Function at 0x405ae0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x48a618
push 0x441f50
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2084
call fcn.0044e2b0
mov eax, dword [0x48e050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2038], esi
mov ebx, edx
xor edi, edi
mov dword [ebp - 0x2028], edi
mov dword [ebp - 0x2040], edi
mov dword [ebp - 0x2034], edi
mov dword [ebp - 0x203c], edi
mov dword [ebp - 0x2050], edi
xor eax, eax
mov dword [ebp - 0x204c], eax
mov dword [ebp - 0x2048], eax
mov dword [ebp - 0x2044], eax
mov dword [ebp - 0x209c], edi
push 0x40
push edi
lea eax, [ebp - 0x2098]
push eax
call fcn.004416b0
add esp, 0xc
mov dword [ebp - 0x2030], edi
cmp esi, edi
je 0x405e04
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x405b86
sub eax, edx
sar eax, 1
je 0x405e04
cmp ebx, edi
je 0x405be2
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x405ba4
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, ebx
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x405bc0
sub eax, esi
sar eax, 1
add eax, edx
cmp eax, 0x1000
ja 0x405e04
mov esi, dword [ebp - 0x2038]
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x405c54
lea ecx, [ebp - 0x203c]
push ecx
lea edx, [ebp - 0x2034]
push edx
push 1
push edi
push edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x405c5a
xor eax, eax
mov edx, dword [ebp - 0x203c]
mov esi, dword [ebp - 0x2034]
cmp edx, edi
jbe 0x405c46
lea ecx, [esi + 8]
lea ebx, [ebx]
cmp dword [ecx], edi
je 0x405c3a
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x405c20
push esi
call sub.WTSAPI32.dll_WTSFreeMemory
mov esi, dword [ebp - 0x2038]
jmp 0x405c5a
lea eax, [eax + eax*2]
mov ecx, dword [esi + eax*4]
mov dword [ebp - 0x202c], ecx
push esi
call sub.WTSAPI32.dll_WTSFreeMemory
mov esi, dword [ebp - 0x2038]
jmp 0x405c5a
mov dword [ebp - 0x202c], eax
lea edx, [ebp - 0x2028]
push edx
mov eax, dword [ebp - 0x202c]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
cmp eax, edi
je 0x405e04
mov eax, dword [ebp - 0x2028]
cmp eax, edi
je 0x405e04
mov dword [ebp - 4], edi
push edi
push eax
lea ecx, [ebp - 0x2030]
push ecx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x405cb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEnvironmentBlock_error:__d
call fcn.00404c20
add esp, 8
jmp 0x405db5
xor eax, eax
mov dword [ebp - 0x2050], eax
mov dword [ebp - 0x204c], eax
mov dword [ebp - 0x2048], eax
mov dword [ebp - 0x2044], eax
push 0x44
push edi
lea edx, [ebp - 0x209c]
push edx
call fcn.004416b0
add esp, 0xc
mov dword [ebp - 0x209c], 0x44
mov dword [ebp - 0x2094], str.WinSta0Default
cmp ebx, edi
je 0x405d2e
mov eax, ebx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x405d00
sub eax, edx
sar eax, 1
je 0x405d2e
push ebx
push esi
push str.__s___s
push 0x1000
lea eax, [ebp - 0x2024]
push eax
call fcn.0043ed50
add esp, 0x14
jmp 0x405d48
push esi
push str.__s_
push 0x1000
lea ecx, [ebp - 0x2024]
push ecx
call fcn.0043ed50
add esp, 0x10
lea edx, [ebp - 0x2024]
push edx
push str.szCmdLine:__s
call fcn.00404c20
add esp, 8
lea eax, [ebp - 0x2050]
push eax
lea ecx, [ebp - 0x209c]
push ecx
push edi
mov edx, dword [ebp - 0x2030]
push edx
push 0x8000400
push edi
push edi
push edi
lea eax, [ebp - 0x2024]
push eax
push edi
mov ecx, dword [ebp - 0x2028]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, edi
jne 0x405da9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUser_error:__d
call fcn.00404c20
add esp, 8
jmp 0x405db5
mov edx, dword [ebp - 0x2050]
mov dword [ebp - 0x2040], edx
mov dword [ebp - 4], 0xfffffffe
call fcn.00405dcb
mov eax, dword [ebp - 0x2040]
jmp 0x405e06
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret