Function at 0x42ade0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x4e500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x290], ecx
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ae24
mov ecx, dword [ebp + 0x18]
push ecx
push str.Not_found__s
push 0x4e7f50
call fcn.00427440
add esp, 0xc
xor eax, eax
jmp 0x42b284
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x228], 0xffffffff
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x42ae7b
mov ecx, 0x4e7f50
call fcn.004276f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push str.Run__s___WTSQueryUserToken_Fail__0x_08x_
push 0x4e7f50
call fcn.00427440
add esp, 0x10
xor eax, eax
jmp 0x42b284
cmp dword [ebp + 0x10], 0
je 0x42af91
mov dword [ebp - 0x210], 0
lea edx, [ebp - 0x210]
push edx
push 4
lea eax, [ebp - 0x230]
push eax
push 0x13
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x42aee6
mov ecx, 0x4e7f50
call fcn.004276f0
mov edx, dword [ebp + 0x18]
push edx
push str.Run__s___GetTokenInformation_TokenLinkedToken__Fail
push 0x4e7f50
call fcn.00427440
add esp, 0xc
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42b284
mov dword [ebp - 0x210], 0
lea ecx, [ebp - 0x210]
push ecx
push 4
lea edx, [ebp - 0x214]
push edx
push 0x14
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x42af54
mov ecx, 0x4e7f50
call fcn.004276f0
mov ecx, dword [ebp + 0x18]
push ecx
push str.Run__s___GetTokenInformation_TokenElevation__Fail
push 0x4e7f50
call fcn.00427440
add esp, 0xc
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42b284
cmp dword [ebp - 0x214], 0
je 0x42af78
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x228], edx
jmp 0x42af91
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x228], ecx
xor edx, edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x224], 0xc
mov dword [ebp - 0x22c], 0xffffffff
lea eax, [ebp - 0x22c]
push eax
push 1
push 3
lea ecx, [ebp - 0x224]
push ecx
push 0xf01ff
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x42b015
mov ecx, 0x4e7f50
call fcn.004276f0
mov eax, dword [ebp + 0x18]
push eax
push str.Run__s___DuplicateTokenEx_Fail
push 0x4e7f50
call fcn.00427440
add esp, 0xc
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42b284
cmp dword [ebp + 0x14], 0
je 0x42b082
mov dword [ebp - 0x218], 1
push 4
lea edx, [ebp - 0x218]
push edx
push 0x1a
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x42b082
mov ecx, 0x4e7f50
call fcn.004276f0
mov ecx, dword [ebp + 0x18]
push ecx
push str.Run__s___SetTokenInformation_TokenUIAccess__Fail
push 0x4e7f50
call fcn.00427440
add esp, 0xc
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42b284
mov dword [ebp - 0x234], 0
push 0
mov ecx, dword [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x42b0cb
mov ecx, 0x4e7f50
call fcn.004276f0
mov eax, dword [ebp + 0x18]
push eax
push str.Run__s___CreateEnvironmentBlock_Fail
push 0x4e7f50
call fcn.00427440
add esp, 0xc
jmp 0x42b264
push 0x44
push 0
lea ecx, [ebp - 0x288]
push ecx
call fcn.00487cb0
add esp, 0xc
mov dword [ebp - 0x288], 0x44
mov dword [ebp - 0x280], str.winsta0default
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x238], edx
mov ax, word [0x4db944]
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.00487cb0
add esp, 0xc
cmp dword [ebp + 0x1c], 0
je 0x42b158
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
push str.__s___s
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00425c60
add esp, 0x14
jmp 0x42b175
mov edx, dword [ebp + 0x18]
push edx
push str.__s_
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00425c60
add esp, 0x10
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push str.CreateProcessAsUser__s__s
push 0x4e7f50
call fcn.00427440
add esp, 0x10
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x288]
push ecx
push 0
mov edx, dword [ebp - 0x234]
push edx
push 0x400
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x42b1fd
mov ecx, 0x4e7f50
call fcn.004276f0
mov eax, dword [ebp + 0x18]
push eax
push str.Run__s___CreateProcessAsUser_Fail
push 0x4e7f50
call fcn.00427440
add esp, 0xc
jmp 0x42b257
cmp dword [ebp + 0xc], 0
jne 0x42b231
cmp dword [ebp - 0x240], 0
je 0x42b219
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x244], 0
je 0x42b22f
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42b257
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x244]
mov dword [eax], ecx
mov edx, dword [ebp - 0x240]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x23c]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x238]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a792
mov esp, ebp
pop ebp
ret 0x18