Function at 0x422c3c
Capabilities:
Create process on windows
Impersonate user
Print debug messages

Disassembly:
push 0x2bc
mov eax, 0x4341df
call fcn.0042bf4b
mov esi, ecx
lea ecx, [ebp - 0x22c]
mov ebx, edx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
xor ecx, ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0x25c], ecx
lea edi, [ebp - 0x258]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x2c4]
push eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x238], ecx
call sub.MSVCR80.dll_memset
xor eax, eax
inc eax
mov dword [ebp - 0x29c], eax
mov word [ebp - 0x298], ax
xor eax, eax
add esp, 0xc
cmp word [esi], 0x22
mov dword [ebp - 0x2c8], 0x44
setne al
mov edi, eax
test edi, edi
je 0x422ce1
push 0x437ca4
lea ecx, [ebp - 0x22c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push esi
lea ecx, [ebp - 0x22c]
call dword [0x4371a4]
test edi, edi
je 0x422d03
push 0x437ca4
lea ecx, [ebp - 0x22c]
call dword [0x4371a4]
test ebx, ebx
je 0x422d25
push 0x43e9bc
lea ecx, [ebp - 0x22c]
call dword [0x4371a4]
push ebx
lea ecx, [ebp - 0x22c]
call dword [0x4371a4]
lea eax, [ebp - 0x248]
push eax
mov edi, 0xf01ff
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x422d52
mov dword [ebp - 0x230], 0xfffffff9
jmp 0x4231a6
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x248]
lea ebx, [ebp - 0x24c]
call fcn.004223fc
test eax, eax
pop ecx
pop ecx
jne 0x422d7f
mov dword [ebp - 0x230], 0xfffffff8
jmp 0x4231a6
mov eax, dword [ebp - 0x24c]
push dword [eax]
call fcn.0042236b
test eax, eax
pop ecx
je 0x422f0c
lea esi, [ebp - 0x240]
call fcn.0042247b
test eax, eax
jne 0x422db3
mov dword [ebp - 0x230], 0xfffffffe
jmp 0x4231a6
push dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
call fcn.00422515
test eax, eax
pop ecx
pop ecx
jne 0x422dda
mov dword [ebp - 0x230], 0xfffffffd
jmp 0x4231a6
push dword [ebp - 0x23c]
xor esi, esi
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, esi
jne 0x422e03
mov dword [ebp - 0x230], 0xfffffff1
jmp 0x4231a6
lea eax, [ebp - 0x238]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x278]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x27c]
push eax
push dword [ebp - 0x238]
mov dword [ebp - 0x27c], 0x20
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jne 0x422e56
push str.cant_load_user_profile_n
call edi
push esi
push dword [ebp - 0x238]
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x234], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
cmp eax, esi
jne 0x422e7b
push str.cant_create_environment_block_n
call edi
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
jae 0x422e90
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x2c8]
push ecx
push esi
push dword [ebp - 0x234]
push 0x400
push esi
push esi
push esi
push eax
push esi
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, esi
je 0x422ed5
push dword [ebp - 0x258]
call ebx
push dword [ebp - 0x25c]
call ebx
mov dword [ebp - 0x230], esi
cmp dword [ebp - 0x234], esi
je 0x422ee9
push dword [ebp - 0x234]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp dword [ebp - 0x260], esi
je 0x4231a6
push dword [ebp - 0x260]
push dword [ebp - 0x238]
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
jmp 0x4231a6
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x234]
push eax
lea ebx, [ebp - 0x240]
lea edi, [ebp - 0x23c]
call fcn.004222d7
test eax, eax
pop ecx
je 0x42319c
cmp dword [ebp - 0x23c], 2
jne 0x42313b
cmp dword [ebp - 0x240], 6
jb 0x42313b
push dword [ebp - 0x248]
call fcn.0042238c
pop ecx
call dword [sym.imp.USER32.dll_GetShellWindow]
xor esi, esi
cmp eax, esi
jne 0x422f82
mov dword [ebp - 0x230], 0xfffffff6
jmp 0x4231a6
lea ecx, [ebp - 0x23c]
push ecx
push eax
mov dword [ebp - 0x23c], esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0x422fa9
mov dword [ebp - 0x230], 0xfffffff5
jmp 0x4231a6
push dword [ebp - 0x23c]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 0x240], eax
jne 0x422fd4
mov dword [ebp - 0x230], 0xfffffff3
jmp 0x4231a6
lea ecx, [ebp - 0x234]
push ecx
push 2
push eax
mov dword [ebp - 0x234], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x423123
lea eax, [ebp - 0x238]
push eax
push 1
push 2
push esi
push 0x18b
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x42310b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x4230ff
push str.CreateProcessWithTokenW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x4230ec
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
jae 0x423057
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x2c8]
push ecx
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebp - 0x238]
call edi
cmp eax, esi
jne 0x4230c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x422
jne 0x4230e0
call fcn.004232b2
test eax, eax
je 0x4230e0
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
jae 0x4230a2
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x2c8]
push ecx
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebp - 0x238]
call edi
cmp eax, esi
je 0x4230e0
push dword [ebp - 0x258]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x25c]
call edi
mov dword [ebp - 0x230], esi
jmp 0x4230f6
mov dword [ebp - 0x230], 0xfffffff0
jmp 0x4230f6
mov dword [ebp - 0x230], 0xffffffef
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x423115
mov dword [ebp - 0x230], 0xffffffee
jmp 0x423115
mov dword [ebp - 0x230], 0xffffffed
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42312d
mov dword [ebp - 0x230], 0xffffffec
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4231a6
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
jae 0x423150
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x25c]
push ecx
xor edi, edi
lea ecx, [ebp - 0x2c8]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
je 0x423190
push dword [ebp - 0x258]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x25c]
call esi
mov dword [ebp - 0x230], edi
jmp 0x4231a6
mov dword [ebp - 0x230], 0xffffffeb
jmp 0x4231a6
mov dword [ebp - 0x230], 0xfffffff4
xor esi, esi
cmp dword [ebp - 0x248], esi
je 0x4231bc
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x238], esi
je 0x4231d0
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24c], esi
je 0x4231e5
push dword [ebp - 0x24c]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
push 0x1fe
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push dword [ebp - 0x230]
lea eax, [ebp - 0x210]
push str.from1ver0.3errcode_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [ebp - 0x244]
call fcn.0041d53a
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x42323f
mov eax, dword [ecx]
push str.duba_createprocess_by_svc
call dword [eax + 0xc]
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 0x244]
call fcn.00422b79
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
pop ecx
jae 0x423267
lea eax, [ebp - 0x228]
mov esi, dword [ebp - 0x240]
test esi, esi
je 0x423287
mov edx, dword [esi]
push eax
push 0x438230
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x20]
test esi, esi
mov byte [ebp - 4], 0
je 0x423296
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp - 0x230]
call fcn.0042bfce
ret