Function at 0x4267f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e89b
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x43b28c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x38], eax
push 0x43b29c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x34]
call fcn.004012b0
mov dword [ebp - 4], 0
push 0x43b2ac
lea ecx, [ebp - 0x34]
call fcn.004013a0
mov eax, 1
test eax, eax
je 0x4268b7
lea ecx, [ebp - 0x34]
call fcn.004014a0
push eax
call fcn.00425600
add esp, 4
cmp eax, 1
jne 0x42689d
push str.Exit_login_user.
call fcn.0042a0d0
add esp, 4
jmp 0x4268b7
push str.waiting_for_login_user.
call fcn.0042a0d0
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42686f
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x40], 0
je 0x42693e
cmp dword [ebp - 0x38], 0
je 0x42693e
push 0x43b2e8
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
push 0x43b308
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
push 0x43b31c
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x48], eax
push 0x43b334
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x48], 0
je 0x42692a
cmp dword [ebp - 0x3c], 0
je 0x42692a
cmp dword [ebp - 0x14], 0
je 0x42692a
cmp dword [ebp - 0x44], 0
jne 0x42693e
push 0x43b344
call fcn.0042a070
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x40], 0
je 0x426d90
cmp dword [ebp - 0x10], 0
je 0x426d90
push 0x43b364
call fcn.0042a0d0
add esp, 4
call dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffff
jne 0x42697c
mov edx, dword [ebp - 0x50]
push edx
push 0x43b398
call fcn.0042a070
add esp, 8
mov eax, dword [ebp - 0x50]
push eax
push 0x43b3ac
call fcn.0042a0d0
add esp, 8
mov dword [ebp - 0x4c], 0
push 0x43b3c0
call fcn.0042a0d0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x43b3e8
call fcn.0042a0d0
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
push 0x43b40c
call fcn.0042a0d0
add esp, 8
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x50]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0x84], eax
push 0x43b428
call fcn.0042a0d0
add esp, 4
cmp dword [ebp - 0x84], 0
jne 0x426b17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43b440
call fcn.0042a070
add esp, 8
mov dword [ebp - 0xe0], 0
lea ecx, [ebp - 0xe0]
push ecx
lea edx, [ebp - 0xe4]
push edx
push 1
push 0
push 0
call dword [ebp - 0x48]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x426a7b
push 0x43b46c
call fcn.0042a070
add esp, 4
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x170], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401360
mov eax, dword [ebp - 0x170]
jmp 0x427009
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xe8], 0
jmp 0x426a9e
mov edx, dword [ebp - 0xe8]
add edx, 1
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0xe0]
jae 0x426b0d
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0xe8]
imul edx, edx, 0xc
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax + edx]
push ecx
call dword [ebp - 0x14]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jne 0x426af7
mov edx, dword [ebp - 0xe8]
imul edx, edx, 0xc
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax + edx]
push ecx
push 0x43b48c
call fcn.0042a0d0
add esp, 8
jmp 0x426b0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x43b4b0
call fcn.0042a070
add esp, 8
jmp 0x426a8f
mov edx, dword [ebp - 0xe4]
push edx
call dword [ebp - 0x44]
mov dword [ebp - 0xdc], 0
lea eax, [ebp - 0xdc]
push eax
push 1
push 1
push 0
push 0x2000000
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.DuplicateTokenEx__
call fcn.0042a0d0
add esp, 4
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x88], 0x30
push 0
mov edx, dword [ebp - 0xdc]
push edx
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x426b8c
mov ecx, dword [ebp - 0x88]
or ecx, 0x400
mov dword [ebp - 0x88], ecx
jmp 0x426ba3
mov dword [ebp - 0xd8], 0
push str.CreateEnvironmentBlock___Fail...
call fcn.0042a0d0
add esp, 4
push str.CreateEnvironmentBlock__
call fcn.0042a0d0
add esp, 4
lea ecx, [ebp - 0x7c]
call fcn.004012b0
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x7c]
call fcn.004013a0
push 0x10
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.004097d0
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0xd4]
push ecx
call fcn.004097d0
add esp, 0xc
mov dword [ebp - 0xd4], 0x44
mov dword [ebp - 0xcc], 0x43b530
push str.Call_CreateProcessAsUser___start...
call fcn.0042a0d0
add esp, 4
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0xd4]
push eax
push 0
mov ecx, dword [ebp - 0xd8]
push ecx
mov edx, dword [ebp - 0x88]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004014a0
push eax
mov ecx, dword [ebp - 0xdc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x426cbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xec], eax
mov edx, dword [ebp - 0xec]
push edx
push str.ERR:_CreateProcessAsUser_error..._d
call fcn.0042a010
add esp, 8
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0xd8]
push edx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov dword [ebp - 0x174], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7c]
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401360
mov eax, dword [ebp - 0x174]
jmp 0x427009
cmp dword [ebp + 0x10], 0
je 0x426ced
mov eax, dword [ebp - 0x58]
push eax
push str.the_wait_process_id_is__d
call fcn.0042a0d0
add esp, 8
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd8]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp dword [ebp + 0x10], 0
je 0x426d20
mov dword [ebp - 0x188], 0x4330ba
jmp 0x426d2a
mov dword [ebp - 0x188], 0x43b5a4
mov ecx, dword [ebp - 0x188]
push ecx
lea ecx, [ebp - 0x7c]
call fcn.004014a0
push eax
push 0x43b5a8
call fcn.0042a0d0
add esp, 0xc
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x178], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7c]
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401360
mov eax, dword [ebp - 0x178]
jmp 0x427009
push str.it_run_only_Win2000_and_autorun_call_process.
call fcn.0042a0d0
add esp, 4
push 0x44
push 0
lea ecx, [ebp - 0x16c]
push ecx
call fcn.004097d0
add esp, 0xc
mov dword [ebp - 0x16c], 0x44
push 0x10
push 0
lea edx, [ebp - 0x100]
push edx
call fcn.004097d0
add esp, 0xc
lea ecx, [ebp - 0x11c]
call fcn.004012b0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x11c]
call fcn.004013a0
mov dword [ebp - 0xf0], 0
push str.explorer.exe
call fcn.00425b30
add esp, 4
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
je 0x426ea1
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x16c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x11c]
call fcn.004014a0
push eax
mov ecx, dword [ebp - 0xf0]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x426e9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2ed
push str.LINE:__d_ERR:_CreateProcessAsUser_error..._d
call fcn.0042a010
add esp, 0xc
mov dword [ebp - 0x17c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11c]
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401360
mov eax, dword [ebp - 0x17c]
jmp 0x427009
jmp 0x426f21
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x16c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.004014a0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x426f21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2ff
push str.LINE:__d_ERR:_CreateProcess_error..._d
call fcn.0042a010
add esp, 0xc
mov dword [ebp - 0x180], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11c]
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401360
mov eax, dword [ebp - 0x180]
jmp 0x427009
lea ecx, [ebp - 0x11c]
call fcn.004014a0
push eax
push str.Path___s
call fcn.0042a0d0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
push str.command___s
call fcn.0042a0d0
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x426f74
push 0xffffffffffffffff
mov eax, dword [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x10], 0
je 0x426fa0
mov dword [ebp - 0x18c], 0x4330bb
jmp 0x426faa
mov dword [ebp - 0x18c], 0x43b678
mov edx, dword [ebp - 0x18c]
push edx
lea ecx, [ebp - 0x11c]
call fcn.004014a0
push eax
push str.Run__s_and__s_wait__SUC...
call fcn.0042a0d0
add esp, 0xc
mov dword [ebp - 0x184], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x11c]
call fcn.00401360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401360
mov eax, dword [ebp - 0x184]
jmp 0x427009
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret