebp - 8]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x41a868
mov dword [ebp + 0xc], 0xfffffff3
jmp 0x41a97d
lea ecx, [ebp + 4]
push ecx
push 2
push eax
mov dword [ebp + 4], esi
call ebx
test eax, eax
je 0x41a93d
lea eax, [ebp + 8]
push eax
push 1
push 2
push esi
push 0x18b
push dword [ebp + 4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x41a938
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
mov dword [ebp - 0x38], eax
je 0x41a938
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, esi
je 0x41a92f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push esi
push esi
push dword [ebp + 8]
call ebx
cmp eax, esi
jne 0x41a922
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x422
jne 0x41a92f
push 3
push str.seclogon
call fcn.0041a22d
test eax, eax
pop ecx
pop ecx
je 0x41a92f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push esi
push esi
push dword [ebp + 8]
call ebx
cmp eax, esi
je 0x41a92f
push dword [ebp - 0x24]
call edi
push dword [ebp - 0x28]
call edi
mov dword [ebp + 0xc], esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp + 4]
call edi
push dword [ebp - 0x10]
call edi
jmp 0x41a97d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41a97d
push dword [ebp - 0x24]
call edi
push dword [ebp - 0x28]
call edi
mov dword [ebp + 0xc], esi
jmp 0x41a97d
mov dword [ebp + 0xc], 0xfffffff4
cmp dword [ebp], esi
je 0x41a987
push dword [ebp]
call edi
cmp dword [ebp + 8], esi
je 0x41a991
push dword [ebp + 8]
call edi
cmp dword [ebp - 4], esi
je 0x41a99f
push dword [ebp - 4]
call sub.MSVCR80.dll_free
pop ecx
push 0x1fe
lea eax, [ebp + 0x2e]
push esi
push eax
mov word [ebp + 0x2c], si
call sub.MSVCR80.dll_memset
push dword [ebp + 0xc]
lea eax, [ebp + 0x2c]
push str.from1ver0.3errcode_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.0041a4ab
mov ecx, dword [ebp - 0x10]
cmp ecx, esi
je 0x41a9e0
mov eax, dword [ecx]
push str.duba_createprocess_by_svc
call dword [eax + 0xc]
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041a519
pop ecx
pop ecx
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
mov edi, dword [ebp - 0x10]
cmp edi, esi
je 0x41aa1b
mov edx, dword [edi]
push eax
push 0x58aff8
mov ecx, edi
call dword [edx + 0x18]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x20]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
lea ecx, [ebp + 0x10]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp + 0x22c]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056f17c
add ebp, 0x230
leave
ret