Function at 0x415260
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x4c4014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0x20]
push ebx
push esi
push edi
mov eax, dword [eax]
mov ebx, ecx
mov edi, dword [ebp + 0x24]
mov dword [ebp - 8], eax
test eax, eax
jne 0x41533d
test edi, edi
je 0x4152d2
mov esi, dword [edi]
push str.Default_SessionID_0_is_passed_from_Client._Enumerating_Sessions_to_find_valid_user_session.
push str.ProcessUtils
push 0x4aea60
push 0x1e
push edi
jmp 0x415323
mov esi, dword [0x4c8c94]
test esi, esi
je 0x415306
push str.Default_SessionID_0_is_passed_from_Client._Enumerating_Sessions_to_find_valid_user_session.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x1e
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
jmp 0x415333
mov eax, dword [0x4c8c98]
test eax, eax
je 0x415333
mov esi, dword [eax]
push str.Default_SessionID_0_is_passed_from_Client._Enumerating_Sessions_to_find_valid_user_session.
push str.ProcessUtils
push 0x4aea60
push 0x1e
push eax
mov esi, dword [esi + 0x34]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x14
mov ecx, edi
call fcn.00414810
mov dword [ebp - 8], eax
test edi, edi
je 0x415358
mov esi, dword [edi]
push eax
push str.In_createProcessInUserSession.User_Session_ID_found:__d
push str.ProcessUtils
push 0x4aea60
push 0x1e
push edi
jmp 0x4153ac
mov esi, dword [0x4c8c94]
test esi, esi
je 0x41538d
push eax
push str.In_createProcessInUserSession.User_Session_ID_found:__d
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x1e
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x1c
jmp 0x4153bc
mov ecx, dword [0x4c8c98]
test ecx, ecx
je 0x4153bc
mov esi, dword [ecx]
push eax
push str.In_createProcessInUserSession.User_Session_ID_found:__d
push str.ProcessUtils
push 0x4aea60
push 0x1e
push ecx
mov esi, dword [esi + 0x34]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
mov esi, dword [ebp - 8]
test esi, esi
jne 0x41546d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], eax
test edi, edi
je 0x4153f9
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._No_active_session_found._ErrorCode:___d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x415743
cmp dword [0x4c8c94], 0
je 0x41544c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession._No_active_session_found._ErrorCode:___d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046999a
mov esp, ebp
pop ebp
ret 0x20
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159d2
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._No_active_session_found._ErrorCode:___d_.
jmp 0x415731
lea eax, [ebx + 8]
push eax
push esi
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x415526
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], eax
test edi, edi
je 0x4154b2
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession__Cannot_get_user_token._ErrorCode:___d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x415743
cmp dword [0x4c8c94], 0
je 0x415505
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession__Cannot_get_user_token._ErrorCode:___d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046999a
mov esp, ebp
pop ebp
ret 0x20
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159d2
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession__Cannot_get_user_token._ErrorCode:___d_.
jmp 0x415731
push 1
push dword [ebx + 8]
lea eax, [ebx + 0x20]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x415540
or dword [ebx + 0x14], 0x400
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0
push eax
push 0
push 0
push 0x13
push dword [ebx + 8]
mov dword [ebx + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x415624
cmp eax, 0x18
je 0x415624
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], eax
test edi, edi
je 0x4155b0
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession__Error_getting_TokenLinkedToken._ErrorCode:___d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x415743
cmp dword [0x4c8c94], 0
je 0x415603
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession__Error_getting_TokenLinkedToken._ErrorCode:___d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046999a
mov esp, ebp
pop ebp
ret 0x20
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159d2
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession__Error_getting_TokenLinkedToken._ErrorCode:___d_.
jmp 0x415731
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x238]
call fcn.00469c69
push dword [ebp - 0x238]
mov dword [ebx + 0x1c], eax
push 0
push eax
call fcn.0046bb80
add esp, 0x10
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x238]
push dword [ebx + 0x1c]
push 0x13
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x415808
lea eax, [ebx + 4]
push eax
mov eax, dword [ebx + 0x1c]
push 1
push 2
push 0
push 0x18b
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x415768
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], eax
test edi, edi
je 0x4156c2
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession__Admin_User__Cannot_duplicate_token._ErrorCode:___d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x415743
cmp dword [0x4c8c94], 0
je 0x415715
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession__Admin_User__Cannot_duplicate_token._ErrorCode:___d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046999a
mov esp, ebp
pop ebp
ret 0x20
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159d2
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession__Admin_User__Cannot_duplicate_token._ErrorCode:___d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push dword [0x4c8c98]
mov esi, dword [esi + 0x34]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046999a
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebx + 4]
mov edx, edi
call fcn.00415e50
test al, al
jne 0x415845
test edi, edi
je 0x415794
mov esi, dword [edi]
push str.In_launchProcessInUserSession__LinkedToken_is_non_elevated._Using_the_STDUser_fallback
push str.ProcessUtils
push 0x4aea60
push 0x1e
push edi
jmp 0x4157ee
mov eax, dword [0x4c8c94]
mov dword [ebp - 0x240], eax
test eax, eax
je 0x4157d1
push str.In_launchProcessInUserSession__LinkedToken_is_non_elevated._Using_the_STDUser_fallback
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x1e
mov ecx, eax
call dword [0x49e2d4]
call dword [ebp - 0x240]
add esp, 0x18
jmp 0x415801
mov eax, dword [0x4c8c98]
test eax, eax
je 0x415801
mov esi, dword [eax]
push str.In_launchProcessInUserSession__LinkedToken_is_non_elevated._Using_the_STDUser_fallback
push str.ProcessUtils
push 0x4aea60
push 0x1e
push eax
mov esi, dword [esi + 0x34]
mov ecx, esi
call dword [0x49e2d4]
call esi
mov esi, dword [ebp - 8]
add esp, 0x14
mov dword [ebx + 4], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4159e7
test edi, edi
je 0x415929
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x4159b4
test edi, edi
je 0x415862
mov esi, dword [edi]
push str.In_launchProcessInUserSession__LinkedToken_is_elevated._Launch_process_in_ADMIN_context
push str.ProcessUtils
push 0x4aea60
push 0xa
push edi
jmp 0x415914
mov esi, dword [0x4c8c94]
test esi, esi
je 0x4158f7
push str.In_launchProcessInUserSession__LinkedToken_is_elevated._Launch_process_in_ADMIN_context
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0xa
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
push dword [ebp - 0x244]
push dword [ebp - 0x248]
push dword [ebp - 0x24c]
push dword [ebx + 0x20]
push dword [ebx + 0x14]
push 0
push 0
push 0
push dword [ebp - 0x250]
push 0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x415db6
test edi, edi
je 0x415d52
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Unable_to_create_a_new_process_with_duplicate_token._ErrorCode:__d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x4159b4
mov eax, dword [0x4c8c98]
test eax, eax
je 0x415898
mov esi, dword [eax]
push str.In_launchProcessInUserSession__LinkedToken_is_elevated._Launch_process_in_ADMIN_context
push str.ProcessUtils
push 0x4aea60
push 0xa
push eax
mov esi, dword [esi + 0x34]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x14
jmp 0x415898
cmp dword [0x4c8c94], 0
je 0x41598a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x23c]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046999a
mov esp, ebp
pop ebp
ret 0x20
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159c4
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Standard_user.Unable_to_get_list_of_processes._ErrorCode:__d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push dword [0x4c8c98]
mov esi, dword [esi + 0x34]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], eax
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046999a
mov esp, ebp
pop ebp
ret 0x20
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x234], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x415a90
test edi, edi
je 0x415a28
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x4159b4
cmp dword [0x4c8c94], 0
je 0x415a6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
jmp 0x4159c4
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159c4
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_initialize_first_process._ErrorCode:__d_.
jmp 0x4159a2
push str.winlogon.exe
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x415ac2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x415ac2
cmp dword [ebp - 8], esi
je 0x415ada
lea eax, [ebp - 0x234]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x415a90
jmp 0x415b62
mov eax, dword [ebp - 0x22c]
mov dword [ebx + 0x18], eax
test edi, edi
je 0x415afe
mov esi, dword [edi]
push eax
push str.In_launchProcessInUserSession.winlogon_process_ID:__d.
push str.ProcessUtils
push 0x4aea60
push 0x1e
push edi
jmp 0x415b52
mov esi, dword [0x4c8c94]
test esi, esi
je 0x415b33
push eax
push str.In_launchProcessInUserSession.winlogon_process_ID:__d.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x1e
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x1c
jmp 0x415b62
mov ecx, dword [0x4c8c98]
test ecx, ecx
je 0x415b62
mov esi, dword [ecx]
push eax
push str.In_launchProcessInUserSession.winlogon_process_ID:__d.
push str.ProcessUtils
push 0x4aea60
push 0x1e
push ecx
mov esi, dword [esi + 0x34]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4159d2
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebx + 0x10], eax
test eax, eax
jne 0x415c0e
test edi, edi
je 0x415baa
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_open_process._ErrorCode:__d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x4159b4
cmp dword [0x4c8c94], 0
je 0x415bed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_open_process._ErrorCode:__d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
jmp 0x4159c4
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159c4
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_open_process._ErrorCode:__d_.
jmp 0x4159a2
lea esi, [ebx + 0xc]
push esi
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x415cab
test edi, edi
je 0x415c47
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_open_process_token._ErrorCode:__d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x4159b4
cmp dword [0x4c8c94], 0
je 0x415c8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_open_process_token._ErrorCode:__d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
jmp 0x4159c4
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159c4
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Standard_user._Unable_to_open_process_token._ErrorCode:__d_.
jmp 0x4159a2
lea eax, [ebx + 4]
push eax
push 1
push 2
push 0
push 0x18b
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x415898
test edi, edi
je 0x415cee
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Unable_to_duplicate_process_token.ErrorCode:___d_.
push str.ProcessUtils
push 0x4aea60
push 0x32
push edi
jmp 0x4159b4
cmp dword [0x4c8c94], 0
je 0x415d31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession._Unable_to_duplicate_process_token.ErrorCode:___d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
jmp 0x4159c4
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159c4
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Unable_to_duplicate_process_token.ErrorCode:___d_.
jmp 0x4159a2
cmp dword [0x4c8c94], 0
je 0x415d95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4c8c94]
mov ecx, esi
push eax
push str.In_launchProcessInUserSession._Unable_to_create_a_new_process_with_duplicate_token._ErrorCode:__d_.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call dword [0x49e2d4]
call esi
add esp, 0x1c
jmp 0x4159c4
mov esi, dword [0x4c8c98]
test esi, esi
je 0x4159c4
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_launchProcessInUserSession._Unable_to_create_a_new_process_with_duplicate_token._ErrorCode:__d_.
jmp 0x4159a2
test edi, edi
je 0x415dd0
mov esi, dword [edi]
push str.In_launchProcessInUserSession._Success_in_CreateProcess.
push str.ProcessUtils
push 0x4aea60
push 0x1e
push edi
jmp 0x415e21
mov esi, dword [0x4c8c94]
test esi, esi
je 0x415e04
push str.In_launchProcessInUserSession._Success_in_CreateProcess.
push 0x4aea60
push 0x4aea60
push str.ProcessUtils
push str.OOBEUtils
push 0x1e
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x18
jmp 0x415e31
mov eax, dword [0x4c8c98]
test eax, eax
je 0x415e31
mov esi, dword [eax]
push str.In_launchProcessInUserSession._Success_in_CreateProcess.
push str.ProcessUtils
push 0x4aea60
push 0x1e
push eax
mov esi, dword [esi + 0x34]
mov ecx, esi
call dword [0x49e2d4]
call esi
add esp, 0x14
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046999a
mov esp, ebp
pop ebp
ret 0x20