Function at 0x433570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call fcn.0042607b
test al, al
je 0x4335aa
inc eax
push ebx
dec sp
or eax, edi
adc eax, 0xfb6b135c
mov edx, 0x55fc877f
sbb byte [ebp - 0x6510348f], cl
sbb eax, 0x33357ad4
fisttp dword [ebp - 0x410bbb]
add dword [edi], ecx
add byte [eax + 0x56], dl
lea eax, [ebp - 0xc]
mov esi, 0xf01ff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4336db
lea eax, [ebp - 0x14]
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4336db
pop edx
add byte [ebp - 0x87bf040], al
add byte [eax], al
add byte [eax - 0x38], ch
xchg ecx, eax
pop edx
add byte [ecx + 0x15ffe85d], cl
mov byte [edx + 0x5a], dh
add byte [ebx + 0x74f685f0], cl
xor eax, 0x5a921468
add byte [esi - 1], dl
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
push str.Kernel32.dll
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x43362d
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433626
call eax
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4336de
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00425ba1
test al, al
je 0x43364a
jecxz 0x4335da
jbe 0x433650
jp 0x43366b
mov ebx, 0xe1a20e41
scasb al, byte es:[edi]
sub edi, dword [ebx + eax*2]
neg byte [edx + 0x3e]
sub ecx, edx
call fcn.00425e53
test al, al
je 0x43366f
sal byte [esp + ebx + 0x13], 0x83
popal
xchg dword [edx + 0x7f], esi
adc eax, dword [ebx + 0x7f728761]
xlatb
or byte [edi + 0x6a], 0x4d
sbb al, 0x1c
scasb al, byte es:[edi]
sti
scasd eax, dword es:[edi]
cmp eax, 0x972f6e54
mov dword [esi], ebp
mov edx, 0xe8bb75dc
fdiv qword [ebp - 0x45]
call 0xff6d3e5b
inc dword [eax + eax*8 - 0x34d9ea8c]
lcall 0xd203, 0x9c69d3f4
xor byte [ecx + 0x1604876d], bh
sbb ah, al
sbb dword [ebp + 0x68db335d], edx
in al, 0x91
pop edx
add byte [ecx + 0x15fff85d], cl
mov byte [edx + 0x5a], dh
call fcn.0042607b
test al, al
je 0x43368d
retf
xor ebx, ebx
push str.Wtsapi32.dll
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4337f3
pop edx
add byte [ebp + 0x4e840fc0], al
add dword [eax], eax
add byte [eax], ch
push 0x5a9200
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xchg edx, eax
pop edx
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x43372e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push ecx
push dword [ebp - 0x18]
jne 0x4336a7
call eax
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
push dword [ebp - 0x10]
test eax, eax
jne 0x433728
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], ebx
call fcn.00425f22
test al, al
je 0x4336f8
mov ah, 0x46
mov al, byte [0x900d3dec]
fdivp st(0)
cmp eax, 0x591f655b
jbe 0x43369b
pop ds
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x43370b
cmp eax, 0xffffffff
je 0x43370b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x43371e
cmp ecx, 0xffffffff
je 0x43371e
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00425c70
test al, al
je 0x433758
push ebx
jp 0x4336bd
push cs
pop esp
adc al, 0xc4
invalid
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.004463a0
push 0x10
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.004463a0
add esp, 0x18
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], str.WinSta0Default
mov dword [ebp - 0x40], 1
push 5
pop eax
mov word [ebp - 0x3c], ax
call fcn.0042607b
test al, al
je 0x4337b3
neg dword [0xe62aa207]
adc al, byte [edi + 0x6b]
lds ebx, [esi + 0x77202a5b]
out dx, al
adc ax, 0x45fd
add dword [ebx - 0x631efa85], 0x8ddb33a8
inc ebp
fcom dword [eax - 0x73]
inc ebp
xchg esp, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 8]
push 0x430
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4336db
cmp dword [ebp - 8], 0
je 0x4337ea
push dword [ebp - 8]
call sub.USERENV.dll_DestroyEnvironmentBlock
mov byte [ebp - 4], 1
jmp 0x4336de
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x43372e
push dword [ebp - 0xc]
jmp 0x4336d5