Function at 0x4b6000
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
push esi
push edi
push 0x44
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c], edx
xorps xmm0, xmm0
mov dword [esp + 0x24], ecx
push 0
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x3c], xmm0
call fcn.00587250
mov esi, dword [ebp + 0xc]
add esp, 0xc
cmp esi, 5
je 0x4b606e
test esi, esi
je 0x4b616e
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x4b60ab
test esi, esi
je 0x4b616e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
push ecx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4b60b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x2d6
mov edx, 0x62612c
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push eax
push 1
push 2
push 0
push 0x2000000
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4b6100
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x2d7
mov edx, 0x62614c
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp esi, 5
push 4
cmove eax, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 0xc
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x4b615d
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x14]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 0x2d9
mov edx, 0x62616c
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 2
mov eax, str.Winsta0Winlogon
cmovne eax, dword [esp + 0x50]
mov dword [esp + 0x50], eax
mov edi, dword [ebp + 8]
test edi, edi
je 0x4b6233
mov eax, dword [edi]
test eax, eax
je 0x4b6233
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x4b6193
mov dword [esp + 0xc], eax
jmp 0x4b6233
xor esi, esi
mov eax, edi
xor ecx, ecx
mov dword [esp + 0x24], ecx
nop dword [eax]
mov eax, dword [eax]
test eax, eax
je 0x4b61b8
push 0x104
push eax
call fcn.0058d536
mov ecx, dword [esp + 0x2c]
add esp, 8
inc esi
inc eax
add ecx, eax
cmp dword [edi + esi*4], 0
mov dword [esp + 0x24], ecx
lea eax, [edi + esi*4]
jne 0x4b61a0
lea eax, [esi - 1]
add eax, ecx
push eax
mov dword [esp + 0x30], eax
call fcn.0058db11
mov edx, dword [edi]
xor ecx, ecx
add esp, 4
mov dword [esp + 0xc], eax
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], 1
test edx, edx
je 0x4b6233
push edx
test esi, esi
mov edx, 0x6261a0
mov eax, 0x62b14a
cmovne eax, edx
push eax
mov eax, dword [esp + 0x34]
sub eax, ecx
push str._s_s
push eax
mov eax, dword [esp + 0x1c]
add eax, ecx
push eax
call fcn.00401140
mov ecx, dword [esp + 0x2c]
inc esi
add ecx, eax
add esp, 0x14
mov dword [esp + 0x18], ecx
mov edx, dword [edi + esi*4]
test edx, edx
jne 0x4b61f5
push 0x44
call fcn.0058db11
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
je 0x4b6500
push 0x44
push 0
push esi
call fcn.00587250
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov dword [esi], 0x34
mov dword [esi + 4], 0
mov eax, dword [0x624130]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
add esi, 0x10
cmp edi, 4
je 0x4b6299
push edx
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004b5c50
mov edx, dword [ebp + 0x14]
add esp, 8
mov dword [esi + 0x20], eax
mov dword [eax + 0x1c], esi
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], ecx
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x30], eax
mov dword [esp + 0x48], 0x44
cmp edi, 4
je 0x4b6398
push edx
push ecx
call fcn.004b5c50
add esp, 8
mov dword [esi + 0x18], eax
mov dword [eax + 0x1c], esi
push dword [ebp + 0x14]
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004b5c50
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 8
mov dword [esi + 0x1c], eax
mov dword [eax + 0x1c], esi
mov eax, dword [esi + 0x18]
mov esi, dword [eax + 0x3c]
add eax, 0x3c
push 2
push 0
push 0
push eax
call edi
push eax
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
push 2
push 0
push 0
mov eax, dword [ecx + 0x2c]
add eax, 0x38
push eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
push 2
push 0
push 0
mov eax, dword [eax + 0x30]
add eax, 0x38
push eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov edi, dword [ebp + 0xc]
add esi, 0x10
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x3c]
mov dword [esp + 0x88], eax
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x38]
mov dword [esp + 0x80], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x3c]
or dword [esp + 0x74], 0x100
mov dword [esp + 0x84], eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
push dword [esp + 0x2c]
push dword [esp + 0x4c]
test edi, edi
jne 0x4b6462
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4b6479
cmp dword [esp + 0x24], 0
je 0x4b63e2
push dword [esp + 0xc]
call fcn.0058c812
add esp, 4
cmp edi, 4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4b6423
mov eax, dword [esi + 0x1c]
push dword [eax + 0x3c]
call edi
mov eax, dword [esi + 0x1c]
mov dword [eax + 0x3c], 0
mov eax, dword [esi + 0x20]
push dword [eax + 0x3c]
call edi
mov eax, dword [esi + 0x20]
mov dword [eax + 0x3c], 0
mov eax, dword [esi + 0x18]
push dword [eax + 0x38]
call edi
mov eax, dword [esi + 0x18]
mov dword [eax + 0x38], 0
mov eax, dword [esp + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4b6435
push eax
call edi
mov eax, dword [esp + 0x38]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b644f
push eax
call edi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b645a
push eax
call edi
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x4b63cf
cmp edi, 4
je 0x4b6491
mov ecx, dword [esi + 0x20]
call fcn.004b5b50
mov ecx, dword [esi + 0x1c]
call fcn.004b5b50
mov ecx, dword [esi + 0x18]
call fcn.004b5b50
cmp dword [esp + 0x24], 0
je 0x4b64a4
push dword [esp + 0xc]
call fcn.0058c812
add esp, 4
mov ecx, esi
call fcn.004aed40
test eax, eax
je 0x4b64d8
cmp dword [esi - 4], 0
jne 0x4b64d8
cmp dword [esi - 0xc], 0
jbe 0x4b64c5
mov eax, dword [esi - 0x10]
xorps xmm0, xmm0
movups xmmword [eax + esi], xmm0
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
push eax
movups xmmword [eax], xmm0
call fcn.0058c812
add esp, 4
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4b64e9
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b60ab
push eax
call esi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xfe
push 0x46d
mov edx, 0x6240d4
xor ecx, ecx
call fcn.004b4f80
add esp, 0xc
push 0x46d
push 0x6240f0
push 0x62410c
call fcn.004010e0
add esp, 0xc
push 0xfe
call fcn.005885bd
int3