Function at 0x407820
Capabilities:
Create process on windows
Get session information
Get session user name
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f010
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push ebx
push esi
push edi
mov eax, dword [0x4516f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.CreateProcessAsSessionId_r_n
mov eax, 0x4556b4
mov dword [ebp - 4], 1
call fcn.00401370
push edi
push str.Session_ID___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp + 8]
push eax
push str.FilePath___s_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp + 0xc]
push ecx
push str.CommandLine___s_r_n
mov eax, 0x4556b4
call fcn.00401370
add esp, 0x1c
call fcn.0040b4b0
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4078b8
push 0x80004005
call fcn.004021b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
push 0x446130
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x18], ebx
call fcn.004020f0
push 0x44
lea ecx, [ebp - 0x70]
push ebx
push ecx
mov byte [ebp - 4], 3
call fcn.0042af90
xor eax, eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
push 0x44
push str.cb___d_r_n
mov eax, 0x4556b4
mov dword [ebp - 0x70], 0x44
call fcn.00401370
movzx edx, word [ebp - 0x3e]
push edx
push str.cbReserved2___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x48]
push eax
push str.dwFillAttribute___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x44]
push ecx
push str.dwFlags___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x60]
push edx
push str.dwX___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x50]
push eax
push str.dwXCountChars___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x58]
push ecx
push str.dwXSize___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x5c]
add esp, 0x44
push edx
push str.dwY___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x4c]
push eax
push str.dwYCountChars___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x54]
push ecx
push str.dwYSize___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x30]
push edx
push str.hStdError___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x38]
push eax
push str.hStdInput___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x34]
push ecx
push str.hStdOutput___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x68]
push edx
push str.lpDesktop___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x6c]
push eax
push str.lpReserved___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x3c]
add esp, 0x40
push ecx
push str.lpReserved2___x_r_n
mov eax, 0x4556b4
call fcn.00401370
movzx edx, word [ebp - 0x40]
push edx
push str.wShowWindow___d_r_n
mov eax, 0x4556b4
call fcn.00401370
xor eax, eax
add esp, 0x10
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 5
push edi
push ebx
mov dword [ebp - 0xa4], 0x20
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov esi, eax
cmp esi, ebx
je 0x407d5a
mov eax, dword [ebp - 0x18]
push eax
mov dword [ebp - 0x9c], eax
push str.User_:__s_r_n
mov eax, 0x4556b4
call fcn.00401370
add esp, 8
lea edx, [ebp - 0x14]
push edx
push edi
call sub.WTSAPI32.dll_WTSQueryUserToken
mov esi, eax
mov eax, dword [ebp - 0x14]
push eax
push str.User_Token_handle_:__x_r_n
mov eax, 0x4556b4
call fcn.00401370
add esp, 8
cmp esi, ebx
je 0x407d5a
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push 1
push 1
push ebx
push 0x2000000
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, eax
cmp esi, ebx
je 0x407d5a
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xa4]
push eax
push ecx
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
mov esi, eax
cmp esi, ebx
je 0x407d5a
mov edx, dword [ebp - 0x10]
push 1
push edx
lea eax, [ebp - 0x1c]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
mov esi, eax
cmp esi, ebx
je 0x407d5a
lea ecx, [ebp - 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov edx, dword [ebp - 0x68]
push edx
push str.lpDesktopBefore___s_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x68]
push eax
push str._x_r_n
mov eax, 0x4556b4
call fcn.00401370
add esp, 0x10
push ebx
lea ecx, [ebp - 0x24]
call fcn.00401f20
push eax
mov dword [ebp - 0x68], eax
push str.lpDesktopAfter___s_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x68]
push ecx
push str._x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x70]
push edx
push str.cb___d_r_n
mov eax, 0x4556b4
call fcn.00401370
movzx eax, word [ebp - 0x3e]
push eax
push str.cbReserved2___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x48]
push ecx
push str.dwFillAttribute___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x44]
push edx
push str.dwFlags___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x60]
push eax
push str.dwX___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x50]
push ecx
push str.dwXCountChars___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x58]
add esp, 0x40
push edx
push str.dwXSize___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x5c]
push eax
push str.dwY___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x4c]
push ecx
push str.dwYCountChars___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x54]
push edx
push str.dwYSize___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x30]
push eax
push str.hStdError___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x38]
push ecx
push str.hStdInput___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x34]
push edx
push str.hStdOutput___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov eax, dword [ebp - 0x68]
push eax
push str.lpDesktop___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp - 0x6c]
add esp, 0x40
push ecx
push str.lpReserved___x_r_n
mov eax, 0x4556b4
call fcn.00401370
mov edx, dword [ebp - 0x3c]
push edx
push str.lpReserved2___x_r_n
mov eax, 0x4556b4
call fcn.00401370
movzx eax, word [ebp - 0x40]
push eax
push str.wShowWindow___d_r_n
mov eax, 0x4556b4
call fcn.00401370
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
lea eax, [ebp - 0x20]
push str.__s___s
push eax
call fcn.004049b0
mov eax, dword [ebp - 0x1c]
add esp, 0x28
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x70]
push edx
mov edx, dword [ebp - 0x10]
push ebx
push eax
push 0x400
push ebx
push ebx
push ebx
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
push esi
push str.CreateProcessAsUser___d_r_n
mov eax, 0x4556b4
call fcn.00401370
add esp, 8
cmp esi, ebx
jne 0x407e64
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x407d70
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x88]
cmp eax, ebx
je 0x407d8b
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov dword [ebp - 0x88], ebx
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x407d9b
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x407da8
push eax
call edi
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x407db5
push eax
call edi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x7c], ebx
je 0x407dc0
mov ecx, dword [ebp - 0x80]
push ecx
call edi
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407de3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407e06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407e28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407e4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x10], ebx
je 0x407e77
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x80]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x80]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
jmp 0x407d60