Function at 0x4365ba
Capabilities:
Create process on windows

Disassembly:
push 0x158
mov eax, 0x50e33a
call fcn.004f41e2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x34]
or dword [ebp - 0x118], 0xffffffff
or dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x12c], eax
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x11c]
push eax
push 0x2010b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x436696
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea eax, [ebp - 0x110]
push ebx
push str.Failed_to_OpenProcessToken__code_u
push eax
call fcn.00401133
xor esi, esi
lea eax, [ebp - 0x110]
inc esi
push esi
push esi
push eax
call fcn.00421c79
add esp, 0x18
test edi, edi
je 0x4369a9
mov dword [edi], ebx
jmp 0x4369a9
lea eax, [ebp - 0x128]
push eax
push 4
lea eax, [ebp - 0x118]
push eax
push 0xc
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4366c8
call ebx
push eax
push str.Failed_to_query_TokenSessionId__code_u
jmp 0x4366d3
push dword [ebp - 0x118]
push str.Current_TokenSessionId_is__u
lea eax, [ebp - 0x110]
push eax
call fcn.00401133
add esp, 0xc
lea eax, [ebp - 0x110]
xor esi, esi
inc esi
push esi
push esi
push eax
call fcn.00421c79
mov eax, dword [ebp + 8]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x436712
push esi
push esi
push str.ProcessIdToSessionId_is_failing_to_obtain_SessionID_of_GUI_process__exiting
call fcn.00421c79
add esp, 0xc
jmp 0x4369a9
mov dword [ebp - 0x120], eax
cmp eax, dword [ebp - 0x118]
je 0x4368c4
lea eax, [ebp - 0x114]
push eax
push esi
push 2
push 0
push 0x2000000
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x43676f
call ebx
push eax
lea eax, [ebp - 0x110]
push str.Failed_to_duplicate_current_token__code_u
push eax
call fcn.00401133
push esi
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00421c79
add esp, 0x18
jmp 0x4369a9
lea ecx, [ebp - 0x164]
call fcn.00436360
and dword [ebp - 4], 0
lea eax, [ebp - 0x164]
push str.SeTcbPrivilege
push esi
push eax
call fcn.00436ae1
add esp, 0xc
cmp eax, esi
je 0x4367bc
call ebx
push eax
lea eax, [ebp - 0x110]
push str.Failed_to_adjust_SE_TCB_NAME_privilege__code_u
push eax
call fcn.00401133
push esi
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00421c79
add esp, 0x18
push 4
lea eax, [ebp - 0x120]
push eax
push 0xc
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x436830
call ebx
mov ebx, eax
lea eax, [ebp - 0x110]
push ebx
push dword [ebp - 0x120]
push str.Failed_to_adjust_TokenSessionId_to__u__code_u
push eax
call fcn.00401133
push esi
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00421c79
add esp, 0x1c
test edi, edi
je 0x43680a
mov dword [edi], ebx
lea ecx, [ebp - 0x164]
mov dword [ebp - 4], esi
call fcn.00436c03
cmp dword [ebp - 0x164], 0
je 0x4369a9
push dword [ebp - 0x164]
jmp 0x4369a3
lea ecx, [ebp - 0x164]
call fcn.00436c03
lea eax, [ebp - 0x128]
push eax
push 4
lea eax, [ebp - 0x118]
push eax
push 0xc
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x436867
call ebx
push eax
push str.Failed_to_query_new_TokenSessionId__code_u
jmp 0x436872
push dword [ebp - 0x118]
push str.New_TokenSessionId_is__u
lea eax, [ebp - 0x110]
push eax
call fcn.00401133
add esp, 0xc
lea eax, [ebp - 0x110]
push esi
push esi
push eax
call fcn.00421c79
add esp, 0xc
lea ecx, [ebp - 0x164]
mov dword [ebp - 4], 2
call fcn.00436c03
cmp dword [ebp - 0x164], 0
je 0x4368c0
push dword [ebp - 0x164]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x164], 0
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], 0
push dword [ebp - 0x12c]
push dword [ebp - 0x130]
push dword [ebp - 0x134]
push dword [ebp - 0x138]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push dword [ebp - 0x144]
je 0x436911
push dword [ebp - 0x148]
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x436919
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x124], eax
test eax, eax
jne 0x436965
call ebx
cmp dword [ebp - 0x114], 0
mov ebx, eax
mov eax, str.CreateProcess
mov ecx, str.CreateProcessAsUser
push ebx
cmove ecx, eax
lea eax, [ebp - 0x110]
push ecx
push str._s_failed__code_u
push eax
call fcn.00401133
push esi
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00421c79
add esp, 0x1c
test edi, edi
je 0x436965
mov dword [edi], ebx
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x436987
cmp eax, 0xffffffff
je 0x436987
and dword [ebp - 0x114], 0
cmp eax, 0xffffffff
je 0x436987
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x4369a9
cmp eax, 0xffffffff
je 0x4369a9
and dword [ebp - 0x11c], 0
cmp eax, 0xffffffff
je 0x4369a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x124]
call fcn.004f418c
ret