Function at 0x404420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x536590
push 0x4be070
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x53de10]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
xor edi, edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x27c], edi
xor eax, eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x234]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x228], eax
cmp eax, edi
jne 0x404514
push 0x200
push edi
push 0x54b218
call fcn.004bbbe0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__LaunchAppIntoDifferentSession_OpenProcessToken____code__d_n
push 0x54b218
call fcn.004b913a
add esp, 0xc
push 0xfffffffffffffffe
lea edx, [ebp - 0x10]
push edx
push 0x53de10
call fcn.004c541c
add esp, 0xc
xor eax, eax
jmp 0x4048c4
lea eax, [ebp - 0x284]
push eax
push str.SeTcbPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x228], eax
cmp eax, edi
jne 0x404577
push 0x200
push edi
push 0x54b218
call fcn.004bbbe0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__LaunchAppIntoDifferentSession_LookupPrivilegeValue____code__d_n
push 0x54b218
call fcn.004b913a
add esp, 0xc
push 0xfffffffffffffffe
lea ecx, [ebp - 0x10]
push ecx
push 0x53de10
call fcn.004c541c
add esp, 0xc
xor eax, eax
jmp 0x4048c4
mov dword [ebp - 0x254], edi
xor eax, eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x254], 1
mov edx, dword [ebp - 0x284]
mov dword [ebp - 0x250], edx
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], 2
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x27c]
push edx
push 0x10
lea eax, [ebp - 0x254]
push eax
push edi
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x228], eax
cmp eax, edi
je 0x404920
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
or ebx, 0xffffffff
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x244], edi
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x244]
push eax
push 1
push edi
push edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
xor eax, eax
mov dword [ebp - 0x240], eax
cmp eax, dword [ebp - 0x258]
jae 0x40470a
lea ecx, [eax + eax*2]
mov edx, dword [ebp - 0x244]
lea eax, [edx + ecx*4]
cmp dword [eax + 8], edi
jne 0x4046fc
mov ebx, dword [eax]
mov dword [ebp - 0x25c], ebx
cmp ebx, 0xffffffff
jne 0x404667
call esi
push eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [eax]
push ecx
push str.Failed_to_WTSGetActiveConsoleSessionId__s__error_code___d_n
jmp 0x4046e1
push str.Wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
jne 0x4046b0
call esi
push eax
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ecx]
push edx
push str.Failed_to_Wtsapi32.dll_load__s__error_code___d_n
lea eax, [ebp - 0x124]
push eax
call fcn.004b913a
lea ecx, [ebp - 0x124]
push ecx
call fcn.00404130
add esp, 0x14
mov eax, dword [ebp - 0x240]
add eax, 1
jmp 0x404620
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0x23c]
push edx
push ebx
call eax
mov dword [ebp - 0x228], eax
cmp eax, edi
jne 0x404730
call esi
push eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [eax]
push ecx
push str.Failed_to_WTSQueryUserToken__s__error_code___d_n
lea edx, [ebp - 0x124]
push edx
call fcn.004b913a
lea eax, [ebp - 0x124]
push eax
call fcn.00404130
add esp, 0x14
mov eax, dword [ebp - 0x240]
add eax, 1
jmp 0x404620
xor eax, eax
cmp eax, edi
jne 0x404730
push 0x200
push edi
push 0x54b218
call fcn.004bbbe0
add esp, 0xc
call esi
push eax
push str.ERROR__LaunchAppIntoDifferentSession_WTSEnumerateSessions____code__d_n
jmp 0x404550
lea edx, [ebp - 0x230]
push edx
push 1
push 1
push edi
push 0x2000000
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x228], eax
cmp eax, edi
jne 0x404778
push 0x200
push edi
push 0x54b218
call fcn.004bbbe0
add esp, 0xc
call esi
push eax
push str.ERROR__LaunchAppIntoDifferentSession_DuplicateTokenEx____code__d_n
jmp 0x404550
mov dword [ebp - 0x2d4], edi
push 0x40
push edi
lea edx, [ebp - 0x2d0]
push edx
call fcn.004bbbe0
add esp, 0xc
mov dword [ebp - 0x2d4], 0x44
mov dword [ebp - 0x2cc], str.winsta0default
push 1
mov eax, dword [ebp - 0x230]
push eax
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov dword [ebp - 0x228], eax
cmp eax, edi
jne 0x4047e4
push 0x200
push edi
push 0x54b218
call fcn.004bbbe0
add esp, 0xc
call esi
push eax
push str.ERROR__LaunchAppIntoDifferentSession_CreateEnvironmentBlock____code__d_n
jmp 0x4044ed
mov edi, dword [ebp - 0x22c]
add edi, 8
push edi
lea eax, [ebp - 0x2d4]
push eax
push 0
mov ecx, dword [ebp - 0x238]
push ecx
push 0x400
push 0
push 0
push 0
mov eax, dword [ebp - 0x22c]
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x40484d
push 0x200
push eax
push 0x54b218
call fcn.004bbbe0
add esp, 0xc
call esi
push eax
push str.ERROR__LaunchAppIntoDifferentSession_CreateProcessAsUser____code__d_n
jmp 0x4044ed
mov eax, dword [edi]
test eax, eax
je 0x4048e0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [edi]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov byte [ebp - 0x224], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x223]
push ecx
call fcn.004bbbe0
add esp, 0xc
mov edx, dword [ebp - 0x22c]
mov eax, dword [edx + 0x10]
push eax
push ebx
push str.CreateProcessAsUser__sid___d__pid___d_n
lea ecx, [ebp - 0x224]
push ecx
call fcn.004b913a
lea edx, [ebp - 0x224]
push edx
call fcn.00404130
add esp, 0x14
mov dword [ebp - 4], 0xfffffffe
call fcn.0040494a
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004b883d
mov esp, ebp
pop ebp
ret
push 0x200
push 0
push 0x54b218
call fcn.004bbbe0
add esp, 0xc
call esi
push eax
push str.ERROR__LaunchAppIntoDifferentSession_CreateProcessAsUser____hProcess_NULL__code__d_n
push 0x54b218
call fcn.004b913a
add esp, 0xc
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x53de10
call fcn.004c541c
add esp, 0xc
xor eax, eax
jmp 0x4048c4
push 0x200
push edi
push 0x54b218
call fcn.004bbbe0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__LaunchAppIntoDifferentSession_AdjustTokenPrivileges____code__d_n
jmp 0x404550