Function at 0x42ac00
Capabilities:
Create process on windows
Impersonate user
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov edi, dword [0x6348d8]
push 0x20
xor ebx, ebx
push 1
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], ebx
call fcn.0057f01b
push str._________Inside_ExecuteWithToken_Method___________n
mov esi, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.0043d390
add esp, 0xc
cmp dword [0x63475c], ebx
je 0x42ac57
push edi
push str.ExecuteWithTokenW_:_Shutdown_is_in_Progress._So_returning_without_executing_the_process__S_._n
call fcn.0043d500
add esp, 8
mov eax, 0x4d5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x44
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.00584f40
push str.ExecuteWithTokenW:_NULL_Root_Directory_and_setting_agent_installed_directory_as_current_directory__n
mov dword [ebp - 0x70], 0x44
call fcn.0043d500
mov edx, dword [0x6346a0]
lea ecx, [ebp - 0x10]
push ecx
push edx
call fcn.00411ff0
mov edi, dword [ebp - 0x10]
push edi
push str.ExecuteWithTokenW:_Setting_the_current_directory_as__S__n
call fcn.0043d7e0
add esp, 0x20
cmp edi, ebx
je 0x42acf5
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x42acf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push str.ExecuteWithTokenW_:_Failed_to_set_the_WorkingDirectory__S__n
mov dword [ebp - 4], eax
call fcn.0043d500
mov eax, dword [ebp - 4]
push eax
call fcn.0043fb10
push edi
call fcn.0057f05b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043f8a0
mov edx, dword [ebp + 0xc]
push eax
push edx
call fcn.00440b70
mov eax, dword [ebp - 4]
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push 1
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x42ad15
push str.ExecuteWithTokenW_:_EnvironmentBlock_Created_sucessfully__n
call fcn.0043d7e0
jmp 0x42ad35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_Error_in_EnvironmentBlock_Creation_with_error__d_:
call fcn.0043d7e0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043f950
mov eax, dword [ebp + 8]
lea edx, [esi + 8]
add esp, 4
push edx
mov dword [esi], 0x20
mov dword [esi + 4], 1
call fcn.0042bdc0
mov eax, dword [ebp + 8]
add esp, 4
push esi
push eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call dword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
je 0x42ad7e
push str.ExecuteWithTokenW_:_profile_Loaded_sucessfully__n
call fcn.0043d7e0
add esp, 4
jmp 0x42ad9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_Error_in_Loading_profile_with_error__d_:
mov dword [ebp - 0x14], eax
call fcn.0043d7e0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0043f950
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
push str.ExecuteWithTokenW:_executeFileName____S__n
call fcn.0043d7e0
mov edx, dword [ebp - 0xc]
add esp, 8
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [ebp + 8]
push edi
push edx
push 0xc000400
push ebx
push ebx
push ebx
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x14], eax
cmp edi, ebx
je 0x42ade3
push edi
call fcn.0057f05b
add esp, 4
cmp dword [ebp - 0x14], ebx
jne 0x42ae17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_Failed_to_Create_the_Process__d_n
mov dword [ebp - 4], eax
call fcn.0043d500
mov edx, dword [ebp - 4]
push edx
call fcn.0043f8a0
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00440b70
add esp, 0x14
jmp 0x42af1a
mov ecx, dword [ebp - 0x24]
push 0x36ee80
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x42ae44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_WaitForSingleObject_Failed_with_error_code__d__n
call fcn.0043d500
add esp, 8
jmp 0x42af1a
cmp eax, ebx
je 0x42aeac
mov edx, dword [ebp - 8]
push 0x3c
push edx
push str.ExecuteWithTokenW_:_Terminating_the_Process_for_application__S_as_time_is_exceeded__d_Minutes__n
mov dword [ebp - 4], 0x102
call fcn.0043d7e0
mov eax, dword [ebp - 4]
push eax
call fcn.0043f8a0
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.00440b70
mov edx, dword [ebp - 0x24]
add esp, 0x18
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x42ae96
push str.ExecuteWithTokenW_:_The_process_has_been_successfully_terminated_..___n
call fcn.0043d7e0
add esp, 4
jmp 0x42af1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_The_process_termination_is_failed_with_error_code_:__d__n
call fcn.0043d500
add esp, 8
jmp 0x42af1a
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x42aed7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ExecuteWithTokenW_:_Unable_to_find_the_exit_code_for_the_application_and_the_error_code_is_:__d__n
mov dword [ebp - 4], eax
call fcn.0043d7e0
jmp 0x42adfc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043f8a0
mov edx, dword [ebp + 0xc]
push eax
push edx
call fcn.00440b70
mov eax, dword [ebp - 4]
push eax
push str.ExecuteWithTokenW_:_Exit_code_of_the_process_:__d__n
call fcn.0043d7e0
mov eax, dword [ebp - 4]
add esp, 0x14
cmp eax, 0xbc2
je 0x42af17
cmp eax, 0x669
je 0x42af17
cmp eax, ebx
je 0x42af17
cmp eax, 0x5e4
jne 0x42af1a
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test eax, eax
je 0x42af37
push str.ExecuteWithTokenW_:_EnvironmentBlock_destroyed_sucessfully__n
call fcn.0043d7e0
add esp, 4
jmp 0x42af53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.ExecuteWithTokenW_:_Error_in_destroying_EnvironmentBlock__with_error__d_:
call fcn.0043d7e0
push edi
call fcn.0043f950
add esp, 0xc
mov edx, dword [esi + 0x1c]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
test eax, eax
je 0x42af74
push str.ExecuteWithTokenW_:_Profile_Unloaded_sucessfully__n
call fcn.0043d7e0
add esp, 4
jmp 0x42af90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.ExecuteWithTokenW_:_Error_in_Unloading_profile_with_error__d_:
call fcn.0043d7e0
push esi
call fcn.0043f950
add esp, 0xc
push str.__________End_Of_ExecuteInUserSession_Method___________n
call fcn.0043d390
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret