Function at 0x407298
Capabilities:
Create process on windows

Disassembly:
push 0x288
mov eax, 0x41cd53
call fcn.0041b8a8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x234], eax
push 0x44
pop esi
sub ebx, ebx
push esi
sub edi, edi
lea eax, [ebp - 0x294]
push ebx
inc edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x22c], ebx
call fcn.0040e690
or dword [ebp - 0x268], edi
mov word [ebp - 0x264], di
sub eax, eax
lea edi, [ebp - 0x248]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x28c], str.winsta0default
stosd dword es:[edi], eax
call fcn.004019ef
push eax
pop esi
cmp esi, ebx
jbe 0x4074b9
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push esi
push ebx
mov edi, 0x2000000
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
cmp eax, ebx
je 0x4074b9
lea ecx, [ebp - 0x228]
push ecx
push 0xe
push eax
mov dword [ebp - 0x228], ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp dword [ebp - 0x228], ebx
je 0x4074a5
push 0x42224c
lea esi, [ebp + 8]
call fcn.0040a377
cmp eax, 0xffffffff
je 0x407373
sub eax, eax
mov word [ebp - 0x21c], ax
jmp 0x40739c
push 0x104
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, ebx
je 0x40739c
sub ecx, ecx
mov word [eax], cx
mov eax, dword [0x428020]
mov ecx, 0x428020
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push dword [ebp + 8]
push eax
push str._s_s__s
lea eax, [ebp - 0x220]
call fcn.00402420
add esp, 0x10
lea eax, [ebp - 0x224]
push eax
push 1
push 1
push ebx
push edi
push dword [ebp - 0x228]
mov dword [ebp - 0x224], ebx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, dword [ebp - 0x220]
or eax, eax
je 0x40748d
push 4
lea eax, [ebp - 0x230]
push eax
push 0xc
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push ebx
push dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
or eax, eax
je 0x407481
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x294]
push eax
push ebx
push dword [ebp - 0x220]
push 0x420
push ebx
push ebx
push ebx
push esi
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x234]
cmp eax, ebx
je 0x407475
mov ecx, dword [ebp - 0x248]
mov dword [eax], ecx
push dword [ebp - 0x220]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00402daa
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x22c], ebx
jne 0x4074fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
pop esi
push esi
push str.___Returning_PrvLaunchCheckerAsInteractiveUser__Error:_0x_X__n
call fcn.0040709d
pop ecx
pop ecx
cmp esi, ebx
jle 0x4074de
and esi, 0xffff
or esi, 0x80070000
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00402daa
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.00402daa
push esi
pop eax
call fcn.0041b8f2
ret
sub esi, esi
jmp 0x4074de