Function at 0x450dc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x694
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x644], 1
mov dword [ebp - 0x214], 0xffffffff
mov dword [ebp - 0x63c], 0xffffffff
mov dword [ebp - 0x640], 0xffffffff
mov word [ebp - 0x638], 0
push 0x206
push 0
lea eax, [ebp - 0x636]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x430], 0
push 0x206
push 0
lea ecx, [ebp - 0x42e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x430]
push eax
push 0
call fcn.0044ecf0
add esp, 0xc
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x450eae
push 0xd2f
push 0x476fe0
call fcn.0044dfd0
add esp, 8
push eax
push str.HELP::GetModuleDir_NULL__szwWork__MAX_PATH_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x451131
lea ecx, [ebp - 0x430]
push ecx
push 0x104
lea edx, [ebp - 0x638]
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push 0x47701c
push 0x104
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x477020
push 0x104
lea ecx, [ebp - 0x638]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x690]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x690], 0x44
push 0x10
push 0
lea eax, [ebp - 0x224]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x660], 0
mov dword [ebp - 0x664], 1
lea ecx, [ebp - 0x640]
push ecx
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x450f9a
push 0xd3a
push 0x47703c
call fcn.0044dfd0
add esp, 8
push eax
push str.OpenProcessToken_GetCurrentProcess____TOKEN_ALL_ACCESS__TokenHandle_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x451131
lea edx, [ebp - 0x63c]
push edx
push 1
push 2
push 0
push 0x2000000
mov eax, dword [ebp - 0x640]
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x450ff9
push 0xd3b
push 0x477098
call fcn.0044dfd0
add esp, 8
push eax
push str.DuplicateTokenEx_TokenHandle__MAXIMUM_ALLOWED__NULL__SecurityImpersonation__TokenPrimary__DupHandle_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x451131
mov dword [ebp - 0x648], 0
push 1
mov ecx, dword [ebp - 0x63c]
push ecx
lea edx, [ebp - 0x648]
push edx
call sub.USERENV.dll_CreateEnvironmentBlock
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x451058
push 0xd3f
push 0x477110
call fcn.0044dfd0
add esp, 8
push eax
push str.CreateEnvironmentBlock_pEnv__DupHandle__TRUE_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x451131
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x690]
push ecx
push 0
mov edx, dword [ebp - 0x648]
push edx
push 0x8000420
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x638]
push eax
mov ecx, dword [ebp - 0x63c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x4510d9
call sub.Comn.dll_GetObjectLog
mov dword [ebp - 0x694], eax
push 0xd4e
push 0x477150
call fcn.0044dfd0
add esp, 8
push eax
push str._s:_Failed_to_start_ABCore.exe
mov edx, dword [ebp - 0x694]
push edx
mov eax, dword [ebp - 0x694]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
jne 0x451119
push 0xd51
push str..helper.cpp
call fcn.0044dfd0
add esp, 8
push eax
push str.bResult
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x451131
mov ecx, dword [ebp - 0x648]
push ecx
call sub.USERENV.dll_DestroyEnvironmentBlock
mov edx, dword [ebp - 0x224]
mov dword [ebp - 0x214], edx
cmp dword [ebp - 0x640], 0xffffffff
je 0x451151
mov eax, dword [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x640], 0xffffffff
cmp dword [ebp - 0x63c], 0xffffffff
je 0x451171
mov ecx, dword [ebp - 0x63c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x63c], 0xffffffff
cmp dword [ebp - 0x214], 0xffffffff
je 0x451191
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x214], 0xffffffff
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret