Function at 0x476ad0
Capabilities:
Create process on windows
Get common file path
Impersonate user
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x20
mov edi, 1
push edi
call fcn.00491e51
xor ebx, ebx
push str._________Inside_ExecuteWithToken_Method___________n
mov esi, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call fcn.00423960
add esp, 0xc
cmp dword [0x515dac], ebx
je 0x476b25
mov eax, dword [ebp + 0x10]
push eax
push str.ExecuteWithTokenW_:_Shutdown_is_in_Progress._So_returning_without_executing_the_process__S_._n
call fcn.00423ad0
add esp, 8
pop edi
pop esi
mov eax, 0x4d5
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x44
lea ecx, [ebp - 0x64]
push ebx
push ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.00492ac0
add esp, 0xc
mov dword [ebp - 0x64], 0x44
cmp dword [ebp + 0x1c], ebx
je 0x476b67
mov edx, edi
mov dword [ebp - 0x38], edi
mov word [ebp - 0x34], dx
mov dword [ebp - 0x5c], 0x4de2b0
mov dword [ebp - 0xc], 0x4000410
jmp 0x476b6e
mov dword [ebp - 0xc], 0xc000400
cmp dword [ebp + 0xc], ebx
je 0x476cb0
push 0x1000
push edi
call fcn.00491e51
add esp, 8
mov edi, eax
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x476bd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.ExecuteWithTokenW:_Failed_to_get_the_CurrentWorkingDirectory__n
mov dword [ebp - 4], eax
call fcn.00423ad0
mov eax, dword [ebp - 4]
push eax
call fcn.004635b0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00463420
mov edx, dword [ebp + 0x14]
push eax
push edx
call fcn.0042bfe0
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
cmp eax, 0x1000
jbe 0x476c08
push eax
push str.ExecuteWithTokenW_:_CurrentWorkingDirectory_Buffer_overflow._Need_to_allocate_the_length_for__d_chars__n
call fcn.00423ad0
mov eax, dword [ebp - 4]
push eax
call fcn.00463420
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042bfe0
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], ebx
je 0x476c93
push edi
push str.ExecuteWithTokenW_:_Current_Working_Directory_:__s__n
call fcn.00423db0
mov edx, dword [ebp + 0x10]
push edx
push str.ExecuteWithTokenW_:_Executing_Application_Source_:__S__n
call fcn.00423db0
mov eax, dword [ebp + 0xc]
push eax
push str.ExecuteWithTokenW_:_Set_Working_Directory_:__S__n
call fcn.00423db0
mov ecx, dword [ebp + 0xc]
add esp, 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x476d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
push edx
push str.ExecuteWithTokenW_:_Failed_to_set_the_WorkingDirectory__S__n
mov dword [ebp - 4], eax
call fcn.00423ad0
mov eax, dword [ebp - 4]
push eax
call fcn.004635b0
push edi
call fcn.0048efd8
mov ecx, dword [ebp - 4]
push ecx
call fcn.00463420
mov edx, dword [ebp + 0x14]
push eax
push edx
call fcn.0042bfe0
mov eax, dword [ebp - 4]
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.00463420
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042bfe0
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ExecuteWithTokenW:_NULL_Root_Directory_and_setting_agent_installed_directory_as_current_directory__n
call fcn.00423ad0
mov edx, dword [0x515c08]
lea ecx, [ebp + 0xc]
push ecx
push edx
call fcn.004628e0
mov eax, dword [ebp + 0xc]
push eax
push str.ExecuteWithTokenW:_Setting_the_current_directory_as__S__n
call fcn.00423db0
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp eax, ebx
je 0x476d43
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x476d43
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
push ecx
push str.ExecuteWithTokenW_:_Failed_to_set_the_WorkingDirectory__S__n
mov dword [ebp - 4], eax
call fcn.00423ad0
mov edx, dword [ebp - 4]
push edx
call fcn.004635b0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
je 0x476d23
push eax
call fcn.0048efd8
add esp, 4
mov dword [ebp + 0xc], ebx
mov eax, dword [ebp - 4]
push eax
call fcn.00463420
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042bfe0
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 8]
cmp dword [ebp + 0x20], ebx
je 0x476df1
push 1
push edi
lea edx, [ebp - 8]
push edx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x476d6e
push str.ExecuteWithTokenW_:_EnvironmentBlock_Created_sucessfully__n
call fcn.00423db0
jmp 0x476d8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_Error_in_EnvironmentBlock_Creation_with_error__d_:
call fcn.00423db0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004634d0
add esp, 4
lea eax, [esi + 8]
push eax
push edi
mov dword [esi], 0x20
mov dword [esi + 4], 1
call fcn.00482fb0
add esp, 8
push esi
push edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call dword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
je 0x476dd2
push str.ExecuteWithTokenW_:_profile_Loaded_sucessfully__n
call fcn.00423db0
add esp, 4
jmp 0x476df1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.ExecuteWithTokenW_:_Error_in_Loading_profile_with_error__d_:
call fcn.00423db0
push edi
call fcn.004634d0
mov edi, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
push str.ExecuteWithTokenW:_executeFileName____S__n
call fcn.00423db0
mov ecx, dword [ebp + 0xc]
add esp, 8
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
push eax
push ebx
push ebx
push ebx
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
cmp dword [ebp - 0x10], ebx
je 0x476e3f
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x476e3f
push eax
call fcn.0048efd8
add esp, 4
mov dword [ebp + 0xc], ebx
cmp edi, ebx
jne 0x476e72
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_Failed_to_Create_the_Process__d_n
mov dword [ebp - 4], eax
call fcn.00423ad0
mov edx, dword [ebp - 4]
push edx
call fcn.00463420
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042bfe0
add esp, 0x14
jmp 0x476fb0
mov edi, dword [ebp + 0x18]
cmp edi, ebx
jne 0x476e94
push ebx
mov dword [ebp - 4], ebx
call fcn.00463420
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042bfe0
add esp, 0xc
jmp 0x476fb0
mov eax, dword [ebp - 0x20]
mov edx, edi
imul edx, edx, 0xea60
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x476ec5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_WaitForSingleObject_Failed_with_error_code__d__n
call fcn.00423ad0
add esp, 8
jmp 0x476fb0
cmp eax, ebx
je 0x476f2f
mov ecx, dword [ebp + 0x10]
push edi
push ecx
push str.ExecuteWithTokenW_:_Terminating_the_Process_for_application__S_as_time_is_exceeded__d_Minutes__n
mov dword [ebp - 4], 0x102
call fcn.00423db0
mov edx, dword [ebp - 4]
push edx
call fcn.00463420
push eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0042bfe0
mov ecx, dword [ebp - 0x20]
add esp, 0x18
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x476f16
push str.ExecuteWithTokenW_:_The_process_has_been_successfully_terminated_..___n
call fcn.00423db0
add esp, 4
jmp 0x476fb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_The_process_termination_is_failed_with_error_code_:__d__n
call fcn.00423ad0
add esp, 8
jmp 0x476fb0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x476f6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_Unable_to_find_the_exit_code_for_the_application_and_the_error_code_is_:__d__n
mov dword [ebp - 4], eax
call fcn.00423db0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00463420
mov edx, dword [ebp + 0x14]
push eax
push edx
call fcn.0042bfe0
add esp, 0x14
jmp 0x476fb0
mov eax, dword [ebp - 4]
push eax
call fcn.00463420
mov ecx, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042bfe0
mov edx, dword [ebp - 4]
push edx
push str.ExecuteWithTokenW_:_Exit_code_of_the_process_:__d__n
call fcn.00423db0
mov eax, dword [ebp - 4]
add esp, 0x14
cmp eax, 0xbc2
je 0x476fad
cmp eax, 0x669
je 0x476fad
cmp eax, ebx
je 0x476fad
cmp eax, 0x5e4
jne 0x476fb0
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x20], ebx
je 0x47702a
mov eax, dword [ebp - 8]
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
test eax, eax
je 0x476fd1
push str.ExecuteWithTokenW_:_EnvironmentBlock_destroyed_sucessfully__n
call fcn.00423db0
add esp, 4
jmp 0x476fed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.ExecuteWithTokenW_:_Error_in_destroying_EnvironmentBlock__with_error__d_:
call fcn.00423db0
push edi
call fcn.004634d0
add esp, 0xc
mov ecx, dword [esi + 0x1c]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
test eax, eax
je 0x47700e
push str.ExecuteWithTokenW_:_Profile_Unloaded_sucessfully__n
call fcn.00423db0
add esp, 4
jmp 0x47702a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.ExecuteWithTokenW_:_Error_in_Unloading_profile_with_error__d_:
call fcn.00423db0
push esi
call fcn.004634d0
add esp, 0xc
push str.__________End_Of_ExecuteInUserSession_Method___________n
call fcn.00423960
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret