Function at 0x53cb1c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xd], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x53cdda
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x561afc]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x53cdf4
call fcn.00407c64
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
push 0x53ce0c
call sub.kernel32.dll_LoadLibraryW
mov esi, eax
test esi, esi
je 0x53cb84
push 0x53ce28
push esi
call fcn.0040cf94
mov dword [ebp - 0x1c], eax
push 0x53ce64
call sub.kernel32.dll_LoadLibraryW
mov edi, eax
test edi, edi
je 0x53cba2
push 0x53ce80
push edi
call fcn.0040cf94
mov dword [ebp - 0x20], eax
push 0x53cea4
call sub.kernel32.dll_LoadLibraryW
mov ebx, eax
test ebx, ebx
je 0x53cbc8
push 0x53cebc
push ebx
call fcn.0040cf94
push 0x53ceec
push ebx
call fcn.0040cf94
mov eax, esi
and eax, ebx
test eax, edi
je 0x53cdb9
cmp dword [ebp - 0x1c], 0
je 0x53cdb9
cmp dword [ebp - 0x20], 0
je 0x53cdb9
call dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
push 1
push 1
push 0
push 0x2000000
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_DuplicateTokenEx
lea eax, [ebp - 0x80]
xor ecx, ecx
mov edx, 0x44
call fcn.00404c5c
lea eax, [ebp - 0x90]
xor ecx, ecx
mov edx, 0x10
call fcn.00404c5c
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 8
call fcn.00404c5c
mov eax, 0x20
call fcn.00404234
cmp byte [ebp - 5], 0
je 0x53cc6b
mov eax, 0x53cf1c
jmp 0x53cc70
mov eax, 0x53cf34
xor edx, edx
mov dword [ebp - 0x34], edx
lea edx, [ebp - 0x34]
push edx
push eax
call sub.Advapi32.dll_ConvertStringSidToSidW
mov dword [ebp - 0x2c], 0x20
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_GetLengthSid
add eax, 8
push eax
lea eax, [ebp - 0x30]
push eax
push 0x19
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_SetTokenInformation
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, 0x104
call fcn.00404234
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x53cce0
mov eax, dword [ebp - 0x38]
sub eax, 0xa
cmp word [eax], 2
je 0x53cce0
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406ad0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 4]
call fcn.00408244
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x53cd08
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x53cd08
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406ad0
test eax, eax
je 0x53cd11
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
call fcn.00404404
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
mov eax, dword [ebp - 0xd]
push esi
push edi
mov edi, eax
lea esi, [ebp - 0x90]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0
push 1
push 0
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x94]
call fcn.0041a450
mov eax, dword [ebp - 0x94]
push eax
call fcn.004fe39c
xor ecx, ecx
pop edx
call fcn.004fe718
mov edx, 2
mov eax, dword [ebp - 0x28]
call fcn.00404268
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 0x90]
push eax
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_FreeLibrary_1
push edi
call sub.kernel32.dll_FreeLibrary_1
push ebx
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53cde1
lea eax, [ebp - 0x94]
call fcn.00407798
lea eax, [ebp - 4]
call fcn.00407798
ret