Function at 0x402b30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x42a018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov byte [ebp - 0x409], 0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
jne 0x402b6b
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ae3f
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x414]
push ecx
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x402e04
lea eax, [ebp - 0x424]
mov dword [ebp - 0x418], 0
push eax
push 4
lea eax, [ebp - 0x418]
mov dword [ebp - 0x424], 4
push eax
push 0x13
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402be6
call ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
push str.Fast_Engine:_Token_Error__d
push 0x42bbf8
call esi
mov eax, dword [ebp - 0x414]
add esp, 0xc
mov dword [ebp - 0x410], eax
jmp 0x402c9f
lea eax, [ebp - 0x410]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
jne 0x402c1d
push str.Fast_Engine:_Duplicate_Token_Error
push 0x42bbf8
call esi
add esp, 8
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0
push eax
push str.S_1_5_32_544
mov dword [ebp - 0x428], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
jne 0x402c56
push str.Fast_Engine:_Convert_SID_error
push 0x42bbf8
call esi
add esp, 8
mov eax, dword [ebp - 0x41c]
push eax
mov dword [ebp - 0x428], 0x20
mov dword [ebp - 0x42c], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x42c]
push eax
push 0x19
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x402c9f
push str.Fast_Engine:_Set_Token_Info_Error
push 0x42bbf8
call esi
add esp, 8
push 1
push dword [ebp - 0x410]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x402dcb
push 0x40
lea eax, [ebp - 0x47c]
mov dword [ebp - 0x480], 0x44
push 0
push eax
call fcn.0040df60
push str.ProgramFiles
mov dword [ebp - 0x478], str.winsta0default
call fcn.0040f731
push eax
lea eax, [ebp - 0x408]
push str._ws_fast__fast_.exe
push eax
call esi
add esp, 0x1c
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x480]
push eax
push 0
push dword [ebp - 0x420]
lea eax, [ebp - 0x408]
push 0x480
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x402d86
push dword [ebp - 0x430]
mov byte [ebp - 0x409], 1
call edi
push dword [ebp - 0x434]
call edi
push dword [ebp - 0x420]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 0x414]
call edi
push dword [ebp - 0x410]
call edi
mov al, byte [ebp - 0x409]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ae3f
mov esp, ebp
pop ebp
ret
call ebx
push eax
push str.Fast_Engine:_Create_Process_Error__d
push 0x42bbf8
call esi
add esp, 0xc
push dword [ebp - 0x420]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 0x414]
call edi
push dword [ebp - 0x410]
call edi
mov al, byte [ebp - 0x409]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ae3f
mov esp, ebp
pop ebp
ret
call ebx
push eax
push str.Fast_Engine:_Create_Env_Block_Error__d
push 0x42bbf8
call esi
add esp, 0xc
push dword [ebp - 0x414]
call edi
push dword [ebp - 0x410]
call edi
mov al, byte [ebp - 0x409]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ae3f
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fast_Engine:_Query_User_Token_Error__d
push 0x42bbf8
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov al, byte [ebp - 0x409]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040ae3f
mov esp, ebp
pop ebp
ret