Function at 0x40bb00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d5b6
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x44d100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0
push ecx
push eax
mov dword [ebp - 0x84], 0
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x40bc3e
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
push 0xa
push 0x500000
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00415ec0
add esp, 0x10
mov dword [ebp - 0x78], str.Failed_to_retrieve_user_token.
lea ecx, [ebp - 0x78]
push ecx
push 0xcc
push str.........SourceLauncherlauncher.cpp
push 0
mov ecx, eax
call fcn.00404780
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x40bc03
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40bbf9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x40bc37
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40bc2d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
xor al, al
jmp 0x40c227
mov eax, dword [ebp - 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x9c], eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 2
push ecx
push 1
push 1
push 0
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40bd5b
xorps xmm0, xmm0
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
push 0xa
push 0x500000
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00415ec0
add esp, 0x10
mov dword [ebp - 0x78], str.Failed_to_duplicate_user_token.
lea ecx, [ebp - 0x78]
push ecx
push 0xd4
push str.........SourceLauncherlauncher.cpp
push 0
mov ecx, eax
call fcn.00404780
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp ecx, 0xf
jbe 0x40bd1a
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40bd10
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 2
cmp ecx, 0xf
jbe 0x40bd52
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40bd48
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
mov byte [ebp - 0x71], 0
jmp 0x40c210
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x98], eax
mov dword [ebp - 0xa4], eax
push 0
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x40be74
xorps xmm0, xmm0
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
push 0xa
push 0x500000
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00415ec0
add esp, 0x10
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x78], eax
mov ecx, esi
lea eax, [ebp - 0x78]
mov dword [ebp - 0x7c], str.CreateEnvironmentBlock_failed._Error_code:
push eax
lea eax, [ebp - 0x7c]
push eax
push 0xdd
push str.........SourceLauncherlauncher.cpp
push 0
call fcn.004049a0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 7
cmp ecx, 0xf
jbe 0x40be33
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40be29
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 6
cmp ecx, 0xf
jbe 0x40be6b
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40be61
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
mov byte [ebp - 0x71], 0
jmp 0x40c1ff
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xb0], sub.USERENV.dll_DestroyEnvironmentBlock
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xac], eax
push 0x40
lea eax, [ebp - 0x100]
mov dword [ebp - 0x104], 0x44
push 0
push eax
call fcn.0041d690
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], 7
movups xmmword [ebp - 0x58], xmm0
add esp, 0xc
mov word [ebp - 0x58], ax
movups xmmword [ebp - 0xc0], xmm0
push 1
push 0x43f940
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xc
call fcn.00412db0
push esi
lea ecx, [ebp - 0x28]
call fcn.00406ec0
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0xd
call fcn.00412db0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.00408ed0
push 1
push 0x43f940
lea ecx, [ebp - 0x58]
call fcn.00412db0
push 1
push 0x43f944
lea ecx, [ebp - 0x58]
call fcn.00412db0
push dword [ebp - 0x7c]
lea eax, [ebp - 0x28]
push eax
call fcn.00417e10
add esp, 8
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
mov byte [ebp - 4], 0xe
jbe 0x40bf4b
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00412db0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.00408ed0
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
call fcn.00416a90
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xf
call fcn.00406ec0
cmp dword [ebp - 0x2c], 7
lea eax, [ebp - 0x40]
push dword [ebp - 0x78]
cmova eax, dword [ebp - 0x40]
lea edi, [ebp - 0x58]
cmp dword [ebp - 0x44], 7
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x80]
cmova edi, dword [ebp - 0x58]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x7c], eax
call fcn.00406ec0
cmp dword [ebp - 0x14], 7
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x104]
push ecx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push esi
push 0x430
push 0
push 0
push 0
push edi
push eax
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00408ed0
lea ecx, [ebp - 0x40]
call fcn.00408ed0
lea ecx, [ebp - 0x70]
call fcn.00408ed0
mov dword [ebp - 0x30], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0xf
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 0x40], 0
test esi, esi
jne 0x40c0a3
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0xa
push 0x500000
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00415ec0
mov ecx, dword [ebp - 0x88]
sub esp, 8
mov edx, esp
mov dword [ebp - 0x7c], esp
mov esi, eax
push edx
call fcn.0040cbe0
push 0x43f948
sub esp, 0x18
mov byte [ebp - 4], 0x13
mov eax, esp
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.004187e0
add esp, 8
mov byte [ebp - 4], 0x12
mov ecx, esi
push str.Create_process_failed__full_command_line:
push 0xfe
push str.........SourceLauncherlauncher.cpp
call fcn.00404540
lea ecx, [ebp - 0x28]
call fcn.00408e80
lea ecx, [ebp - 0x40]
call fcn.00408e80
mov byte [ebp - 0x71], 0
jmp 0x40c197
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0xa
push 0x500000
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00415ec0
sub esp, 8
mov esi, eax
mov ecx, esp
lea eax, [ebp - 0x58]
push eax
push ecx
call fcn.004187e0
add esp, 8
mov ecx, esi
push str.Process_created_successfully__full_command_line:
push 0x102
push str.........SourceLauncherlauncher.cpp
call fcn.00404400
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x17
cmp ecx, 0xf
jbe 0x40c133
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c129
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xc
cmp ecx, 0xf
jbe 0x40c16b
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c161
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
mov edi, dword [ebp - 0xbc]
mov byte [ebp - 0x71], 1
mov eax, dword [ebp - 0xc0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0x19
test eax, eax
je 0x40c18c
push eax
call esi
mov byte [ebp - 4], 0x1a
test edi, edi
je 0x40c197
push edi
call esi
mov ecx, dword [ebp - 0x44]
mov byte [ebp - 4], 0xb
cmp ecx, 7
jbe 0x40c1d1
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c1c7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c244
push ecx
push edx
call fcn.0041b85f
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x94]
mov byte [ebp - 4], 0x1b
test eax, eax
je 0x40c1f9
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 0x1c
test eax, eax
je 0x40c210
push eax
call edi
mov eax, dword [ebp - 0x90]
mov dword [ebp - 4], 0x1d
test eax, eax
je 0x40c224
push eax
call edi
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bbac
mov esp, ebp
pop ebp
ret 8
call fcn.0042072f
int3