Function at 0x404890
Capabilities:
Acquire debug privileges
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415500
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x421024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
push str.LaunchApplication
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x10]
push str._s_enter_
push str.StartupAgency
mov dword [ebp - 0x7c], eax
call fcn.00401b30
push 0x44
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x38], 0
push 0
push eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x48], 0x30
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0xf8], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0xf0], str.winsta0default
movups xmmword [ebp - 0x5c], xmm0
push esi
push 0
push 0x2000000
movups xmmword [ebp - 0x90], xmm0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x404979
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Open_Process_Error:__u_n
push str.StartupAgency
call fcn.00401aa0
add esp, 0xc
mov dword [ebp - 0x60], 0
lea eax, [ebp - 0x60]
push 0x41fa04
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
lea ecx, [ebp - 0x44]
push ecx
push 0x201eb
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4049bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process_token_open_Error:__u_n
push str.StartupAgency
call fcn.00401aa0
add esp, 0xc
mov dword [ebp - 0x64], 0
lea eax, [ebp - 0x64]
push 0x41fa04
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
lea eax, [ebp - 0x98]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x404a01
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Lookup_Privilege_value_Error:__u_n
push str.StartupAgency
call fcn.00401aa0
add esp, 0xc
mov dword [ebp - 0x68], 0
lea eax, [ebp - 0x68]
push 0x41fa04
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x44]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 2
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x404a6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Duplicate_Token_Error:__u_n
push str.StartupAgency
call fcn.00401aa0
add esp, 0xc
mov dword [ebp - 0x6c], 0
lea eax, [ebp - 0x6c]
push 0x41fa04
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 4
push edi
push 0xc
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push 0
push 0
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x404ab3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x514
jne 0x404ad6
push str.Token_does_not_have_the_provilege_n
push str.StartupAgency
call fcn.00401aa0
add esp, 8
push 1
push dword [ebp - 0x38]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x404b00
mov dword [ebp - 0x48], 0x430
jmp 0x404b07
call esi
push eax
push str.Adjust_Privilege_value_Error:__u_n
push str.StartupAgency
call fcn.00401aa0
add esp, 0xc
mov dword [ebp - 0x70], 0
lea eax, [ebp - 0x70]
push 0x41fa04
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov dword [ebp - 0x3c], 0
mov esi, dword [ebp - 0x74]
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404b10
sub ecx, edx
mov edx, 2
sar ecx, 1
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004141b1
mov ecx, esi
add esp, 4
mov edi, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404b42
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + 1]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xf8]
push eax
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x48]
push 0
push 0
push 0
push edi
push 0
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push edi
mov esi, eax
call fcn.004141ac
add esp, 4
test esi, esi
jne 0x404bbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_Creating_Process_32__d
push str.StartupAgency
call fcn.00401aa0
add esp, 0xc
mov dword [ebp - 0x78], esi
lea eax, [ebp - 0x78]
push 0x41fa04
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
call fcn.00408120
test al, al
jne 0x404c8f
mov esi, dword [ebp - 0x7c]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404bd3
sub ecx, edx
mov edx, 2
sar ecx, 1
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004141b1
mov ecx, esi
add esp, 4
mov edi, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404c05
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + 1]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xf8]
push eax
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x48]
push 0
push 0
push 0
push edi
push 0
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push edi
mov esi, eax
call fcn.004141ac
add esp, 4
test esi, esi
jne 0x404c8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_Creating_Process_64__d
push str.StartupAgency
call fcn.00401aa0
add esp, 0xc
push 1
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x41fa04
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], esi
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [ebp - 0x31], 0
call fcn.00408120
test al, al
jne 0x404d77
mov eax, dword [ebp - 0x5c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x421bd0]
mov dword [ebp - 0x18], eax
mov al, byte [ebp - 0x31]
test al, al
jne 0x404d62
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x20]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
push esi
push str.Return_from_MsgWaitForMultipleObject:__d
push str.StartupAgency
call fcn.00401b30
add esp, 0xc
sub esi, 0
je 0x404d4a
sub esi, 1
je 0x404d0d
mov al, byte [ebp - 0x31]
sub esi, 1
jne 0x404cc0
push 1
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.GlobalExit_5491c4d3_0a5f_4898_bec4_cd906998e306
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x404d40
push str.Send_exit_event
push str.StartupAgency
call fcn.00401b30
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
mov al, 1
mov byte [ebp - 0x31], al
jmp 0x404cc0
push 1
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
mov byte [ebp - 0x31], al
jmp 0x404cc0
push dword [ebp - 0x90]
call edi
push dword [ebp - 0x8c]
call edi
jmp 0x404df2
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x404dec
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0xb4]
push eax
call esi
test eax, eax
je 0x404dd3
lea eax, [ebp - 0xb4]
push eax
call edi
push 1
push 0
push 0
push 0
lea eax, [ebp - 0xb4]
push eax
call esi
test eax, eax
jne 0x404db5
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x404da0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x404e00
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov dword [ebp - 0x40], 0
xor esi, esi
nop dword [eax]
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x404e50
cmp esi, 0x64
jge 0x404e50
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x40]
push str.Exit_Code:__lu
push str.StartupAgency
call fcn.00401b30
mov eax, dword [ebp - 0x40]
add esp, 0xc
cmp eax, 0x103
jne 0x404e53
inc esi
jmp 0x404e10
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_:__lu__code_:__lu
push str.StartupAgency
call fcn.00401b30
add esp, 0x10
push dword [ebp - 0x5c]
call edi
push dword [ebp - 0x58]
call edi
push dword [ebp - 0x4c]
call edi
push dword [ebp - 0x44]
call edi
push dword [ebp - 0x38]
call edi
push str.LaunchApplication
push str._s_exit_
push str.StartupAgency
call fcn.00401b30
add esp, 0xc
mov eax, 1
jmp 0x404eee
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414132
mov esp, ebp
pop ebp
ret