Function at 0x10004310
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x8bc
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x8b4], eax
mov eax, dword [esp + 0x8c4]
push ebx
push ebp
mov ebp, dword [esp + 0x8c8]
push esi
push edi
xor ebx, ebx
push 0x40
lea edx, [esp + 0x60]
push ebx
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x64], ebx
call fcn.1001f410
xor eax, eax
add esp, 0xc
push 0x103
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x2b5]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov byte [esp + 0x2bc], bl
call fcn.1001f410
add esp, 0xc
push 0x103
lea ecx, [esp + 0x1ad]
push ebx
push ecx
mov byte [esp + 0x1b4], bl
call fcn.1001f410
add esp, 0xc
lea edi, [esp + 0x2b0]
call fcn.10011130
push 0x1002bdd0
mov edx, edi
push edx
lea eax, [esp + 0x1b0]
push str._s_s
push eax
call fcn.100182ad
push 3
push ebp
mov dword [esp + 0x70], 0x44
call fcn.1000d200
mov esi, eax
add esp, 0x18
cmp esi, ebx
jne 0x10004683
push 2
push ebp
call fcn.1000d200
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x10004683
push 1
push ebp
call fcn.1000d200
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x10004683
push 0x103
lea ecx, [esp + 0xa5]
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xac], bl
call fcn.1001f410
add esp, 0xc
push 0x3ff
lea edx, [esp + 0x4c5]
push ebx
push edx
mov byte [esp + 0x4cc], bl
call fcn.1001f410
add esp, 0xc
push ebp
push str._SessionMgr__Get_Session__d_token_error
push 0x2a9
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000be40
add esp, 0x14
push ebp
push str._SessionMgr__Get_Session__d_token_error
push 0x2a9
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x14
push 0x1002caf4
push 0x2ab
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000be40
push 0x1002caf4
push 0x2ab
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000bb50
mov eax, edi
call fcn.1000ca80
mov eax, edi
push eax
push str._sIsagentIsaCreateUserProcess.exe
lea ecx, [esp + 0xc8]
push 0x104
push ecx
call fcn.10018328
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [esp + 0x1ac]
push edx
push ebp
push str._d__s__d
lea eax, [esp + 0x4d0]
push 0x400
push eax
call fcn.10018328
lea ecx, [esp + 0x4d8]
push ecx
lea edx, [esp + 0xbc]
push edx
push str._s__Param:__s
push 0x2b0
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000be40
lea eax, [esp + 0x4f0]
push eax
lea ecx, [esp + 0xd4]
push ecx
push str._s__Param:__s
push 0x2b0
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x48
push 5
lea edx, [esp + 0x4c4]
push edx
lea eax, [esp + 0xa8]
push eax
lea edi, [esp + 0x1c]
call fcn.1000b940
add esp, 0xc
test eax, eax
je 0x10004643
mov esi, dword [esp + 0x10]
push 0x7530
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100045fb
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1000463c
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x1000463c
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x1000463c
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x100045e0
mov edx, dword [esp + 0x10]
mov dword [ecx], edx
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x100045ea
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10004ac6
push str.IsaCreateUserProcess
push 0x2cc
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000be40
push str.IsaCreateUserProcess
push 0x2cc
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x20
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._SessionMgr__Create_IsaHelp.exe_failed_
push 0x2d2
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000be40
push str._SessionMgr__Create_IsaHelp.exe_failed_
push 0x2d2
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x20
xor eax, eax
jmp 0x10004ac6
push 4
push ebx
call fcn.1000d200
add esp, 8
cmp eax, ebx
mov dword [esp + 0x34], eax
jne 0x100046dd
push str._SessionMgr__Get_System_Session__d_token_error
push 0x2da
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000be40
push str._SessionMgr__Get_System_Session__d_token_error
push 0x2da
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10004ac6
push esi
push eax
call fcn.1000e430
mov edi, eax
add esp, 8
cmp edi, ebx
mov dword [esp + 0x10], edi
jne 0x100049cb
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str._SessionMgr__create_high_privilege_token_error__0x
push 0x2e3
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000be40
add esp, 0x14
call edi
push eax
push str._SessionMgr__create_high_privilege_token_error__0x
push 0x2e3
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x14
push str._SessionMgr__use_low_privilege_token
push 0x2eb
push str..SessionMgr.c
mov dword [esp + 0x1c], esi
push ebx
mov ecx, str.CreateUserProcess
xor esi, esi
call fcn.1000be40
push str._SessionMgr__use_low_privilege_token
push 0x2eb
push str..SessionMgr.c
push ebx
mov ecx, str.CreateUserProcess
call fcn.1000bb50
push 0x103
lea eax, [esp + 0xc5]
push ebx
push eax
mov byte [esp + 0xcc], bl
call fcn.1001f410
add esp, 0x2c
push 0x103
lea ecx, [esp + 0x3bd]
push ebx
push ecx
mov byte [esp + 0x3c4], bl
call fcn.1001f410
add esp, 0xc
push 0x1002cc30
push 0x2f8
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
mov dword [esp + 0x24], ebx
call fcn.1000be40
push 0x1002cc30
push 0x2f8
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x20
lea edi, [esp + 0xa0]
call fcn.10011130
mov eax, edi
lea edi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10004800
sub eax, edi
cmp byte [esp + eax + 0x9f], 0x5c
jne 0x10004832
lea eax, [esp + 0xa0]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10004820
sub eax, edx
mov byte [esp + eax + 0x9f], bl
lea edx, [esp + 0xa0]
push edx
push str._c_cacls___s___E__T__G_Users:F
lea eax, [esp + 0x3c0]
push 0x103
push eax
call fcn.10018328
push ebx
lea ecx, [esp + 0x3cc]
push ecx
push 0x1002cc78
xor edi, edi
call fcn.1000b940
add esp, 0x1c
push 3
xor eax, eax
push 2
push 0xf003f
push str.Everyone
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x40]
push ecx
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x10004968
push 0x1002cc88
push 0x302
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000be40
push 0x1002cc88
push 0x302
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000bb50
mov edx, dword [esp + 0x34]
mov edi, dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
add esp, 0x20
push ebx
push edx
push ebx
push ebx
push 4
push 4
push str.MACHINESOFTWAREISA
call edi
push str._SessionMgr_
push 0x304
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000be40
push str._SessionMgr_
push 0x304
push str..SessionMgr.c
push 2
mov ecx, str.CreateUserProcess
call fcn.1000bb50
mov eax, dword [esp + 0x34]
add esp, 0x20
push ebx
push eax
push ebx
push ebx
push 4
push 4
push str.MACHINESOFTWAREASM
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esp + 0x10]
mov eax, edi
push ebx
push eax
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x100049d3
push str._SessionMgr__CreateEnvironmentBlock_fail
push 0x311
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000be40
push str._SessionMgr__CreateEnvironmentBlock_fail
push 0x311
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x20
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
xor eax, eax
jmp 0x10004ac6
cmp esi, ebx
je 0x1000496c
mov eax, esi
jmp 0x1000496e
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x2b8]
push edx
push eax
push 0x430
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1c8]
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], eax
jne 0x10004adf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x10004a5a
push str._SessionMgr__Create_IsaHelp.exe_failed_
push 0x31d
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000be40
push str._SessionMgr__Create_IsaHelp.exe_failed_
push 0x31d
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x20
lea edx, [esp + 0x1a8]
push edx
push str._SessionMgr__CreateProcessAsUser__s
push 0x32b
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000be40
add esp, 0x14
lea eax, [esp + 0x1a8]
push eax
push str._SessionMgr__CreateProcessAsUser__s
push 0x32b
push str..SessionMgr.c
push 1
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x14
mov ecx, dword [esp + 0x34]
push ecx
call edi
push esi
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x8c4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x8bc
ret
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10004aed
mov edx, dword [esp + 0x2c]
mov dword [eax], edx
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x10004afb
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov edx, dword [esp + 0x28]
push edx
call edi
mov eax, dword [esp + 0x2c]
push ebp
push eax
push str._SessionMgr__Create_user_session_sub_process_id:___d__in_Session:___d_
push 0x327
push str..SessionMgr.c
push 3
mov ecx, str.CreateUserProcess
call fcn.1000be40
mov ecx, dword [esp + 0x44]
push ebp
push ecx
push str._SessionMgr__Create_user_session_sub_process_id:___d__in_Session:___d_
push 0x327
push str..SessionMgr.c
push 3
mov ecx, str.CreateUserProcess
call fcn.1000bb50
add esp, 0x30
jmp 0x10004aa6