Function at 0x427bab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45e405
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
mov eax, dword [0x497d50]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
push str.LaunchProcessAsUser...
lea ecx, [esp + 0x18]
call fcn.00402060
xor esi, esi
push esi
lea eax, [esp + 0x18]
push eax
push 2
mov dword [esp + 0x8c], esi
call fcn.00411fad
or dword [esp + 0x8c], 0xffffffff
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
push 0x44
pop ebx
push ebx
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00445f90
add esp, 0xc
push 0x10
lea eax, [esp + 0x20]
push esi
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], str.winsta0default
call fcn.00445f90
add esp, 0xc
xor ebx, ebx
inc ebx
push ebx
push dword [edi]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], 0x20
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x427c6a
mov dword [esp + 0x18], 0x420
jmp 0x427cac
push str.CreateEnvironmentBlock_failed
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], esi
call fcn.00402060
mov dword [esp + 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.00411fad
or dword [esp + 0x8c], 0xffffffff
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
push str._Skip
push eax
call fcn.00401dd1
add esp, 0xc
push 2
pop ecx
mov dword [esp + 0x80], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
xor ebx, ebx
inc eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.004341e6
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x427d40
push str.operator_new_failed
lea ecx, [esp + 0x18]
call fcn.00402060
push esi
lea eax, [esp + 0x18]
push eax
push 1
mov byte [esp + 0x8c], 3
call fcn.00411fad
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
push 8
pop esi
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0040253e
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
push ecx
inc eax
push eax
push ebx
call fcn.00446c98
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x30]
push ecx
push esi
push dword [esp + 0x18]
push dword [esp + 0x28]
push esi
push esi
push esi
push ebx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [esp + 0x14], esi
cmp eax, esi
jne 0x427dc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateProcessAsUser_failed:
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.00402060
mov byte [esp + 0x80], 4
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push 1
call fcn.00411fad
mov byte [esp + 0x8c], 2
mov ecx, dword [esp + 0x24]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.0040253e
push dword [esp + 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x1c]
call esi
push dword [esp + 0x20]
call esi
push ebx
call fcn.004341db
mov esi, dword [esp + 0x18]
pop ecx
jmp 0x427d20