Function at 0x10003b40
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x1005c070]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100031b0
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0xffffffff
jne 0x10003b95
push 0x10007490
mov eax, dword [ebp - 0x40c]
push eax
push str.Failed_to_CreateProcessAsActiveSession__invalid_session_id_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
jmp 0x10003f9f
xor ecx, ecx
mov word [ebp - 0x408], cx
push 0x400
push 0
lea edx, [ebp - 0x406]
push edx
call fcn.1002bb10
add esp, 0xc
push 0x10055648
lea eax, [ebp - 0x408]
push eax
call fcn.10007580
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x408]
push edx
call fcn.100075a0
add esp, 8
push 0x1005564c
lea eax, [ebp - 0x408]
push eax
call fcn.100075a0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x10003c6b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x414], ecx
mov edx, dword [ebp - 0x414]
add edx, 2
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x414]
mov cx, word [eax]
mov word [ebp - 0x41a], cx
add dword [ebp - 0x414], 2
cmp word [ebp - 0x41a], 0
jne 0x10003c0d
mov edx, dword [ebp - 0x414]
sub edx, dword [ebp - 0x420]
sar edx, 1
mov dword [ebp - 0x424], edx
je 0x10003c6b
push 0x10055650
lea eax, [ebp - 0x408]
push eax
call fcn.100075a0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x408]
push edx
call fcn.100075a0
add esp, 8
mov eax, dword [ebp - 0x40c]
push eax
call fcn.100036d0
add esp, 4
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
jne 0x10003cd1
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055654
mov ecx, dword [ebp - 0x40c]
push ecx
push str.Failed_to_CreateProcessAsActiveSession__cannot_get_token_session_id_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
jmp 0x10003f9f
mov dword [ebp - 0x428], 1
push 4
lea edx, [ebp - 0x428]
push edx
push 0x1a
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x10003d3a
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100556f4
mov ecx, dword [ebp - 0x40c]
push ecx
push str.Failed_to_CreateProcessAsActiveSession__cannot_set_UI_access__session_id_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
mov dword [ebp - 0x418], 0
push 1
mov edx, dword [ebp - 0x410]
push edx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x10003da6
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055730
mov ecx, dword [ebp - 0x40c]
push ecx
push str.Failed_to_CreateEnvironmentBlock__Session_id_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
jmp 0x10003f9f
mov edx, dword [ebp - 0x410]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10003e19
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055770
mov eax, dword [ebp - 0x40c]
push eax
push str.Failed_to_ImpersonateLoggedOnUser__Session_id_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov edx, dword [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003f9f
push 0x44
push 0
lea eax, [ebp - 0x480]
push eax
call fcn.1002bb10
add esp, 0xc
mov dword [ebp - 0x480], 0x44
mov dword [ebp - 0x478], str.winsta0default
xor ecx, ecx
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], 0x1000400
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x480]
push eax
push 0
mov ecx, dword [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x42c]
push edx
push 0
push 0
push 0
mov eax, 2
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x408]
push edx
push 0
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10003f13
push 0x10007490
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100557cc
mov ecx, dword [ebp - 0x40c]
push ecx
push str.Failed_to_CreateProcessAsUserW__Session_id_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x10003f9f
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x43c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push 0x10007490
mov edx, dword [ebp - 0x40c]
push edx
push str.__sid_:
mov eax, dword [ebp - 0x434]
push eax
push str.Create_child_process__pid_:
mov ecx, 0x1005dfb8
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.100074c0
mov ecx, eax
call fcn.10007520
mov ecx, eax
call fcn.10003100
mov eax, 1
jmp 0x10003fa1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100288d1
mov esp, ebp
pop ebp
ret 8