Function at 0x4014c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x8a4
mov eax, dword [0x434c44]
xor eax, esp
mov dword [esp + 0x89c], eax
mov eax, dword [esp + 0x8a8]
push ebx
push ebp
push esi
push edi
push 0x44
xor edi, edi
lea ecx, [esp + 0x44]
push edi
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 0x64
call fcn.00414210
xor eax, eax
xor edx, edx
add esp, 0xc
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x44
mov word [esp + 0x72], dx
mov dword [esp + 0x6c], 1
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x68], edi
call fcn.004024b0
push str.kernel32.dll
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
jne 0x40156f
push str.Load_Library_Error...
call fcn.00402360
mov eax, dword [esp + 0x18]
jmp 0x40187c
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42dcec
push esi
call ebx
call eax
push 0x206
mov ebp, eax
lea ecx, [esp + 0x49e]
xor eax, eax
push edi
push ecx
mov word [esp + 0x4a4], ax
call fcn.00414210
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__d__d
lea edx, [esp + 0x4a4]
call fcn.004049f0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call ebx
mov esi, eax
mov dword [esp + 0x1c], edi
cmp esi, edi
je 0x401656
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [esp + 0x1c], edi
je 0x401656
push str.64_Bit_OS
call fcn.00402360
add esp, 4
push 0x104
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x6a4]
push 0x104
push edx
call fcn.0041200f
add esp, 0xc
push str._syswow64wtsapi32.dll
lea eax, [esp + 0x6a4]
push 0x104
push eax
call fcn.0041207e
add esp, 0xc
lea ecx, [esp + 0x6a0]
push ecx
jmp 0x40165b
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x40186d
push str.WTSQueryUserToken
push esi
call ebx
mov dword [0x438b60], eax
cmp eax, edi
je 0x401853
lea edx, [esp + 0x18]
push edx
push ebp
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401770
call ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 1
push edi
push edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
cmp ecx, edi
jbe 0x4016c6
cmp dword [eax + 8], edi
jne 0x4016be
mov ebp, dword [eax]
add eax, 0xc
sub ecx, 1
jne 0x4016b7
lea edx, [esp + 0x18]
push edx
push ebp
call dword [0x438b60]
test eax, eax
jne 0x401705
push ebp
call ebx
push eax
push str.WTSQueryUserToken_Error__d__d
lea edx, [esp + 0x94]
call fcn.004049f0
add esp, 0xc
lea eax, [esp + 0x88]
push eax
call fcn.00402360
mov eax, 1
jmp 0x40187c
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 1
push 1
push edi
push 0x2000000
push edx
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40173b
push str.DuplicateTokenEx_FAILED_2
call fcn.00402360
mov eax, 2
jmp 0x40187c
mov eax, dword [esp + 0x1c]
push edi
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x401768
push str.CreateEnvironmentBlock_FAILED_3
call fcn.00402360
mov eax, 3
jmp 0x40187c
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x44]
push ecx
push edi
push edi
push 0x30
push edi
push edi
push edi
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4017ef
push str.Launch_Success
call fcn.00402360
add esp, 4
cmp dword [esp + 0x8bc], edi
je 0x4017d0
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x14], 1
jne 0x40183b
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x14]
jmp 0x40187f
push 0x206
lea edx, [esp + 0x296]
xor ecx, ecx
push edi
push edx
mov word [esp + 0x29c], cx
call fcn.00414210
add esp, 0xc
call ebx
push eax
push str.CreateProcessAsUser_Failed_:__d
lea edx, [esp + 0x298]
call fcn.004049f0
lea eax, [esp + 0x298]
push eax
call fcn.00402360
add esp, 0xc
mov dword [esp + 0x14], 4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x14]
jmp 0x40187f
push str.GetProcAddress_Failed_for_WTSQueryUserToken
call fcn.00402360
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x14]
jmp 0x40187f
push str.Failed_to_LoadLibrary_wtsapi32.dll
call fcn.00402360
mov eax, 5
add esp, 4
mov ecx, dword [esp + 0x8ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00411cc8
add esp, 0x8a4
ret