Function at 0x42485a
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x479b74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x230], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x228], eax
mov eax, dword [ebp + 0x1c]
push 0x44
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x298]
push ecx
push eax
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x22c], ecx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x250]
stosd dword es:[edi], eax
add esp, 0xc
xor ecx, ecx
mov esi, ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x220], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x214], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x218]
push eax
push 1
push 2
push ecx
push 0x2000000
mov edi, ecx
push ebx
mov dword [ebp - 0x224], edi
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x424923
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov ecx, eax
mov dword [ebp - 0x214], ecx
call fcn.00427566
jmp 0x424b0f
push 5
pop eax
xor ebx, ebx
mov word [ebp - 0x268], ax
push ebx
push dword [ebp - 0x218]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x298], 0x44
push eax
mov dword [ebp - 0x290], ebx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x424976
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov ecx, eax
mov dword [ebp - 0x214], ecx
call fcn.00427566
jmp 0x424b11
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x424957
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x42499d
xor ecx, ecx
cmp cx, word [eax]
jne 0x4249a9
lea eax, [ebp - 0x210]
mov dword [ebp - 0x228], eax
mov ebx, dword [ebp - 0x230]
test ebx, ebx
je 0x4249ba
xor eax, eax
cmp ax, word [ebx]
jne 0x424a07
push 0x40ce88
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push 0x40ce98
push eax
call fcn.00416afb
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0x214], ecx
test ecx, ecx
jns 0x4249f6
call fcn.00427566
mov esi, dword [ebp - 0x220]
jmp 0x424b0f
mov esi, dword [ebp - 0x220]
xor eax, eax
inc eax
mov ebx, esi
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x424a50
xor ecx, ecx
cmp word [eax], cx
je 0x424a50
push eax
push ebx
lea eax, [ebp - 0x224]
push 0x4093dc
push eax
call fcn.00416afb
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0x214], ecx
test ecx, ecx
jns 0x424a4a
call fcn.00427566
mov edi, dword [ebp - 0x224]
jmp 0x424b0f
mov edi, dword [ebp - 0x224]
push 4
lea eax, [ebp - 0x238]
push eax
push 0xc
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x424904
push 4
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 1
push eax
push 0x1a
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x424904
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x298]
push eax
mov eax, dword [ebp - 0x228]
push eax
push dword [ebp - 0x21c]
mov eax, dword [ebp - 0x22c]
shl eax, 4
or eax, 0x400
push eax
xor eax, eax
push eax
push eax
push eax
push edi
push ebx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x424904
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x424af1
mov eax, dword [ebp - 0x250]
mov dword [ecx], eax
jmp 0x424afd
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x214]
xor ebx, ebx
call fcn.0042757e
test edi, edi
je 0x424b21
mov ecx, edi
call fcn.00427347
cmp dword [ebp - 0x21c], 0
je 0x424b3c
push dword [ebp - 0x21c]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov dword [ebp - 0x21c], ebx
cmp dword [ebp - 0x218], 0
je 0x424b57
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x218], ebx
test esi, esi
je 0x424b62
mov ecx, esi
call fcn.00427347
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004729c0
leave
ret 0x20