Function at 0x4039b0
Capabilities:
Check os version
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create thread
Get user security identifier
Impersonate user
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c1d4
mov eax, dword fs:[0]
push eax
sub esp, 0x5ec
mov eax, dword [0x42c0e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4e0], eax
xor eax, eax
mov dword [ebp - 0x538], edi
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x558], edx
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x564], eax
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x55c], eax
xorps xmm0, xmm0
mov dword [ebp - 4], eax
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
movups xmmword [ebp - 0x480], xmm0
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
xor ecx, ecx
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x590], ecx
mov dword [ebp - 0x58c], ecx
mov dword [ebp - 0x588], eax
xor esi, esi
mov dword [ebp - 0x524], eax
mov byte [ebp - 0x4c9], al
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x550], eax
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x520]
mov byte [ebp - 4], 3
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x584], 0x2e
mov dword [ebp - 0x4f4], esi
test eax, eax
je 0x403af6
mov dword [eax], esi
test edx, edx
je 0x403afc
mov dword [edx], esi
push 2
push 0x42382c
lea ecx, [ebp - 0x438]
movlpd qword [ebp - 0x5f0], xmm0
movlpd qword [ebp - 0x5e8], xmm0
movlpd qword [ebp - 0x5e0], xmm0
movlpd qword [ebp - 0x5d8], xmm0
movlpd qword [ebp - 0x5d0], xmm0
movlpd qword [ebp - 0x5c8], xmm0
movlpd qword [ebp - 0x5c0], xmm0
movlpd qword [ebp - 0x5b8], xmm0
mov dword [ebp - 0x5f4], 0x44
movups xmmword [ebp - 0x438], xmm0
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], esi
call fcn.004021c0
push 1
xorps xmm0, xmm0
mov byte [ebp - 4], 4
push 0x423834
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
movups xmmword [ebp - 0x468], xmm0
mov dword [ebp - 0x454], 0
call fcn.004021c0
lea eax, [edi + 0x208]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.004020e0
add esp, 0xc
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 6
push ecx
push eax
push dword [ebp - 0x4f8]
lea ecx, [ebp - 0x4c8]
call fcn.004026a0
lea eax, [edi + 0x408]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004020e0
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x4d4], eax
add esp, 0xc
cmp ecx, eax
je 0x403c99
mov ecx, dword [ebp - 0x43c]
cmp ecx, 8
jb 0x403c58
mov edx, dword [ebp - 0x450]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403c48
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404eb8
push ecx
push edx
call fcn.0040610c
mov eax, dword [ebp - 0x4d4]
add esp, 8
mov dword [ebp - 0x440], 0
xor ecx, ecx
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], cx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x450], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x440], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x484]
cmp ecx, 8
jb 0x403cd9
mov edx, dword [ebp - 0x498]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403ccf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404eb8
push ecx
push edx
call fcn.0040610c
add esp, 8
mov ecx, dword [ebp - 0x4b4]
xor eax, eax
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x484], 7
mov word [ebp - 0x498], ax
mov byte [ebp - 4], 6
cmp ecx, 8
jb 0x403d3a
mov edx, dword [ebp - 0x4c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403d30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404eb8
push ecx
push edx
call fcn.0040610c
add esp, 8
mov ecx, dword [ebp - 0x49c]
xor eax, eax
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b4], 7
mov word [ebp - 0x4c8], ax
mov byte [ebp - 4], 5
cmp ecx, 8
jb 0x403d9b
mov edx, dword [ebp - 0x4b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403d91
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404eb8
push ecx
push edx
call fcn.0040610c
add esp, 8
mov ecx, dword [ebp - 0x454]
xor eax, eax
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x49c], 7
mov word [ebp - 0x4b0], ax
mov byte [ebp - 4], 4
cmp ecx, 8
jb 0x403dfc
mov edx, dword [ebp - 0x468]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403df2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404eb8
push ecx
push edx
call fcn.0040610c
add esp, 8
mov ecx, dword [ebp - 0x424]
xor eax, eax
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov byte [ebp - 4], 3
cmp ecx, 8
jb 0x403e5d
mov edx, dword [ebp - 0x438]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403e53
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404eb8
push ecx
push edx
call fcn.0040610c
add esp, 8
cmp byte [edi + 0x20409], 0
je 0x403ec1
lea eax, [ebp - 0x554]
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404247
lea eax, [ebp - 0x4d0]
push eax
push 1
push 0
push 0
push 0x2000000
push dword [ebp - 0x554]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push dword [ebp - 0x554]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x4f0], eax
jmp 0x4042ce
cmp byte [edi + 0x20420], 0
je 0x404259
push str.NetIsServiceAccount
push 1
push str.netapi32.dll
call fcn.00401080
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
lea eax, [edi + 0x20422]
mov dword [0x44caf8], ecx
test ecx, ecx
je 0x403f0d
lea edx, [ebp - 0x550]
push edx
push eax
push 0
call ecx
lea eax, [edi + 0x20422]
push 0x5c
push eax
call fcn.00407554
add esp, 8
lea ecx, [edi + 0x20422]
test eax, eax
je 0x403f32
xor edx, edx
mov word [eax], dx
add eax, 2
mov dword [ebp - 0x4f0], eax
jmp 0x403f3e
mov dword [ebp - 0x4f0], ecx
lea ecx, [ebp - 0x584]
cmp dword [ebp - 0x550], 0
mov dword [ebp - 0x4dc], ecx
je 0x403ff0
push str._SA_262E99C9_6160_4871_ACEC_4E61736B6F21
lea ecx, [ebp - 0x438]
call fcn.00402650
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x438]
mov eax, dword [ebp - 0x428]
cmovae ecx, dword [ebp - 0x438]
mov byte [ebp - 4], 8
lea ecx, [ecx + eax*2]
add ecx, 2
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
cmovae eax, dword [ebp - 0x438]
sub ecx, eax
sar ecx, 1
push ecx
push eax
push 0
lea ecx, [ebp - 0x590]
call fcn.004022e0
mov ecx, dword [ebp - 0x590]
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x4fc], ecx
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x4e4], 5
mov byte [ebp - 4], 3
call fcn.00402970
mov eax, dword [ebp - 0x588]
xor esi, esi
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x4fc]
lea ecx, [esi + 5]
jmp 0x404013
push str.NT_AUTHORITY
push ecx
call fcn.0040936a
add esp, 8
test eax, eax
jne 0x404022
mov ecx, 5
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4e4], ecx
cmp byte [edi + 0x2040a], 0
je 0x404222
jmp 0x404058
cmp byte [edi + 0x2040a], 0
lea eax, [edi + 0x20622]
mov dword [ebp - 0x4fc], eax
je 0x40421d
xor edx, edx
mov ecx, 2
cmp dword [edi + 0x2041c], 0xffffffff
mov dword [ebp - 0x4e4], ecx
sete dl
mov dword [ebp - 0x4e8], edx
cmp dword [0x44caf4], 0
je 0x404222
push dword [edi + 0x2041c]
call fcn.00404fa0
add esp, 4
mov dword [ebp - 0x4d4], eax
test eax, eax
je 0x4040a5
push 0x14
call fcn.00409486
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x4f4], esi
mov dword [esi], 1
mov dword [esi + 4], eax
mov dword [esi + 8], 0xc0000005
push str.NT_SERVICE
push dword [ebp - 0x4dc]
call fcn.0040936a
add esp, 8
test eax, eax
jne 0x404183
mov dword [ebp - 0x504], eax
lea eax, [ebp - 0x53c]
push eax
push 0
push 0
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x4ec]
push eax
lea eax, [edi + 0x20422]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x404183
mov esi, dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x4ec], eax
lea eax, [ebp - 0x53c]
push eax
push 0
push 0
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x4ec]
push eax
lea eax, [edi + 0x20422]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x40417d
mov ecx, dword [ebp - 0x4f4]
test ecx, ecx
je 0x404151
inc dword [ecx]
mov eax, dword [ecx]
lea eax, [eax*8 + 0xc]
push eax
push ecx
call fcn.0040f121
mov esi, eax
add esp, 8
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [esi]
mov dword [esi + ecx*8 - 4], eax
mov eax, dword [esi]
mov dword [esi + eax*8], 0xc0000005
jmp 0x404183
mov esi, dword [ebp - 0x4f4]
mov eax, dword [0x44caf4]
lea ecx, [ebp - 0x4d0]
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [ebp - 0x4e4]
push esi
push 0
push ecx
mov ecx, dword [ebp - 0x4fc]
push ecx
push dword [ebp - 0x4dc]
push dword [ebp - 0x4f0]
call eax
test eax, eax
jne 0x4041f2
test esi, esi
je 0x4041c7
push esi
call fcn.0040946b
add esp, 4
push dword [ebp - 0x4d4]
call fcn.00405470
push dword [ebp - 0x4ec]
call fcn.00405470
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x20828
add edi, ecx
jmp 0x404d67
test esi, esi
je 0x4041ff
push esi
call fcn.0040946b
add esp, 4
push dword [ebp - 0x4ec]
call fcn.00405470
push dword [ebp - 0x4d4]
call fcn.00405470
add esp, 8
jmp 0x4042c8
mov ecx, 5
lea edx, [ebp - 0x4d0]
push edx
push 0
push ecx
push eax
push dword [ebp - 0x4dc]
push dword [ebp - 0x4f0]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x4042c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x20828
add edi, ecx
jmp 0x404d67
push dword [ebp - 0x4e4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
test eax, eax
je 0x404d55
lea eax, [ebp - 0x518]
push eax
push 1
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x404d55
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [ebp - 0x4d0]
push eax
push 1
push 2
push 0
push 0xf01ff
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x404d5b
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x4f0], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [edi + 0x2040c], 0
je 0x404343
push str.CreateRestrictedToken
push 1
push str.Advapi32.dll
call fcn.00401080
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44cafc], eax
test eax, eax
jne 0x40430a
mov dword [edi + 0x20828], 0x32
jmp 0x404d69
push dword [ebp - 0x4d0]
call fcn.00401170
mov esi, eax
add esp, 4
test esi, esi
jne 0x40432f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x20828], eax
jmp 0x404d69
push dword [ebp - 0x4d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4d0], esi
jmp 0x4043b5
cmp byte [edi + 0x2040d], 0
je 0x4043af
lea eax, [ebp - 0x56c]
push eax
push 4
lea eax, [ebp - 0x568]
push eax
push 0x12
push dword [ebp - 0x4d0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4043af
cmp dword [ebp - 0x568], 3
jne 0x4043af
lea eax, [ebp - 0x56c]
push eax
push 4
lea eax, [ebp - 0x570]
push eax
push 0x13
push dword [ebp - 0x4d0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4043af
push dword [ebp - 0x4d0]
call esi
mov esi, dword [ebp - 0x570]
mov dword [ebp - 0x4d0], esi
jmp 0x4043b5
mov esi, dword [ebp - 0x4d0]
cmp byte [edi + 0x2040b], 0
je 0x4044b2
cmp word [edi + 0x20422], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x5a4], xmm0
movlpd qword [ebp - 0x59c], xmm0
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x5b0], 0x20
mov dword [ebp - 0x5ac], 0
jne 0x404470
lea eax, [ebp - 0x4dc]
push eax
push esi
call fcn.00405360
mov esi, dword [ebp - 0x4dc]
lea eax, [ebp - 0x53c]
add esp, 8
mov dword [ebp - 0x4f8], 0x208
mov dword [ebp - 0x580], 0x208
push eax
lea eax, [ebp - 0x580]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x4f8]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
lea eax, [ebp - 0x218]
push esi
mov dword [ebp - 0x5a8], eax
call fcn.00405470
mov esi, dword [ebp - 0x4d0]
add esp, 4
jmp 0x40447c
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x5a8], eax
lea eax, [ebp - 0x5b0]
push eax
push esi
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
mov byte [ebp - 0x4c9], al
test al, al
je 0x4044b2
push 0
push dword [ebp - 0x4d0]
lea eax, [ebp - 0x4d8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
neg eax
sbb eax, eax
and dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4e8], 0
lea esi, [edi + 0x2040a]
jne 0x4046f6
cmp byte [esi], 0
je 0x4046f6
call fcn.004018d0
test eax, eax
je 0x40451f
mov dword [edi + 0x20828], 0x32
mov dword [edi + 0x20834], 0x65
cmp byte [ebp - 0x4c9], 0
je 0x404506
push dword [ebp - 0x594]
push dword [ebp - 0x4d0]
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov eax, dword [ebp - 0x4d8]
test eax, eax
je 0x404d69
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
jmp 0x404d69
lea eax, [edi + 0x2041c]
push eax
push dword [ebp - 0x4d0]
call fcn.004057d0
add esp, 8
test eax, eax
je 0x404540
mov dword [edi + 0x20828], eax
jmp 0x4044eb
cmp dword [0x44caf4], 0
je 0x40455f
cmp dword [edi + 0x2041c], 0
je 0x40455f
cmp byte [edi + 0x2040e], 0
je 0x404700
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push 0x60000
push 0
push str.winsta0
mov dword [ebp - 0x4e4], eax
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov dword [ebp - 0x524], eax
test eax, eax
je 0x4046e5
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
cmp byte [edi + 0x2040e], 0
push 0x60081
push 0
push 0
je 0x4045ab
push str.Winlogon
jmp 0x4045b0
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov dword [ebp - 0x4d4], eax
test eax, eax
je 0x4046e5
lea eax, [ebp - 0x4dc]
push eax
push dword [ebp - 0x4d0]
call fcn.00405360
add esp, 8
test eax, eax
je 0x4046d7
mov esi, dword [ebp - 0x4dc]
mov eax, dword [ebp - 0x524]
push esi
push eax
call fcn.00402db0
add esp, 8
test eax, eax
je 0x40431e
push esi
push dword [ebp - 0x4d4]
call fcn.00402ac0
add esp, 8
test eax, eax
je 0x40431e
cmp byte [edi + 0x2040e], 0
lea ecx, [ebp - 0x438]
je 0x404635
push str.winsta0winlogon
call fcn.00402650
mov byte [ebp - 4], 9
jmp 0x404643
push str.winsta0default
call fcn.00402650
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x438]
mov eax, dword [ebp - 0x428]
cmovae ecx, dword [ebp - 0x438]
lea ecx, [ecx + eax*2]
add ecx, 2
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
cmovae eax, dword [ebp - 0x438]
sub ecx, eax
sar ecx, 1
push ecx
push eax
push 0
lea ecx, [ebp - 0x564]
call fcn.004022e0
mov eax, dword [ebp - 0x564]
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 3
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x5ec], eax
call fcn.00402970
push dword [ebp - 0x4dc]
mov eax, 5
mov word [ebp - 0x5c4], ax
call fcn.00405470
mov eax, dword [ebp - 0x55c]
lea esi, [edi + 0x2040a]
add esp, 4
mov dword [ebp - 0x534], eax
push dword [ebp - 0x4d4]
call dword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x40470c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x20828], eax
jmp 0x4044eb
mov dword [edi + 0x2041c], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4e4], eax
push str.Wow64DisableWow64FsRedirection
push 1
push str.Kernel32.dll
call fcn.00401080
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44cae8], eax
test eax, eax
je 0x404739
lea ecx, [ebp - 0x5f8]
push ecx
call eax
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp byte [edi + 0x20408], 0
jne 0x4048e5
cmp dword [ebp - 0x4e8], 0
jne 0x404760
cmp byte [esi], 0
jne 0x4048e5
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
lea eax, [ebp - 0x57c]
push 0
push eax
lea eax, [ebp - 0x514]
mov dword [ebp - 0x57c], 0xc
push eax
lea eax, [ebp - 0x508]
mov dword [ebp - 0x574], 1
push eax
mov dword [ebp - 0x578], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push dword [ebp - 0x508]
call esi
push 0
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x510]
push eax
call edi
push 0
push 1
push dword [ebp - 0x500]
call esi
push 0
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x50c]
push eax
call edi
push 0
push 1
push dword [ebp - 0x50c]
call esi
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x5bc], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x5b4], eax
xor eax, eax
push 0x10
mov dword [ebp - 0x5c8], 0x101
mov word [ebp - 0x5c4], ax
call fcn.00409486
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x2c]
push 0
push 0
push eax
push 0x405630
mov dword [eax], edi
mov dword [eax + 0xc], esi
mov ecx, dword [ebp - 0x508]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x18]
push 0
push 0
mov dword [eax + 8], ecx
call fcn.0040ee0a
mov ecx, dword [ebp - 0x4e0]
push 0x10
mov dword [ecx], eax
call fcn.00409486
push 0
push 0
push eax
mov dword [eax], edi
mov dword [eax + 0xc], esi
mov ecx, dword [ebp - 0x500]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 8], ecx
push 0x405570
push 0
push 0
call fcn.0040ee0a
mov ecx, dword [ebp - 0x4e0]
push 0x10
mov dword [ecx + 4], eax
call fcn.00409486
push 0
push 0
push eax
push 0x405490
mov dword [eax], edi
mov dword [eax + 0xc], esi
mov ecx, dword [ebp - 0x50c]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x1c]
push 0
push 0
mov dword [eax + 8], ecx
call fcn.0040ee0a
mov ecx, dword [ebp - 0x4e0]
add esp, 0x54
mov edi, dword [ebp - 0x538]
mov dword [ecx + 8], eax
jmp 0x4048ef
mov dword [ebp - 0x5c8], 0
mov al, byte [edi + 0x20408]
test al, al
sete byte [ebp - 0x4e0]
test al, al
jne 0x404927
cmp dword [edi + 0x2041c], 0
je 0x404927
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [ebp - 0x4e0]
xor edx, edx
cmp al, 5
movzx ecx, cl
cmove ecx, edx
mov dword [ebp - 0x4e0], ecx
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x450]
mov eax, dword [ebp - 0x440]
cmovae ecx, dword [ebp - 0x450]
inc eax
cmp dword [ebp - 0x43c], 8
lea eax, [ecx + eax*2]
mov dword [ebp - 0x4e8], eax
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
xor esi, esi
mov dword [ebp - 0x4d4], eax
xor eax, eax
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x4e8]
sub eax, dword [ebp - 0x4d4]
sar eax, 1
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x4dc], eax
je 0x404a05
cmp eax, 0x7fffffff
ja 0x404ebd
lea esi, [eax + eax]
mov dword [ebp - 0x4f4], esi
cmp esi, 0x1000
jb 0x4049ba
push esi
call fcn.00402190
add esp, 4
mov esi, eax
jmp 0x4049cd
test esi, esi
je 0x4049cb
push esi
call fcn.004060dc
add esp, 4
mov esi, eax
jmp 0x4049cd
xor esi, esi
mov eax, dword [ebp - 0x4f4]
push esi
push dword [ebp - 0x4e8]
add eax, esi
mov dword [ebp - 0x45c], esi
push dword [ebp - 0x4d4]
mov dword [ebp - 0x454], eax
call fcn.00402290
mov eax, dword [ebp - 0x4dc]
add esp, 0xc
lea eax, [esi + eax*2]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x4e0]
mov ecx, dword [edi + 0x20410]
movzx eax, al
or ecx, 0x414
cmp word [edi + 0x10408], 0
mov dword [ebp - 0x4e0], eax
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x5f4]
mov dword [ebp - 0x4e8], 0
push eax
lea eax, [edi + 0x10408]
mov byte [ebp - 4], 0xb
cmove eax, dword [ebp - 0x4e8]
push eax
push dword [ebp - 0x4d8]
push ecx
push dword [ebp - 0x4e0]
push 0
push 0
push esi
push 0
push dword [ebp - 0x4d0]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x404b77
lea eax, [edi + 0x208]
push eax
lea ecx, [ebp - 0x498]
call fcn.00402650
push str..exe
push eax
lea eax, [ebp - 0x4b0]
mov byte [ebp - 4], 0xc
push eax
call fcn.004020e0
add esp, 0xc
lea ecx, [ebp - 0x480]
push eax
call fcn.00402a50
lea ecx, [ebp - 0x4b0]
call fcn.00402970
lea ecx, [ebp - 0x498]
call fcn.00402970
xor eax, eax
lea edx, [edi + 0x10408]
cmp word [edx], ax
lea ecx, [ebp - 0x480]
cmove edx, eax
mov eax, dword [edi + 0x20410]
lea edi, [ebp - 0x54c]
or eax, 0x414
cmp dword [ebp - 0x46c], 8
push edi
cmovae ecx, dword [ebp - 0x480]
lea edi, [ebp - 0x5f4]
push edi
push edx
push dword [ebp - 0x4d8]
push eax
push dword [ebp - 0x4e0]
push 0
push 0
push esi
push ecx
push dword [ebp - 0x4d0]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, dword [ebp - 0x538]
test eax, eax
jne 0x404b77
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp - 0x4c9], 0
mov dword [edi + 0x20828], eax
je 0x404b54
lea eax, [ebp - 0x5b0]
push eax
push dword [ebp - 0x4d0]
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov eax, dword [ebp - 0x4d8]
test eax, eax
je 0x404b64
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
push dword [ebp - 0x4d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x404d1c
cmp dword [ebp - 0x500], 0
je 0x404ba4
push dword [ebp - 0x510]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x514]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x524]
test eax, eax
je 0x404bc1
push eax
call dword [sym.imp.USER32.dll_CloseWindowStation]
push dword [ebp - 0x4e4]
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
cmp dword [edi + 0x20410], 0x100000
jne 0x404bdb
push dword [ebp - 0x54c]
call fcn.00401760
add esp, 4
movzx eax, word [edi + 0x20414]
mov ecx, 0xffff
cmp ax, cx
je 0x404c3d
push dword [edi + 0x20418]
push eax
push dword [ebp - 0x548]
call fcn.004017c0
add esp, 0xc
test eax, eax
jne 0x404c3d
push eax
push dword [ebp - 0x54c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x548]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x54c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x20828], eax
xor edi, edi
jmp 0x404d1c
mov eax, dword [edi + 0x20418]
test eax, eax
je 0x404c54
push eax
push dword [ebp - 0x54c]
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov eax, dword [ebp - 0x544]
push dword [ebp - 0x548]
mov dword [edi + 0x20828], 0
mov dword [edi + 0x20824], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x548]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x4c9], 0
je 0x404cda
cmp byte [edi + 0x20408], 0
je 0x404cb4
push dword [ebp - 0x594]
push dword [ebp - 0x4d0]
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push dword [ebp - 0x4d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404d06
mov ecx, dword [ebp - 0x558]
test ecx, ecx
je 0x404cc6
mov eax, dword [ebp - 0x594]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x520]
test ecx, ecx
je 0x404d06
mov eax, dword [ebp - 0x4d0]
mov dword [ecx], eax
jmp 0x404d06
push dword [ebp - 0x4d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x520]
test eax, eax
je 0x404cf6
mov dword [eax], 0
mov ecx, dword [ebp - 0x558]
test ecx, ecx
je 0x404d06
mov dword [ecx], 0
mov eax, dword [ebp - 0x4d8]
test eax, eax
je 0x404d16
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov edi, dword [ebp - 0x54c]
test esi, esi
je 0x404d6b
mov ecx, dword [ebp - 0x454]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x404d49
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ec2
push ecx
push esi
call fcn.0040610c
add esp, 8
jmp 0x404d6b
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
call dword [sym.imp.KERNEL32.dll_GetLastError]
add edi, 0x20828
mov dword [edi], eax
xor edi, edi
mov edx, dword [ebp - 0x52c]
test edx, edx
je 0x404da8
mov ecx, dword [ebp - 0x530]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x404d9e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ec2
push ecx
push edx
call fcn.0040610c
add esp, 8
mov ecx, dword [ebp - 0x46c]
cmp ecx, 8
jb 0x404de8
mov edx, dword [ebp - 0x480]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404dde
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ec2
push ecx
push edx
call fcn.0040610c
add esp, 8
mov ecx, dword [ebp - 0x43c]
xor eax, eax
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
cmp ecx, 8
jb 0x404e45
mov edx, dword [ebp - 0x450]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404e3b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ec2
push ecx
push edx
call fcn.0040610c
add esp, 8
mov edx, dword [ebp - 0x51c]
xor eax, eax
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
test edx, edx
je 0x404e9b
mov ecx, dword [ebp - 0x534]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x404e91
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404ec2
push ecx
push edx
call fcn.0040610c
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406096
mov esp, ebp
pop ebp
ret
call fcn.0040f0d0
call fcn.00405850
call fcn.0040f0d0
int3