Function at 0x47eff0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, eax
push edi
push esi
lea eax, [esp + 0x24]
xor ebp, ebp
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea ebx, [edi + 1]
test eax, eax
jne 0x47f026
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x47f041
cmp dword [0x71038c], ebx
jl 0x47f041
push str.Environment_created
push str.StartInteractiveClientProcess
push ebx
call fcn.00579a92
add esp, 0xc
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [esp + 0x20], eax
test eax, eax
je 0x47f250
push 0x60000
push 0
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov dword [esp + 0x18], eax
test eax, eax
je 0x47f213
cmp dword [0x71038c], ebx
jl 0x47f090
push str.WindowStation_created
push str.StartInteractiveClientProcess
push ebx
call fcn.00579a92
mov eax, dword [esp + 0x24]
add esp, 0xc
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x47f213
push 0x60081
push 0
push 0
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov ecx, dword [esp + 0x20]
push ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x47f213
cmp dword [esp + 0x10], edi
je 0x47f213
lea edx, [esp + 0x14]
push edx
mov eax, esi
call fcn.0047eee0
mov ebp, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x47f213
mov eax, dword [esp + 0x18]
push ebp
push eax
call fcn.0047f260
add esp, 8
test eax, eax
je 0x47f213
mov ecx, dword [esp + 0x10]
push ebp
push ecx
call fcn.0047f560
add esp, 8
test eax, eax
je 0x47f213
push esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x47f213
cmp dword [0x71038c], ebx
jl 0x47f145
push str.CreateProcessAsUser
push str.StartInteractiveClientProcess
push ebx
call fcn.00579a92
add esp, 0xc
push 0x44
lea edx, [esp + 0x38]
push 0
push edx
call fcn.005c8fb0
mov edx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x38]
push ecx
push 0
push edx
push 0x430
push 0
push 0
push 0
push eax
push 0
push esi
mov dword [esp + 0x60], 0x44
mov dword [esp + 0x68], 0x6d15b8
mov dword [esp + 0x8c], ebx
mov word [esp + 0x90], bx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test edi, edi
jne 0x47f1ce
cmp dword [0x71038c], 3
jl 0x47f1eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process_creation_failed____i
push str.StartInteractiveClientProcess
push 3
call fcn.00579a92
add esp, 0x10
jmp 0x47f1eb
cmp dword [0x71038c], 3
jl 0x47f1eb
push str.Process_creation_successfully
push str.StartInteractiveClientProcess
push 3
call fcn.00579a92
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x47f207
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x47f207
push eax
call esi
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
je 0x47f213
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test ebp, ebp
je 0x47f232
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x47f241
push eax
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47f250
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret