Function at 0x40f410
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445113
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x461008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xcc], ebx
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0xc1], 0
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x50], 0
mov word [ebp - 0x60], ax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], eax
mov word [ebp - 0x48], ax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x60]
cmp eax, edx
je 0x40f499
push 0xffffffffffffffff
push 0
push edx
mov ecx, eax
call fcn.00403f40
lea eax, [ebp - 0x48]
cmp eax, edi
je 0x40f4ac
push 0xffffffffffffffff
push 0
push edi
mov ecx, eax
call fcn.00403f40
lea eax, [ebp - 0x30]
cmp eax, esi
je 0x40f4bf
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.00403f40
mov eax, dword [0x463be0]
xor edi, edi
mov dword [ebp - 0xc8], edi
test eax, eax
jne 0x40f503
lea eax, [ebp - 0x64]
push eax
push 0x455ed0
push 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x40f4fa
push str.RtlRandomEx
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x463be0], eax
jmp 0x40f4ff
mov eax, dword [0x463be0]
test eax, eax
je 0x40f525
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push ecx
call eax
mov edi, eax
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0xc8], edi
push str.Seed_08X_Key_08X_r_n
call fcn.00416f00
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
lea edx, [ebp - 0xc8]
lea ecx, [ebp - 0xc0]
call fcn.00410280
add esp, 4
push eax
mov byte [ebp - 4], 1
call fcn.004102b0
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x68]
push eax
call fcn.00410350
lea ecx, [ebp - 0xbc]
call fcn.0040d9e0
cmp word [0x4639d8], 0
jne 0x40f57d
push 0x104
push 0x4639d8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, ebx
call fcn.0040f9d0
mov ebx, eax
test ebx, ebx
jne 0x40f5a2
push dword [ebp - 0xcc]
push str.Service::GetSessionToken___returned_no_token_for_session__d_r_n
call fcn.00416f00
add esp, 8
jmp 0x40f703
push 0x44
lea eax, [ebp - 0xb8]
push 0
push eax
call fcn.0043cf50
mov esi, 0x4639d8
mov dword [ebp - 0xb8], 0x44
add esp, 0xc
mov dword [ebp - 0xb0], str.winsta0Default
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
lea ecx, [esi + 2]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40f5e0
sub esi, ecx
mov ecx, edi
sar esi, 1
call fcn.00415710
mov ecx, eax
mov dword [ebp - 0xc8], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f601
sub ecx, edx
add esi, 0xb
sar ecx, 1
mov edx, 2
add esi, ecx
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00432432
push 0x455f5c
mov edi, eax
push esi
push edi
call fcn.0043256a
push 0x4639d8
push esi
push edi
call fcn.004325c6
push 0x455f5c
push esi
push edi
call fcn.004325c6
push 0x455f60
push esi
push edi
call fcn.004325c6
push dword [ebp - 0xc8]
push esi
push edi
call fcn.004325c6
add esp, 0x40
push dword [ebp - 0xc8]
call fcn.004323fa
add esp, 4
mov dword [ebp - 0x14], 0
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push ebx
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x40f69b
mov esi, 0x400
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
push dword [ebp - 0x14]
push esi
push 0
push 0
push 0
push edi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40f6e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUser
push 0x4566ac
call fcn.00416f00
add esp, 0xc
jmp 0x40f6f2
push dword [ebp - 0x6c]
call esi
push dword [ebp - 0x70]
call esi
mov byte [ebp - 0xc1], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40f700
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push ebx
call esi
lea ecx, [ebp - 0x60]
call fcn.0040d9e0
mov al, byte [ebp - 0xc1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043183b
mov esp, ebp
pop ebp
ret