Function at 0x403450
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x40690c
mov eax, dword fs:[0]
push eax
sub esp, 0x7d8
mov eax, dword [0x40b424]
xor eax, esp
mov dword [esp + 0x7d4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40b424]
xor eax, esp
push eax
lea eax, [esp + 0x7ec]
mov dword fs:[0], eax
xor edi, edi
cmp dword [0x40b864], edi
jne 0x403a93
push 0x3bf
push str..loginService.cpp
lea ecx, [esp + 0x40]
call fcn.00405530
add eax, 4
push str.RunAtMgr____start
push eax
mov dword [esp + 0x7fc], edi
call fcn.004014d0
or ebp, 0xffffffff
add esp, 8
lea ecx, [esp + 0x38]
mov dword [esp + 0x7f4], ebp
call fcn.00405740
mov eax, dword [0x40b004]
push str.Wtsapi32.dll
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x20], eax
cmp eax, edi
je 0x403a93
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x40355f
push 0x3da
push str..loginService.cpp
lea ecx, [esp + 0x40]
call fcn.00405530
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x7f4], 1
call ebx
push eax
push str.GetProcAddress_WTSQueryUserToken_failed__error_code_:
add edi, 4
push edi
call fcn.004054d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x38]
mov dword [esp + 0x7f4], ebp
call fcn.00405740
xor edi, edi
jmp 0x403565
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], edi
cmp esi, edi
je 0x4035c9
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push edx
call esi
test eax, eax
jne 0x4035c9
push 0x3e1
push str..loginService.cpp
lea ecx, [esp + 0x40]
call fcn.00405530
mov esi, eax
mov dword [esp + 0x7f4], 2
call ebx
push eax
push str.Call_WTSQueryUserToken_failed__error_code_:
add esi, 4
push esi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x38]
mov dword [esp + 0x7f4], ebp
call fcn.00405740
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
push 1
push 1
push edi
push 0x2000000
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push 0x44
lea edx, [esp + 0xc4]
push edi
push edx
call sub.MSVCR90.dll_memset
xor eax, eax
add esp, 0xc
push str.Userenv.dll
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0xc4], 0x44
mov dword [esp + 0xcc], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
test ebp, ebp
jne 0x403643
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x403a93
push str.CreateEnvironmentBlock
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x4036a6
push 0x3fa
push str..loginService.cpp
lea ecx, [esp + 0x40]
call fcn.00405530
mov edi, eax
mov dword [esp + 0x7f4], 3
call ebx
push eax
push str.PCreateEnvironmentBlock_failed__error_code_:
add edi, 4
push edi
call fcn.004054d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
or ebx, 0xffffffff
lea ecx, [esp + 0x38]
mov dword [esp + 0x7f4], ebx
call fcn.00405740
jmp 0x4036a9
or ebx, 0xffffffff
xor edi, edi
mov dword [esp + 0x18], edi
test esi, esi
je 0x4036c2
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esp + 0x20]
push edx
call esi
mov edi, eax
push 0x403
push str..loginService.cpp
lea ecx, [esp + 0x40]
call fcn.00405530
push edi
add eax, 4
push str.CreateEnvironmentBlock_result_:
push eax
mov dword [esp + 0x800], 4
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
lea ecx, [esp + 0x38]
mov dword [esp + 0x7f4], ebx
call fcn.00405740
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x3f2]
push ecx
mov word [esp + 0x3f4], ax
call sub.MSVCR90.dll_memset
lea edx, [esp + 0x3f4]
push 0x200
push edx
call fcn.004012d0
add esp, 0x14
test eax, eax
jne 0x403794
push 0x409
push str..loginService.cpp
lea ecx, [esp + 0x40]
call fcn.00405530
add eax, 4
push str.GetProgramData_Error.
push eax
mov dword [esp + 0x7fc], 5
call fcn.004014d0
add esp, 8
lea ecx, [esp + 0x38]
mov dword [esp + 0x7f4], ebx
call fcn.00405740
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call esi
mov eax, dword [esp + 0x20]
push eax
call esi
jmp 0x403a93
lea ecx, [esp + 0x18c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
lea ecx, [esp + 0x3e8]
push ecx
lea ecx, [esp + 0x190]
mov dword [esp + 0x7f8], 6
call dword [0x407138]
push 0x407b0c
lea ecx, [esp + 0x190]
call dword [0x407138]
push str.WebEx
lea ecx, [esp + 0x190]
call dword [0x407138]
push 0x407b0c
lea ecx, [esp + 0x190]
call dword [0x407138]
push str.Temp.ini
lea ecx, [esp + 0x190]
call dword [0x407138]
lea edx, [esp + 0x3e8]
push edx
lea ecx, [esp + 0x1c8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_unsigned_short_int_const__]
push str.webexwebex932_atscmgr.exe
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x7f8], 7
call dword [0x407138]
push 0x208
lea eax, [esp + 0x1e4]
push 0
push eax
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x19c]
mov ebx, 8
add esp, 0xc
cmp dword [esp + 0x1a4], ebx
jae 0x40386b
lea ecx, [esp + 0x190]
mov eax, dword [esp + 0x1c8]
cmp dword [esp + 0x1dc], ebx
jae 0x403882
lea eax, [esp + 0x1c8]
push ecx
push 0x104
lea ecx, [esp + 0x1e8]
push ecx
push eax
push str.AtMgrPath
push str.WebEx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 0x1a8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
push 0x407d3c
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x7f8], bl
call dword [0x407138]
lea edx, [esp + 0x18c]
push edx
lea ecx, [esp + 0x1ac]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
push 0x42a
push str..loginService.cpp
lea ecx, [esp + 0x40]
call fcn.00405530
mov ecx, dword [esp + 0x1ac]
mov byte [esp + 0x7f4], 9
cmp dword [esp + 0x1c0], ebx
jae 0x40390e
lea ecx, [esp + 0x1ac]
push ecx
push 0x407d38
lea ecx, [esp + 0x1e8]
push ecx
add eax, 4
push str.RunExePath:
push eax
call fcn.004014d0
add esp, 8
push eax
call fcn.004054d0
add esp, 8
push eax
call fcn.004014d0
add esp, 8
push eax
call fcn.004054d0
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0x7f4], bl
call fcn.00405740
mov eax, dword [esp + 0x1ac]
cmp dword [esp + 0x1c0], ebx
jae 0x40396f
lea eax, [esp + 0x1ac]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc4]
push ecx
mov ecx, dword [esp + 0x1c]
push 0
push edx
push 0x430
push 0
push 0
push 0
push eax
lea eax, [esp + 0x204]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4039f9
push 0x43c
push str..loginService.cpp
lea ecx, [esp + 0x10c]
call fcn.00405530
mov esi, eax
mov byte [esp + 0x7f4], 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUser_atmgr.exe__failed__error_code_:
add esi, 4
push esi
call fcn.004014d0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea ecx, [esp + 0x104]
mov byte [esp + 0x7f4], bl
call fcn.00405740
push str.DestroyEnvironmentBlock
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403a14
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x403a14
push ecx
call eax
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
call fcn.00401fc0
call fcn.00402750
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
or esi, 0xffffffff
lea ecx, [esp + 0x1a8]
mov dword [0x40b864], 1
mov dword [0x40b004], esi
mov byte [esp + 0x7f4], 7
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x7f4], 6
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esp + 0x18c]
mov dword [esp + 0x7f4], esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov ecx, dword [esp + 0x7ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7d4]
xor ecx, esp
call fcn.00405af7
add esp, 0x7e4
ret