Function at 0x4fa6b4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0xa1c
mov eax, 0x66fd11
call fcn.005b47af
mov edi, ecx
lea ecx, [ebp - 0x3f8]
call fcn.004bfcb5
xor ebx, ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x3f8]
call fcn.004c052f
xor eax, eax
mov dword [ebp - 0x234], 7
push str.explorer.exe
mov dword [ebp - 0x238], ebx
mov word [ebp - 0x248], ax
call fcn.005ff18e
pop ecx
push eax
push str.explorer.exe
lea ecx, [ebp - 0x248]
call fcn.0040a315
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x3f8]
call fcn.004c0c99
push ebx
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
mov esi, eax
call fcn.00409de7
push 0x12c
call dword [sym.imp.KERNEL32.DLL_Sleep]
test esi, esi
je 0x4fa6d5
lea eax, [ebp - 0x324]
push esi
push eax
call fcn.004d52cb
pop ecx
pop ecx
lea eax, [ebp - 0x324]
mov byte [ebp - 4], 2
push eax
call fcn.004c407a
mov ecx, eax
call fcn.004d511e
call fcn.0040ff0c
mov ecx, eax
call fcn.004ce1a6
push 1
push 3
lea ecx, [ebp - 0x4a8]
call fcn.004078ff
mov eax, dword [ebp - 0x2d4]
mov byte [ebp - 4], 3
cmp dword [eax - 0xc], 0
jne 0x4fa7af
lea ecx, [ebp - 0x324]
call fcn.004cb9df
mov eax, dword [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x498]
push str.AccountName:
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0x4a8]
mov esi, str.ServiceApp::startGui
push eax
push esi
push 0x31
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 2
call fcn.0040843a
push 1
push 3
lea ecx, [ebp - 0x558]
call fcn.004078ff
mov eax, dword [ebp - 0x2d0]
mov byte [ebp - 4], 4
cmp dword [eax - 0xc], 0
jne 0x4fa82c
lea ecx, [ebp - 0x324]
call fcn.004cb9df
mov eax, dword [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x548]
push str.Domain:
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0x558]
push eax
push esi
push 0x32
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], 2
call fcn.0040843a
push 1
push 3
lea ecx, [ebp - 0x608]
call fcn.004078ff
push 5
pop eax
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], al
call fcn.004cbae9
push eax
lea eax, [ebp - 0x5f8]
push str.Sid:
push eax
call fcn.0040710b
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0x608]
push eax
push esi
push 0x33
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x608]
mov byte [ebp - 4], 2
call fcn.0040843a
call fcn.004c407a
lea eax, [ebp - 0x3cc]
push eax
call fcn.004d4e8d
pop ecx
push eax
lea ecx, [ebp - 0x3d8]
call fcn.004cb0c3
lea ecx, [ebp - 0x3cc]
mov byte [ebp - 4], 7
call fcn.004cbc70
mov dword [ebp - 0x3cc], ebx
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x3c4], ebx
mov esi, dword [ebp - 0x3d8]
mov byte [ebp - 4], 8
jmp 0x4fa996
push esi
lea ecx, [ebp - 0x3b0]
call fcn.004126a6
mov eax, dword [ebp - 0x360]
mov byte [ebp - 4], 9
cmp dword [eax - 0xc], 0
jne 0x4fa954
lea ecx, [ebp - 0x3b0]
call fcn.004cb9df
mov eax, dword [ebp - 0x360]
push eax
lea ecx, [ebp - 0x278]
call fcn.004078a3
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x3cc]
call fcn.0042630c
push ebx
push 1
lea ecx, [ebp - 0x278]
call fcn.00409de7
lea ecx, [ebp - 0x3b0]
mov byte [ebp - 4], 8
call fcn.004128f6
add esi, 0x60
cmp esi, dword [ebp - 0x3d4]
jne 0x4fa927
call fcn.004cf8b3
test eax, eax
je 0x4fb09e
call dword [sym.imp.KERNEL32.DLL_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0x3c0], eax
lea eax, [ebp - 0x3b8]
push eax
push 0xf00ff
mov dword [ebp - 0x3b8], ebx
mov dword [ebp - 0x3b4], ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4faa3f
push 1
push 3
lea ecx, [ebp - 0x6b8]
call fcn.004078ff
mov byte [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x6a8]
push str.OpenProcessToken__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x6b8]
push eax
push str.ServiceApp::startGui
push 0x46
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x6b8]
jmp 0x4fab31
lea eax, [ebp - 0x3b4]
push eax
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 0x3b8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4faabc
push 1
push 3
lea ecx, [ebp - 0x768]
call fcn.004078ff
mov byte [ebp - 4], 0xd
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x758]
push str.DuplicateTokenEx__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x768]
push eax
push str.ServiceApp::startGui
push 0x4c
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x768]
jmp 0x4fab31
push 4
lea eax, [ebp - 0x3c0]
push eax
push 0xc
push dword [ebp - 0x3b4]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x4fab3b
push 1
push 3
lea ecx, [ebp - 0x818]
call fcn.004078ff
mov byte [ebp - 4], 0xf
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x808]
push str.SetTokenInformation__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x818]
push eax
push str.ServiceApp::startGui
push 0x52
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x818]
call fcn.0040843a
jmp 0x4fb0db
push dword [ebp - 0x3b4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x4fabae
push 1
push 3
lea ecx, [ebp - 0x8c8]
call fcn.004078ff
mov byte [ebp - 4], 0x11
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x8b8]
push str.ImpersonateLoggedOnUser__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x8c8]
push eax
push str.ServiceApp::startGui
push 0x58
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 8
call fcn.0040843a
push 0x44
pop esi
push esi
lea eax, [ebp - 0x394]
push ebx
push eax
call fcn.005f3980
add esp, 0xc
mov dword [ebp - 0x394], esi
mov dword [ebp - 0x368], 1
push 5
pop eax
mov word [ebp - 0x364], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], ebx
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
jne 0x4fac15
mov eax, ebx
jmp 0x4fac22
lea eax, [ebp - 0x218]
push eax
call fcn.005ff18e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040a315
xor eax, eax
mov byte [ebp - 4], 0x12
mov esi, 0x68e2e8
mov dword [ebp - 0x21c], 7
push esi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040a315
xor eax, eax
mov byte [ebp - 4], 0x13
mov esi, str.SOFTWARE_
mov dword [ebp - 0x24c], 7
push esi
mov dword [ebp - 0x250], ebx
mov word [ebp - 0x260], ax
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x260]
call fcn.0040a315
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.00417c9a
add esp, 0xc
mov dword [ebp - 0x294], reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x290]
push eax
call fcn.0040bd4b
push ebx
push 1
lea ecx, [ebp - 0x2ac]
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x260]
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x17
call fcn.00409de7
lea ecx, [ebp - 0x350]
call fcn.004c20e0
push 0xf003f
push ebx
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x350]
call fcn.004c42c3
xor eax, eax
mov dword [ebp - 0x21c], 7
mov esi, str.runmode
mov dword [ebp - 0x220], ebx
push esi
mov word [ebp - 0x230], ax
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040a315
push ebx
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x350]
call fcn.004c339c
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x18
mov esi, eax
call fcn.00409de7
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0x6871ec
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.005ff18e
pop ecx
push eax
push 0x6871ec
lea ecx, [ebp - 0x230]
call fcn.0040a315
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0x1a
push esi
push eax
call fcn.004f9fe3
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x1b
push ecx
push eax
lea eax, [ebp - 0x2c4]
push eax
call fcn.0042591c
push eax
lea eax, [ebp - 0x2ac]
mov byte [ebp - 4], 0x1c
push 0x6871ec
push eax
call fcn.00417d55
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x1d
call fcn.0040c677
push ebx
push 1
lea ecx, [ebp - 0x2ac]
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x2c4]
call fcn.00409de7
lea ecx, [ebp - 0x254]
call fcn.00409ec4
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x18
call fcn.00409de7
lea ecx, [ebp - 0x324]
call fcn.004cbae9
push eax
lea ecx, [ebp - 0x2c4]
call fcn.004078a3
mov esi, eax
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], ebx
push str.__sid:
mov word [ebp - 0x230], ax
call fcn.005ff18e
pop ecx
push eax
push str.__sid:
lea ecx, [ebp - 0x230]
call fcn.0040a315
push esi
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.00417c9a
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x22
call fcn.00409de7
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040c677
push 1
push dword [ebp - 0x3b4]
lea eax, [ebp - 0x3bc]
mov dword [ebp - 0x3bc], ebx
push eax
mov esi, ebx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4faf1c
mov edx, dword [ebp - 0x3bc]
mov esi, 0x400
jmp 0x4faf24
mov edx, ebx
mov dword [ebp - 0x3bc], edx
cmp dword [ebp - 0x234], 8
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x394]
push eax
push ebx
push edx
push esi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x248]
cmovae ecx, dword [ebp - 0x248]
push ecx
push ebx
push dword [ebp - 0x3b4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4fb004
push 1
push 3
lea ecx, [ebp - 0x978]
call fcn.004078ff
mov byte [ebp - 4], 0x23
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x968]
push str.CreateProcessAsUser__error
push eax
call fcn.0040710b
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0x978]
push eax
push str.ServiceApp::startGui
push 0x7b
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x978]
call fcn.0040843a
push dword [ebp - 0x3b8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x278]
call fcn.00409de7
lea ecx, [ebp - 0x350]
call fcn.004c211d
push ebx
push 1
lea ecx, [ebp - 0x290]
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.00409de7
jmp 0x4fb0db
push dword [ebp - 0x3b8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
push 3
lea ecx, [ebp - 0xa28]
call fcn.004078ff
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x25
push str.Startup_binary
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0xa28]
push eax
push str.ServiceApp::startGui
push 0x81
push str.D:_build6c589d3ff8507062_srccoreService.cpp
push 1
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0xa28]
call fcn.0040843a
push ebx
push 1
lea ecx, [ebp - 0x278]
call fcn.00409de7
lea ecx, [ebp - 0x350]
call fcn.004c211d
push ebx
push 1
lea ecx, [ebp - 0x290]
call fcn.00409de7
push ebx
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 8
call fcn.00409de7
mov ecx, edi
call fcn.004fb113
sub esp, 0x28
mov dword [ebp - 0x3c0], edi
mov ecx, esp
mov dword [ebp - 0x3bc], esp
lea eax, [ebp - 0x3c0]
push eax
mov dword [ecx + 0x24], ebx
call fcn.004f962c
mov byte [ebp - 4], 0x26
call fcn.004e2896
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.004d70fe
mov bl, 1
lea ecx, [ebp - 0x3cc]
call fcn.00409ec4
lea ecx, [ebp - 0x3d8]
mov byte [ebp - 4], 0x27
call fcn.004cbc70
lea ecx, [ebp - 0x324]
call fcn.004128f6
lea ecx, [ebp - 0x3f8]
call fcn.004bfd60
mov al, bl
call fcn.005b4759
ret