Function at 0x411bc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
call fcn.004119e0
test eax, eax
je 0x411e72
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00411a70
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
cmp dword [ebp - 0x10], 0
je 0x411e70
mov edx, dword [ebp - 0x10]
push edx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x411c2a
cmp dword [ebp - 8], 0
jne 0x411c5e
push 0x4e2624
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._______Error_:_OpenProcess_is_failed__Error_code_is_:
mov eax, dword [ebp - 4]
push eax
call fcn.0040d6f0
add esp, 8
mov ecx, eax
call fcn.00411e90
push eax
call fcn.0040d6f0
add esp, 8
xor al, al
jmp 0x411e85
lea ecx, [ebp - 0x14]
push ecx
push 0xf01ff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x411cb3
push 0x4e278c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._______Error_:_OpenProcessToken_is_failed__Error_code_is_:
mov eax, dword [ebp - 4]
push eax
call fcn.0040d6f0
add esp, 8
mov ecx, eax
call fcn.00411e90
push eax
call fcn.0040d6f0
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x411e85
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov dword [ebp - 0x6c], 0
push 0x40
push 0
lea eax, [ebp - 0x68]
push eax
call fcn.004b6f30
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x6c]
push ecx
call fcn.004b6f30
add esp, 0xc
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov dword [ebp - 0x6c], 0x44
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov dword [ebp - 0xc], 0
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x411d90
push 0x4e281c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._______Waring_:_CreateEnvironmentBlock_failed__Error_code_is_:
mov edx, dword [ebp - 4]
push edx
call fcn.0040d6f0
add esp, 8
mov ecx, eax
call fcn.00411e90
push eax
call fcn.0040d6f0
add esp, 8
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x420
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x411e30
push str._______Info_:_CreatProcess_success__n
mov eax, dword [ebp - 4]
push eax
call fcn.0040d6f0
add esp, 8
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x411e85
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
push 0x4e2888
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._______Error_:_CreateProcessAsUser___failed__Error_code_is_:
mov eax, dword [ebp - 4]
push eax
call fcn.0040d6f0
add esp, 8
mov ecx, eax
call fcn.00411e90
push eax
call fcn.0040d6f0
add esp, 8
jmp 0x411e83
push str._______Error_:_Currentuser_isnt_System_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040d6f0
add esp, 8
xor al, al
mov esp, ebp
pop ebp
ret