Function at 0x555610
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x420]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x555694
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 8
mov esi, eax
je 0x555960
push esi
push str.WTSEnumerateSessions_failed__err__d
push 0x1f1
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 8
call fcn.004f21c0
add esp, 0x1c
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
test byte [0x9538a8], 0x10
je 0x5556c7
push dword [ebp - 0x420]
push 0x6f7624
push 0x1f5
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 0x10
call fcn.004f21c0
add esp, 0x1c
push ebx
push edi
push esi
push 0x6d74bc
lea eax, [ebp - 0x414]
push 0x410
push eax
call fcn.004f3b60
mov ebx, dword [ebp - 0x428]
add esp, 0x14
cmp dword [ebp - 0x420], 0
mov dword [ebp - 0x424], 0
jle 0x55595d
mov esi, dword [ebx]
lea eax, [ebp - 0x418]
mov edi, dword [ebx + 4]
push eax
push esi
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x41c], 0
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x555762
test byte [0x9538a8], 0x10
je 0x555941
push edi
push esi
push str.Session_id__d___s__is_not_interactive
push 0x214
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 0x10
call fcn.004f21c0
add esp, 0x20
jmp 0x555941
test byte [0x9538a8], 0x10
je 0x555791
push edi
push esi
push str.Session_id__d___s__is_interactive
push 0x21a
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 0x10
call fcn.004f21c0
add esp, 0x20
push 1
push dword [ebp - 0x418]
lea eax, [ebp - 0x41c]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x5557e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
je 0x555941
push eax
push edi
push esi
push str.Failed_to_create_evnironment_block_for_session__d___s___err__d
push 0x221
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 1
call fcn.004f21c0
add esp, 0x24
jmp 0x555941
test byte [0x9538a8], 0x10
je 0x555815
push str.Create_environment_block_succeeded
push 0x225
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 0x10
call fcn.004f21c0
add esp, 0x18
lea eax, [ebp - 0x47c]
push 0x44
push eax
call fcn.004f3630
add esp, 8
mov dword [ebp - 0x47c], 0x44
test byte [0x9538a8], 4
mov dword [ebp - 0x474], 0x6cba10
je 0x555870
push edi
push esi
lea eax, [ebp - 0x414]
push eax
push str.Executing_cmd:__s_in_session__d___s_
push 0x22c
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 4
call fcn.004f21c0
add esp, 0x24
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x47c]
push eax
push 0
push dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push 0x420
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x5558ef
test byte [0x9538a8], 0x10
je 0x5558d7
push str.CreateProcessAsUser_succeeded
push 0x23b
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 0x10
call fcn.004f21c0
add esp, 0x18
push dword [ebp - 0x438]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x434]
call esi
jmp 0x555929
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
je 0x555923
push eax
push str.CreateProcessAsUser_failed__err__d
push 0x242
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_utl_utl_mcpl.c
push str.utl_mcpl_run_cmd_in_all_sessions
push dword [0x7d0564]
push 1
call fcn.004f21c0
add esp, 0x1c
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x555939
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x424]
add ebx, 0xc
inc eax
mov dword [ebp - 0x424], eax
cmp eax, dword [ebp - 0x420]
jl 0x555700
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0063c972
mov esp, ebp
pop ebp
ret