Function at 0x4020f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8088
call fcn.00423ed0
mov eax, dword [0x434674]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, str._start.
mov edi, str.ExecuteAppByAdmin
mov dword [ebp - 0x801c], eax
mov esi, edx
mov dword [ebp - 0x802c], ecx
call fcn.00410060
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor edi, edi
mov dword [ebp - 0x8020], 1
mov dword [ebp - 0x8010], edi
cmp esi, edi
jbe 0x402170
push esi
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
je 0x402166
lea edx, [ebp - 0x8010]
push edx
push 0xf01ff
push eax
call ebx
mov eax, dword [ebp - 0x8010]
cmp eax, edi
jne 0x4021c2
lea eax, [ebp - 0x8010]
push eax
push edi
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4021a3
lea ecx, [ebp - 0x8010]
push ecx
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov eax, dword [ebp - 0x8010]
cmp eax, edi
jne 0x4021c2
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00411d2c
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [ebp - 0x8024]
push edx
push 4
lea ecx, [ebp - 0x8018]
push ecx
push 0x14
push eax
mov dword [ebp - 0x8018], edi
mov dword [ebp - 0x8024], edi
call esi
cmp dword [ebp - 0x8018], edi
jne 0x402243
push 0x8000
lea edx, [ebp - 0x800c]
push edi
push edx
call fcn.0041d880
mov edx, dword [ebp - 0x8010]
add esp, 0xc
lea eax, [ebp - 0x8028]
push eax
push 4
lea ecx, [ebp - 0x800c]
push ecx
push 0x13
push edx
mov dword [ebp - 0x8028], 4
call esi
test eax, eax
je 0x40223d
mov eax, dword [ebp - 0x800c]
mov dword [ebp - 0x8010], eax
jmp 0x402243
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x44
lea ecx, [ebp - 0x8084]
push edi
push ecx
call fcn.0041d880
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x803c], eax
mov dword [ebp - 0x8038], eax
mov dword [ebp - 0x8034], eax
mov dword [ebp - 0x8030], eax
lea esi, [eax + 0x30]
mov eax, dword [ebp - 0x8010]
push edi
push eax
lea ecx, [ebp - 0x8014]
mov edx, 5
push ecx
mov dword [ebp - 0x8084], 0x44
mov word [ebp - 0x8054], dx
mov dword [ebp - 0x807c], str.WinSta0Default
mov dword [ebp - 0x8058], 1
mov dword [ebp - 0x8014], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x4022c0
mov esi, 0x430
mov ecx, dword [ebp - 0x8014]
lea edx, [ebp - 0x803c]
push edx
lea eax, [ebp - 0x8084]
push eax
mov eax, dword [ebp - 0x801c]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edi
push ecx
mov ecx, dword [ebp - 0x8010]
push esi
push edi
push edi
push edi
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x40230d
mov ebx, str._CreateProcessAsUser_fail.
mov edi, str.ExecuteAppByAdmin
call fcn.00410060
xor esi, esi
xor edi, edi
jmp 0x402332
mov eax, dword [ebp - 0x802c]
mov edx, dword [ebp - 0x8034]
mov dword [eax], edx
mov eax, dword [ebp - 0x8014]
cmp eax, edi
je 0x40232c
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov esi, dword [ebp - 0x8020]
mov eax, dword [ebp - 0x8010]
cmp eax, edi
je 0x402348
cmp eax, 0xffffffff
je 0x402348
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411d2c
mov esp, ebp
pop ebp
ret 4