Function at 0x729983
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b10a4
mov eax, dword fs:[0]
push eax
mov eax, 0x2368
call fcn.006e70d0
mov eax, dword [0x8ca144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 0x10], 0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
je 0x729cb8
call fcn.00402330
xor ebx, ebx
lea eax, [ebp - 0x22e8]
push 0x2000
push ebx
push eax
mov dword [ebp - 0x2308], ebx
mov dword [ebp - 0x2304], ebx
call fcn.0074fc20
push edi
push esi
lea eax, [ebp - 0x22e8]
push str.__s___s
push eax
call fcn.00408370
push str.EXPLORER.EXE
call fcn.0072a350
add esp, 0x20
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2320], eax
test eax, eax
je 0x729be5
lea ecx, [ebp - 0x2308]
mov esi, 0xf01ff
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x729be5
lea eax, [ebp - 0x2304]
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0x2308]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x729be0
call fcn.00402330
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x729abc
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x729ab5
call eax
push 4
mov dword [ebp - 0x231c], eax
lea eax, [ebp - 0x231c]
push eax
push 0xc
push dword [ebp - 0x2304]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x729ab5
call fcn.00402330
jmp 0x729be5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x2374]
push ebx
push eax
call fcn.0074fc20
push 0x10
lea eax, [ebp - 0x2330]
push ebx
push eax
call fcn.0074fc20
add esp, 0x18
mov dword [ebp - 0x2374], esi
mov dword [ebp - 0x2318], ebx
mov dword [ebp - 0x2314], ebx
mov dword [ebp - 0x2310], ebx
push 0x65
pop ecx
mov esi, str.l5icv3QNZfGeLkxihIBuxEqkjvcoDlDXsYm4V9WqUqLRb3n2jqFewhoIz9ddiOHRydfOfHckoqHXUrG64Nin7ZtLODdrI8d1o1NdCW7EpayKkkeuh1R2Dp0lvs7AlBj5v7izHXLErHJvret6IV9c1LD2xuPZmEuFaPYuRQ2R4R5kjpSA7g4KtJAvyGfB8AnjfEODcz0EAO9rN4tEDVABfQbIphuq7eRTybqMt4S3URECZfkPmgVJtgcBvYWZZ635erzkQTK8eOjTJQbL6WTj7vseXBfbw5sGeTDj4Qgn2bkWK64ck2k4vBYHFrhubkASlTZ8Vy26rJdwkBz7r5HHSQ00frYXXe4QRQ2qBAkP9QVATBraNthVQpymzpJtCE1NBRYYsuX7aI4kGQkHXXPe
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x2e8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x2300]
movsb byte es:[edi], byte [esi]
call fcn.00405a50
lea eax, [ebp - 0x2300]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2318]
call fcn.004082f0
push ebx
push 1
lea ecx, [ebp - 0x2300]
mov byte [ebp - 4], bl
call fcn.004096c0
push 5
pop eax
push ebx
push dword [ebp - 0x2304]
mov word [ebp - 0x2344], ax
lea eax, [ebp - 0x230c]
push eax
mov dword [ebp - 0x236c], str.WinSta0Default
mov dword [ebp - 0x2348], 1
mov dword [ebp - 0x230c], ebx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x729b90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2318]
call fcn.006ec102
jmp 0x729be5
lea eax, [ebp - 0x2330]
push eax
lea eax, [ebp - 0x2374]
push eax
push ebx
push dword [ebp - 0x230c]
lea eax, [ebp - 0x22e8]
push 0x430
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x2304]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x729b7f
call fcn.00402330
cmp dword [ebp - 0x230c], 0
je 0x729b7f
push dword [ebp - 0x230c]
call sub.USERENV.dll_DestroyEnvironmentBlock
jmp 0x729b7f
call fcn.006ee3ed
call fcn.006edd82
cmp dword [ebp - 0x2304], 0
je 0x729c7c
cmp dword [ebp - 0x2304], 0xffffffff
je 0x729c7c
mov dword [ebp - 0x2318], ebx
mov dword [ebp - 0x2314], ebx
mov dword [ebp - 0x2310], ebx
push 0x4f
pop ecx
mov esi, str.YiWCYpAsM1rqjB3rx28DhMnzCwLj2gBkgbwkHDCTrNk1NT3SmWGA8s3NqMEFwzPcucmyTKNip6ZZUYM6gwDyteqGSiMGKGqaq1l1kJOnvbS576wMrSKRzGvrc3zPsZo8Y8Z5pyLVhBXba6sKLiJSssuZHNteK8HSMF0oKW2vmSGitBZJUsje9iJEviHSoCNT4M8Yf9XMjdRmDcA8bWWZj8uZ6M1uDhq3x4EMCH27VlhieamAsg9FidqOkmk8Eo1opTLPTKcWMpzCsFNbPyhI711ps5ExKEsSMlkEV13V1x2kLcKW2yb3O8rFo2FHS
mov dword [ebp - 4], 2
lea edi, [ebp - 0x150]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x2300]
movsw word es:[edi], word [esi]
call fcn.00405a50
lea eax, [ebp - 0x2300]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x2318]
call fcn.004082f0
push ebx
push 1
lea ecx, [ebp - 0x2300]
call fcn.004096c0
push dword [ebp - 0x2304]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2318]
call fcn.006ec102
cmp dword [ebp - 0x2308], 0
je 0x729c9f
cmp dword [ebp - 0x2308], 0xffffffff
je 0x729c9f
call fcn.006f2b04
push dword [ebp - 0x2308]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2320], 0
jne 0x729cb4
call fcn.006f221d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x729cd0
call fcn.006ef2bb
xor ebx, ebx
push ebx
push ebx
push edi
push esi
call fcn.0072940d
add esp, 0x10
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006e70bb
mov esp, ebp
pop ebp
ret