Function at 0x404180
Capabilities:
Create process on windows
Get common file path
Print debug messages
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ea56
mov eax, dword fs:[0]
push eax
mov eax, 0x1880
call fcn.004f93f0
mov eax, dword [0x5635b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1838], ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1820], eax
call fcn.00408e92
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4041e1
push 0x80004005
call fcn.004010e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x1814], ebx
movzx edx, byte [ebp + 0x18]
neg edx
push 0
sbb edx, edx
lea ecx, [ebp - 0x1824]
push ecx
and edx, 0xfffe0000
push 1
add edx, 0x40000
push edx
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_SaferCreateLevel]
test eax, eax
je 0x4044e6
mov edx, dword [ebp - 0x1824]
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x1818]
push ecx
push eax
push edx
mov dword [ebp - 0x1818], eax
mov dword [ebp - 0x181c], eax
call dword [sym.imp.ADVAPI32.dll_SaferComputeTokenFromLevel]
test eax, eax
je 0x404476
push str.S_1_16_12288
lea ecx, [ebp - 0x1828]
call fcn.004030b0
mov ecx, dword [ebp - 0x1828]
lea eax, [ebp - 0x182c]
push eax
push ecx
mov byte [ebp - 4], 1
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x4042c3
mov eax, dword [ebp - 0x182c]
mov dword [ebp - 0x1830], 0
push eax
mov dword [ebp - 0x1830], 0x20
mov dword [ebp - 0x1834], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
mov eax, dword [ebp - 0x1818]
lea edx, [ebp - 0x1834]
push edx
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push 0x44
lea ecx, [ebp - 0x188c]
push 0
push ecx
call fcn.004f9330
movzx edx, byte [ebp + 0x14]
mov ecx, dword [esi]
add esp, 0xc
neg edx
sbb edx, edx
and edx, 5
mov dword [ebp - 0x188c], 0x44
mov dword [ebp - 0x1860], 1
mov word [ebp - 0x185c], dx
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x404348
jns 0x404311
push 0x80070057
call fcn.004010e0
cmp word [ecx], 0x22
je 0x404348
lea edx, [eax - 1]
test edx, edx
js 0x404307
cmp edx, eax
jg 0x404307
cmp word [ecx + edx*2], 0x22
je 0x404348
mov eax, dword [ebp - 0x1820]
mov ecx, dword [eax]
mov edx, dword [esi]
push ecx
push edx
push str.__s___s
push 0x800
lea eax, [ebp - 0x1810]
push eax
jmp 0x404365
mov ecx, dword [ebp - 0x1820]
mov edx, dword [ecx]
mov eax, dword [esi]
push edx
push eax
push str._s__s
push 0x800
lea ecx, [ebp - 0x1810]
push ecx
call fcn.004f93aa
add esp, 0x14
lea edx, [ebp - 0x810]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
je 0x404394
push eax
call esi
test eax, eax
je 0x4043fd
lea eax, [ebp - 0x1848]
push eax
mov eax, dword [ebp - 0x1818]
lea ecx, [ebp - 0x188c]
push ecx
push 0
push 0
push 0x1000000
push 0
push 0
push 0
lea edx, [ebp - 0x1810]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ecx, dword [edi]
cmp eax, 1
sete bl
cmp dword [ecx - 0xc], 0
je 0x4043de
lea edx, [ebp - 0x810]
push edx
call esi
test bl, bl
je 0x4043fd
mov ecx, dword [ebp - 0x1844]
mov eax, dword [ebp - 0x1848]
push ecx
mov dword [ebp - 0x181c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40442c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x1810]
push edx
lea eax, [ebp - 0x1814]
push str.CreateProcessAsUser__s__failed_with_error__u.
push eax
call fcn.00402d20
mov ecx, dword [ebp - 0x1814]
add esp, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x182c]
test eax, eax
je 0x40444a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x1828]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404470
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x1814]
mov ecx, dword [ebp - 0x1824]
push ecx
call dword [sym.imp.ADVAPI32.dll_SaferCloseLevel]
mov esi, dword [ebp - 0x181c]
test esi, esi
jne 0x4044a6
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4044fd
cmp byte [ebp + 0x1c], 0
je 0x4044b8
mov ecx, dword [ebp - 0x1838]
push esi
call fcn.00403af0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4044e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
jmp 0x40450b
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404509
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f931e
mov esp, ebp
pop ebp
ret 0x18