Function at 0x72b214
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b2961
mov eax, dword fs:[0]
push eax
mov eax, 0x2904
call fcn.006e6170
mov eax, dword [0x8cf144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 0x10], 0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2884], esi
mov dword [ebp - 0x288c], edi
je 0x72b7a6
xor ebx, ebx
mov dword [ebp - 0x28cc], ebx
mov dword [ebp - 0x28c8], ebx
mov dword [ebp - 0x28c4], ebx
push 0x61
pop ecx
mov esi, str.Xqcksg8gaN4LgvJJ5dvxFYtJCCDbltpJYc28HkZzZmlReKpe96D6Tzvd50MpEFe7Mk3vnYWgln0hnHr1Opa0WPOiAWZttQHaOZnkOfN7ELrvXutR856ff1qW3EsKerRnqeKjDrruwiKUCnIrCsZI6DczgtbBVRaahCfia6iQjvP9gr6iiNcoKMPjTSwgKuzqbFKIdXSbShV8X21FGRhUepmiyHsoSPb2kU78hLqmJhc6IbII1sMtSXonKpEkl2tcjieFRDDEeomuigsz7toTpiDHmxz6p7JySpBkjcTPiS8HImHaK5ZHapg9uzN1V65Pdc9vne4uf0M0GtLCoAO4HnRpG8VGXTFOVzAxheWUHnSr1XMHBLA0ICJ4OSzsP6cqnO6fmN
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x838]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x2868]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x2868]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28cc]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x2868]
call fcn.006eb1be
push 0x2000
lea eax, [ebp - 0x2838]
mov dword [ebp - 0x2890], ebx
push ebx
push eax
mov dword [ebp - 0x2888], ebx
call fcn.007512b0
push dword [ebp - 0x288c]
lea eax, [ebp - 0x2838]
push dword [ebp - 0x2884]
push str.__s___s
push eax
call fcn.00407f20
add esp, 0x1c
mov dword [ebp - 0x28a8], ebx
mov dword [ebp - 0x28a4], ebx
mov dword [ebp - 0x28a0], ebx
push 0x54
pop ecx
mov esi, str.UOIbcvk06Srvg1F5RK3noXJnAUDMsVBUbFmJ1ZiIDialSnNjbAgvkSrw3LMjzezHe02NfjqNhn1cQ7K6jy6DyYJhw4iVmq9PTLLMBFyZb56ETrTStiohFUwlVf0xZ1LmBByiyXmaCzzATh3rO1li0Sai3AdPsR1Y5YbnKIAU7MUCPRwFZfUtnOR82CDdPAsedoMJBG9vPfN2aRViHTN9SG0EQFZjhyO6GtLgGww2ziA7EsjtuuFSnmPkBy4SN6ggT5ZFOwk7t3YlLICUhO55pv8ux22AqPFieVaIA7JaN4BiTuX8ZdF8SdhmEs0bnnLiuTZFjwSgQQr0pEZv6t
mov byte [ebp - 4], 2
lea edi, [ebp - 0x550]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x2868]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x2868]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28a8]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x2868]
mov byte [ebp - 4], 2
call fcn.006eb1be
push str.EXPLORER.EXE
call fcn.0072bc61
pop ecx
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x2884], edi
test edi, edi
jne 0x72b39a
lea ecx, [ebp - 0x28a8]
mov byte [ebp - 4], bl
call fcn.006eb210
jmp 0x72b747
lea eax, [ebp - 0x2890]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x72b6cb
mov dword [ebp - 0x28b4], ebx
mov dword [ebp - 0x28b0], ebx
mov dword [ebp - 0x28ac], ebx
push 0x4e
pop ecx
mov esi, str.22D6fHAdt8QKqLVAINtyzNvlLpcE6k4fwpcZX9QMuDNZYPcj1KosmpKqFhpsVb49GBCIrggXQGaeCBbbZkCdulQ8oDCNdttCTV8l3Rd2qE4JIuPocoa0LDqdYpqHckkfvzAVC4EtbqAUTAKoTB47bW6SYQEKjdSE56pkaAI7vM0aNlUPslnuDwZ3BuBHr1U3GzMqfc66nrvbpdwrvhs9GNIekXhW51GnAcv0EDCSecgdVGJmAwSJyE0L8gypqplq6rFG1Dbvh8dup7bjVK8sJh8a1K6JWJ0QFNtCuBwxV3tMNzFCXcMMW6G
mov byte [ebp - 4], 4
lea edi, [ebp - 0x3fc]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3fc]
push eax
lea ecx, [ebp - 0x2868]
call fcn.00405a00
push 5
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x28b4]
lea eax, [ebp - 0x2868]
push eax
call fcn.00407ea0
xor edi, edi
mov byte [ebp - 4], 4
push ebx
inc edi
lea ecx, [ebp - 0x2868]
push edi
call fcn.006eb1be
lea eax, [ebp - 0x2888]
push eax
push edi
push edi
push ebx
push 0xf01ff
push dword [ebp - 0x2890]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x72b6c1
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x28c0], eax
test eax, eax
je 0x72b593
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28b8], eax
test eax, eax
je 0x72b587
mov dword [ebp - 0x289c], ebx
mov dword [ebp - 0x2898], ebx
mov dword [ebp - 0x2894], ebx
push 0x5f
pop ecx
mov esi, str.h2JVvLWYW0MD6YVUB1VXVaFWiPYR9DbdCYgxIPFAvSudd7qiDt4DOg0g3Lu07b5w4e3VJeSw8DR0KDyImLILmZrujG8NJOps81chz4AzRs6VZdAfCElCezU568OYfDuKYeMXdJQYX0m7SpSV8bGSBi3xUxQ5HNzBw1jTqdt7Xn8mveulx4pStqWQb4BUu3vvaL53JTZ5QzeFLODsb04Vlew9tMGVUzd5d7IKjg9lsSyycF1wjNwaIbV2PRxbNQ1s5xlWH6U0Ym6DM3uq8PHwX02PFQkK2wPtE0CpocXKiy5a4UmL1cx3pn34uqwRKPJv8jyMODS4lp3agcr8HecEuyZFoaTdNlEUDxJVMwY7flLo4bxOmPf83NnlGE96
mov byte [ebp - 4], 6
lea edi, [ebp - 0x274]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x2850]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x2850]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x289c]
call fcn.00407ea0
xor edi, edi
mov byte [ebp - 4], 6
push ebx
inc edi
lea ecx, [ebp - 0x2850]
push edi
call fcn.006eb1be
call dword [ebp - 0x28b8]
push 4
mov dword [ebp - 0x28bc], eax
lea eax, [ebp - 0x28bc]
push eax
push 0xc
push dword [ebp - 0x2888]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x72b578
mov dword [ebp - 0x2844], ebx
mov dword [ebp - 0x2840], ebx
mov dword [ebp - 0x283c], ebx
push 0x38
pop ecx
mov esi, str.oNNtYxHmbOdaTbF6mQBpBfmk65kGcpQZj3nFRrTPcOXhwpYhPbagbG2mqeaCQDEw0HK86kXsPwb04OXmOCNUmTQTRMHvxeIAvzv0acJjr4IiQULWJ3p1NXkW1v1o049HTUwpGnhagSz8seN1VWBgApo12lNo3j1X3RAhL3PDE1AgegPpEF3YkNebVyld73sD1T8yk1nipFbaDw8LOegLAwj08nt4Z4fNW
mov byte [ebp - 4], 8
lea edi, [ebp - 0xf4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x2880]
movsw word es:[edi], word [esi]
call fcn.00405a00
lea eax, [ebp - 0x2880]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x2844]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x2880]
call fcn.006eb1be
lea ecx, [ebp - 0x2844]
call fcn.006eb210
lea ecx, [ebp - 0x289c]
call fcn.006eb210
lea ecx, [ebp - 0x28b4]
jmp 0x72b72e
lea ecx, [ebp - 0x289c]
mov byte [ebp - 4], 4
call fcn.006eb210
push dword [ebp - 0x28c0]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00402330
push 0x44
pop esi
push esi
lea eax, [ebp - 0x2910]
push ebx
push eax
call fcn.007512b0
push 0x10
lea eax, [ebp - 0x2860]
push ebx
push eax
call fcn.007512b0
add esp, 0x18
mov dword [ebp - 0x2910], esi
call fcn.006f3274
push 5
pop eax
mov dword [ebp - 0x2908], str.WinSta0Default
mov word [ebp - 0x28e0], ax
mov dword [ebp - 0x28e4], edi
mov dword [ebp - 0x288c], ebx
mov dword [ebp - 0x289c], ebx
mov dword [ebp - 0x2898], ebx
mov dword [ebp - 0x2894], ebx
push 0x58
pop ecx
mov esi, str.JptoEdlvaYeteA2ShsQo2bwg0nIhS1YBrw14BJEHdSvPygMp0QoDrf9o4c8iiZfkbcBYGPd80bwAVRvqPJx14trhYMzgVw2aO7jW3a8j2FEhQKEClqBefkmHaOTRI15AiElY0R775LlA1HDle94xjfA1HsshzpFZbooEwIaLrTp6zhg6MpsvqzEcqNk39DH0nNUv7eASzxzixHsN5Lz9WicluDq5HgHcw9TvrQ3M67YvkKsUlcGCHzINPoccUko7fiJgdCGlzKzUw7ePjFzojRlMsQX0XwTugWm3DZn78vSnPgiayqp9HMI9h3fDBjRmH73qx6N7AvW9JQIPEwJ9dTFvHpj66PT
mov byte [ebp - 4], 0xa
lea edi, [ebp - 0x6b0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6b0]
push eax
lea ecx, [ebp - 0x2880]
call fcn.00405a00
lea eax, [ebp - 0x2880]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x289c]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x2880]
mov byte [ebp - 4], 0xa
call fcn.006eb1be
push ebx
push dword [ebp - 0x2888]
lea eax, [ebp - 0x288c]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x72b562
call fcn.006f1e2e
lea eax, [ebp - 0x2860]
push eax
lea eax, [ebp - 0x2910]
push eax
push ebx
push dword [ebp - 0x288c]
lea eax, [ebp - 0x2838]
push 0x430
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x2888]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x72b562
call fcn.00402330
cmp dword [ebp - 0x288c], 0
je 0x72b562
push dword [ebp - 0x288c]
call sub.USERENV.dll_DestroyEnvironmentBlock
jmp 0x72b562
call fcn.006f38e2
jmp 0x72b56d
mov dword [ebp - 0x2844], ebx
mov dword [ebp - 0x2840], ebx
mov dword [ebp - 0x283c], ebx
push 0x73
pop ecx
mov esi, str.vJhkbuBUcFiTtuSWWJon7YyEADkWcxJ02kN6OQWNGq0ssSxI5N8uN2Okh8eUKzCu7geeABIMFCBeRgepEueqPfarxvgmEJdKCzpIACqEJ5VPC62ML2vQDyCDhb8yNn8qTAgeHCfZCEEC5nLYWsHTkzevQK8gJB97ce7DzfVtcVG6lcN1jH8smiBtDPZVbJSLNNPvOSSFbUETaJUo48IEDhwtURFKkD5Uy2P4NMSvM0dkO9T6iwzbVGDnPR8hm4TDQu5nHUdn7QmNIVAwvqojOT8BUerhy8AjAocFlRByt9f4lol5RwU9nn4HtOcukjA9Wln5l9tdW6VLj53nlshXID5Btw7htz4eIHKc9LlzXxgeTzYZPv7Nvvjfor6BGKguYcacD0ZK9XyJkosSyDY9KzZu8ZN26R6GqisMD8ztv5cKCITiVzMn6LvcM1bb5seJoaBVMpA4Oq2L
mov byte [ebp - 4], 0xc
lea edi, [ebp - 0x2c4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x2880]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x2880]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x2844]
call fcn.00407ea0
push ebx
push 1
lea ecx, [ebp - 0x2880]
call fcn.006eb1be
lea ecx, [ebp - 0x2844]
call fcn.006eb210
lea ecx, [ebp - 0x28a8]
mov byte [ebp - 4], bl
call fcn.006eb210
mov edi, dword [ebp - 0x2884]
cmp dword [ebp - 0x2888], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x72b76c
cmp dword [ebp - 0x2888], 0xffffffff
je 0x72b76c
call fcn.006ec5ad
push dword [ebp - 0x2888]
call esi
cmp dword [ebp - 0x2890], 0
je 0x72b78b
cmp dword [ebp - 0x2890], 0xffffffff
je 0x72b78b
call fcn.00402330
push dword [ebp - 0x2890]
call esi
test edi, edi
jne 0x72b797
call fcn.00402330
push ebx
call esi
lea ecx, [ebp - 0x28cc]
call fcn.006eb210
xor al, al
jmp 0x72b7be
call fcn.006f3fd9
xor ebx, ebx
push ebx
push ebx
push edi
push esi
call fcn.0072ac27
add esp, 0x10
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006e615c
mov esp, ebp
pop ebp
ret