Function at 0x406e70
Capabilities:
Check if file exists
Compare security identifiers
Create process on windows
Get memory capacity
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9d4
mov eax, dword [0x411014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x910], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp + 0x1c]
push 0x44
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0x9b4]
push 0
push eax
movups xmmword [ebp - 0x970], xmm0
mov byte [ebp - 0x9b6], 0
mov byte [ebp - 0x9b5], 0
mov byte [ebp - 0x9c4], 0
mov dword [ebp - 0x960], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x950], 0x40
xor ebx, ebx
mov esi, 0x411098
mov dword [ebp - 0x9bc], ebx
lea edi, [ebx + 2]
nop dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esi, 0x28
sub edi, 1
jne 0x406f10
mov esi, 0x411098
mov dword [ebp - 0x9c8], ebx
mov dword [ebp - 0x958], esi
lea eax, [edi + 0x40]
test ebx, ebx
jne 0x407059
mov ebx, dword [esi - 0xc]
cmp ebx, 0x40
push esi
cmovg ebx, eax
mov dword [ebp - 0x90c], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebx*4]
push eax
push dword [esi - 4]
lea eax, [ebp - 0x904]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
test ebx, ebx
jle 0x407027
nop dword [eax]
mov ebx, dword [ebp + esi*4 - 0x904]
mov dword [ebp - 0x954], 0
mov eax, dword [ebx + 4]
mov edi, dword [eax + 4]
lea eax, [ebp - 0x954]
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x406fd4
push dword [ebp - 0x954]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Token__x_user_info_query_failed__err__d_len__d__n
call sub.vmwarebase.DLL_Warning
add esp, 0x10
jmp 0x40701a
mov edi, dword [ebp - 0x9c0]
lea eax, [ebp - 0x954]
push eax
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x954], 0
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x406fb7
push dword [ebp - 0x404]
push dword [ebp - 0x804]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test al, al
jne 0x407091
inc esi
cmp esi, dword [ebp - 0x90c]
jl 0x406f80
mov ebx, dword [ebp - 0x9bc]
mov eax, dword [ebp - 0x9c8]
mov esi, dword [ebp - 0x958]
add eax, 0x28
add esi, 0x28
mov dword [ebp - 0x9c8], eax
cmp eax, 0x50
mov dword [ebp - 0x958], esi
mov eax, 0x40
jb 0x406f33
mov esi, 0x411098
mov edi, 2
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esi, 0x28
sub edi, 1
jne 0x407063
mov dword [ebp - 0x954], ebx
test ebx, ebx
je 0x4070a1
push str.Reusing_existing_session_n
call sub.vmwarebase.DLL_Log
mov esi, dword [ebp - 0x9c0]
add esp, 4
jmp 0x407101
mov eax, dword [ebx + 4]
inc dword [eax]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0x9bc], ebx
jmp 0x40702d
push str.Allocating_a_new_session_n
call sub.vmwarebase.DLL_Log
mov esi, dword [ebp - 0x9c0]
lea eax, [ebp - 0x954]
push eax
push esi
call fcn.004067f0
add esp, 0xc
test al, al
jne 0x4070f5
push str.CreateLogonSessionInfo_failed_n
push 2
call fcn.004027c0
push 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x954]
add esp, 0x10
mov dword [ebp - 0x9bc], eax
jmp 0x407597
mov eax, dword [ebp - 0x954]
mov dword [ebp - 0x9bc], eax
lea eax, [ebp - 0x960]
mov dword [ebp - 0x9b4], 0x44
push eax
push 1
push 2
push 0
push 0xf01ff
push esi
mov dword [ebp - 0x9ac], str.winsta0default
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40715d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DuplcateTokenEx_failed:__d._n
push 2
call fcn.004027c0
push 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x14
jmp 0x407597
mov esi, dword [ebp - 0x960]
lea eax, [ebp - 0x954]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4000
push 1
lea eax, [ebp - 0x90c]
mov dword [ebp - 0x90c], 0
xorps xmm0, xmm0
mov word [ebp - 0x908], 0x1000
push eax
mov dword [ebp - 0x954], 0
xor bl, bl
movq qword [ebp - 0x95c], xmm0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4071d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetTokenIntegrityLevel
push str._s:_AllocateAndInitializeSid_failed:__u_n
call sub.vmwarebase.DLL_Warning
add esp, 0xc
jmp 0x40721e
mov eax, dword [ebp - 0x954]
push 8
mov dword [ebp - 0x95c], eax
lea eax, [ebp - 0x95c]
push eax
push 0x19
push esi
mov dword [ebp - 0x958], 0x60
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x40721c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetTokenIntegrityLevel
push str._s:_SetTokenInformation_failed:__u_n
call sub.vmwarebase.DLL_Warning
add esp, 0xc
jmp 0x40721e
mov bl, 1
mov eax, dword [ebp - 0x954]
test eax, eax
je 0x40722f
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test bl, bl
jne 0x407257
push str.SetTokenIntegrityLevel_failed._n
push 2
call fcn.004027c0
push 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
jmp 0x407597
mov edi, dword [ebp - 0x9cc]
push edi
call sub.vmwarebase.DLL_File_GetNTGlobalFinalPath
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40728d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Before:_File_GetNTGlobalFinalPath_failed_for__s:__d_n
push 2
call fcn.004027c0
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebx
jmp 0x40758e
push dword [ebp - 0x960]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x4072b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ImpersonateLoggedOnUser_failed:__d_n
push 2
call fcn.004027c0
push ebx
jmp 0x407147
push edi
call sub.vmwarebase.DLL_File_GetNTGlobalFinalPath
mov esi, eax
add esp, 4
mov dword [ebp - 0x954], esi
test esi, esi
jne 0x4072ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.After:_File_GetNTGlobalFinalPath_failed_for__s_:__d._n
push 2
call fcn.004027c0
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push esi
jmp 0x40758e
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x40731e
push edi
push str.Failed_to_validate_vmx_file___s___abort_to_launch_it._n
push 2
call fcn.004027c0
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x14
jmp 0x407597
push 1
push edi
call sub.vmwarebase.DLL_Unicode_GetAllocBytes
push 1
push dword [ebp - 0x910]
mov edi, eax
call sub.vmwarebase.DLL_Unicode_GetAllocBytes
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x9b4]
push eax
mov eax, dword [ebp - 0x9bc]
push 0
push dword [eax + 0xc]
push 0x414
push 0
push 0
push 0
push esi
push edi
push dword [ebp - 0x960]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push edi
mov dword [ebp - 0x9c4], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x9c4]
add esp, 8
mov byte [ebp - 0x9b5], al
test eax, eax
je 0x407463
call fcn.00406e50
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x4073db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GlobalMemoryStatusEx_failed:__d_n
push 2
call fcn.004027c0
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp - 0x954]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x14
jmp 0x407597
mov eax, dword [ebp - 0x948]
or ecx, 0xffffffff
cmp dword [ebp - 0x944], 0
cmova eax, ecx
push eax
push 0x64000
push dword [ebp - 0x970]
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
jne 0x407412
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetProcessWorkingSetSite_failed:__d_n
jmp 0x4073b9
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x9bc]
push dword [ebp - 0x968]
push dword [ebp - 0x970]
call fcn.00406bc0
push ebx
mov byte [ebp - 0x9b6], 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp - 0x954]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x14
jmp 0x40760c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00406e50
cmp esi, 2
je 0x40756d
cmp esi, 3
je 0x40756d
push esi
push str.CreateProcessAsUser_failed:__d_n
push 2
call fcn.004027c0
add esp, 0xc
mov dword [ebp - 0x958], 0
lea eax, [ebp - 0x958]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp byte [ebp - 0x958], 0
je 0x407503
lea eax, [ebp - 0x910]
mov dword [ebp - 0x958], 0
push eax
push 4
lea eax, [ebp - 0x958]
mov dword [ebp - 0x910], 0
push eax
push 0xc
push dword [ebp - 0x9c0]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40751b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_get_session_ID_of_users_token:__d._n
call sub.vmwarebase.DLL_Log
add esp, 8
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp - 0x954]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
jmp 0x407597
cmp dword [ebp - 0x958], 0
je 0x407503
push 1
push 0x9a
call sub.vmwarebase.DLL_URL_Get
mov edi, eax
push edi
push str._____msg.authd.termServLaunchFailureWS_Cannot_power_on_the_virtual_machine._This_may_be_because_you_are_running_inside_a_Terminal_Services_or_Remote_Desktop_session_or_are_in_Fast_User_Switch_Mode._n_nFor_more_information__refer_to_our_Web_site_at___s_._n
call sub.vmwarebase.DLL_Msg_Format
mov esi, eax
push esi
push 2
call fcn.004027c0
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp - 0x954]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x28
jmp 0x407597
mov eax, dword [ebp - 0x9cc]
push esi
push eax
push str.CreateProcessAsUser:_The_system_cannot_find_the_file___s___code:__d_._n
push 2
call fcn.004027c0
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp - 0x954]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x18
push str.Process_creation_failed
push dword [ebp + 0x18]
push dword [ebp - 0x9d0]
call sub.vmwarebase.DLL_Str_Sprintf
mov eax, dword [ebp - 0x9bc]
add esp, 0xc
test eax, eax
je 0x4075c0
push eax
call fcn.00406df0
add esp, 4
cmp byte [ebp - 0x9c4], 0
je 0x4075ed
push 0
push dword [ebp - 0x970]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x970]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x970], 0
cmp byte [ebp - 0x9b5], 0
je 0x40760c
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x96c], 0
mov eax, dword [ebp - 0x960]
pop edi
pop esi
pop ebx
test eax, eax
je 0x407620
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x9b6], 0
je 0x40764b
mov ecx, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x968]
mov dword [ecx], eax
mov eax, dword [ebp - 0x970]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004083a0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004083a0
mov esp, ebp
pop ebp
ret