Function at 0x46122f
Capabilities:
Create process on windows

Disassembly:
push 0x14c
mov eax, 0x51bd12
call fcn.004d8af2
mov ebx, ecx
mov dword [ebp - 0x134], ebx
mov eax, dword [ebp + 0x10]
xor esi, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x130], esi
lea eax, [ebp - 0x130]
push eax
push 1
push 3
push esi
push 0xf01ff
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x461304
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x34d
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x144]
call fcn.00406620
lea eax, [ebp - 0x144]
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x13c]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x130], esi
je 0x4612f9
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x130], esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
jmp 0x461579
mov dword [ebp - 0x134], esi
push 1
mov byte [ebp - 4], 3
lea eax, [ebp - 0x134]
push dword [ebp - 0x130]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x4613a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x351
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x144]
call fcn.00406620
lea eax, [ebp - 0x144]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x13c]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x134], 0
je 0x461399
push dword [ebp - 0x134]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov dword [ebp - 0x134], esi
cmp dword [ebp - 0x130], 0
jmp 0x46155f
lea ecx, [ebp - 0x12c]
call fcn.0042b0ee
cmp dword [eax + 4], 6
jae 0x461492
lea ecx, [ebp - 0x144]
call fcn.00461095
mov byte [ebp - 4], 5
cmp dword [ebp - 0x144], 0
jge 0x461480
cmp dword [ebp - 0x140], 0
mov eax, 0x357
mov edi, dword [ebp - 0x13c]
cmovne eax, dword [ebp - 0x140]
push eax
push dword [ebp - 0x144]
push ecx
mov esi, esp
lea ecx, [edi - 0x10]
mov dword [ebp - 0x138], esi
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x154]
mov dword [esi], eax
call fcn.00406620
lea eax, [ebp - 0x154]
mov byte [ebp - 4], 6
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x14c]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
cmp dword [ebp - 0x134], 0
je 0x46145b
push dword [ebp - 0x134]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
and dword [ebp - 0x134], 0
cmp dword [ebp - 0x130], 0
je 0x461573
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x130], 0
jmp 0x461573
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x13c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x134]
cmp dword [eax - 4], 1
jle 0x4614af
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00406d8c
mov eax, dword [ebp + 8]
push dword [ebp - 0x148]
mov ecx, dword [ebp + 0x14]
push edi
push dword [ebp - 0x138]
or ecx, 0x1000400
push esi
push ecx
xor esi, esi
push esi
push esi
push esi
push eax
push esi
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x461532
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x368
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x154]
call fcn.00406620
lea eax, [ebp - 0x154]
mov byte [ebp - 4], 7
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x14c]
jmp 0x461376
lea ecx, [ebx + 8]
mov dword [ebx], esi
mov dword [ebx + 4], esi
call fcn.0040687a
cmp dword [ebp - 0x134], esi
je 0x461559
push dword [ebp - 0x134]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov dword [ebp - 0x134], esi
cmp dword [ebp - 0x130], esi
je 0x461573
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x130], esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
call fcn.004d8aa1
ret