Function at 0x450370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x22c], 0
xor eax, eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x278], 0
push 0x40
push 0
lea ecx, [ebp - 0x274]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x21c], 0xffffffff
mov word [ebp - 0x218], 0
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
call fcn.0044d7e0
add esp, 4
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x45042b
jmp 0x450848
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call fcn.0044fa90
add esp, 8
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x45047f
push 0xff
push 0x4755d0
call fcn.0044dfd0
add esp, 8
push eax
push 0x4755e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x450848
push 0x4755fc
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x4504d5
push 0x475600
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push str._noshowcheckbox
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
jmp 0x450509
push 0x475644
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x475660
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
call fcn.0044fef0
test eax, eax
je 0x450739
call fcn.0044ffb0
test eax, eax
je 0x450739
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x29c], 0
xor ecx, ecx
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x28c], 0
xor edx, edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], 0
push 0x475670
call fcn.0044fd00
add esp, 4
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0xffffffff
setne al
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x4505ca
push 0x118
push 0x47568c
call fcn.0044dfd0
add esp, 8
push eax
push str.hExeplorer_INVALID_HANDLE_VALUE
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x450848
lea ecx, [ebp - 0xc]
push ecx
push 0xf01ff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x45061d
push 0x11d
push 0x4756c0
call fcn.0044dfd0
add esp, 8
push eax
push str.OpenProcessToken_hExeplorer_TOKEN_ALL_ACCESS_hToken_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x450848
lea eax, [ebp - 0x290]
push eax
push 4
lea ecx, [ebp - 0x280]
push ecx
push 0x13
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x21c], eax
push 0
mov ecx, dword [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x27c]
push edx
call sub.USERENV.dll_CreateEnvironmentBlock
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x45069a
push 0x121
push 0x475708
call fcn.0044dfd0
add esp, 8
push eax
push str.CreateEnvironmentBlock__LPVOID__lpEnvironment__HprimaryToken__FALSE_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x450848
mov dword [ebp - 0x29c], 0xc
mov dword [ebp - 0x28c], 0xc
mov dword [ebp - 0x278], 0x44
mov dword [ebp - 0x270], 0x475760
mov dword [ebp - 0x24c], 0x41
mov word [ebp - 0x248], 5
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x278]
push ecx
push 0
mov edx, dword [ebp - 0x27c]
push edx
push 0x400
push 0
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x29c]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x27c]
push ecx
call sub.USERENV.dll_DestroyEnvironmentBlock
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x22c]
mov dword [edx], eax
jmp 0x450848
mov dword [ebp - 0x2a8], 0
xor ecx, ecx
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x2f0], 0
push 0x40
push 0
lea edx, [ebp - 0x2ec]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.WTSAPI32.dll_WTSQueryUserToken
mov dword [ebp - 0x2a8], 0xc
lea edx, [ebp - 0x21c]
push edx
push 1
push 2
lea eax, [ebp - 0x2a8]
push eax
push 0x2000000
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x4507e0
push 0x14a
push 0x475780
call fcn.0044dfd0
add esp, 8
push eax
push str.DuplicateTokenEx_hToken__MAXIMUM_ALLOWED___sa__SecurityImpersonation__TokenPrimary__HprimaryToken_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401020
add esp, 0xc
jmp 0x450848
mov dword [ebp - 0x2f0], 0x44
mov dword [ebp - 0x2e8], str.WinSta0Default
mov dword [ebp - 0x2c4], 0x41
mov word [ebp - 0x2c0], 5
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x2f0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x22c]
mov dword [eax], ecx
cmp dword [ebp - 0x21c], 0xffffffff
je 0x450868
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x21c], 0xffffffff
cmp dword [ebp - 0xc], 0xffffffff
je 0x45087f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp - 8], 0xffffffff
je 0x450896
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp - 0x228], 0xffffffff
je 0x4508b6
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x228], 0xffffffff
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret