Function at 0x45c33a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x206c
call fcn.0046d920
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2008], edi
mov dword [ebp - 0x2014], eax
je 0x45c6a4
call fcn.0045218b
test al, al
je 0x45c386
pop edx
mov al, byte [0x28a72af2]
ja 0x45c3ac
scasd eax, dword es:[edi]
pop edx
xchg esi, eax
insd dword es:[edi], dx
xchg ebx, eax
and eax, 0x8b65a6f3
mov ebp, 0xffffdff8
call fcn.00452101
test al, al
je 0x45c3a5
invalid
xor ebx, ebx
lea eax, [ebp - 0x2004]
push 0x2000
push ebx
push eax
mov dword [ebp - 0x2010], ebx
mov dword [ebp - 0x200c], ebx
call fcn.00480620
push dword [ebp - 0x2014]
lea eax, [ebp - 0x2004]
push edi
push str.__s___s
push eax
call fcn.00407df0
add esp, 0x1c
call fcn.00452215
test al, al
je 0x45c40a
jmp [eax]
mov al, cl
sub ebp, esi
invalid
push str.EXPLORER.EXE
call fcn.0045da69
pop ecx
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2018], eax
test eax, eax
je 0x45c5f5
lea ecx, [ebp - 0x2010]
mov esi, 0xf01ff
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45c5f5
lea eax, [ebp - 0x200c]
push eax
push 1
push 1
push ebx
push esi
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x45c5f5
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x45c4bc
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45c4b5
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x45c5f5
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x206c]
push ebx
push eax
call fcn.00480620
push 0x10
lea eax, [ebp - 0x2028]
push ebx
push eax
call fcn.00480620
add esp, 0x18
mov dword [ebp - 0x206c], esi
call fcn.00452146
test al, al
je 0x45c502
mov dword [eax - 0x55179408], eax
cld
cmp dword [esi], esp
lahf
invalid
fnstcw word [0x5ef1e880]
invalid
call fcn.004523f8
test al, al
je 0x45c527
ror dword [ebp + 0x31], cl
adc dword [esi + edx*4], esi
mov byte [0xc4e716b5], al
inc esp
insd dword es:[edi], dx
xor al, 0xc8
mov ecx, 0xea9b36cc
adc al, 0xbf
jp 0x45c557
pop ebp
inc esp
xor esp, dword [edx - 0x18]
hlt
call fcn.00452620
test al, al
je 0x45c545
add al, 0xbf
cli
push ebx
outsb dx, byte [esi]
dec eax
in al, dx
pop ecx
fsubrp st(7)
pop ss
sbb eax, 0x669368c3
xor al, 0xd8
sub ecx, edx
push 5
pop eax
xor ebx, ebx
mov dword [ebp - 0x2064], str.WinSta0Default
mov word [ebp - 0x203c], ax
mov dword [ebp - 0x2040], 1
mov dword [ebp - 0x2008], ebx
call fcn.00452215
test al, al
je 0x45c595
invalid
mov dh, 0x6a
jg 0x45c4ff
clc
daa
inc ecx
mov ebp, 0x30c9767b
and ecx, edx
dec eax
invalid
push ebx
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2008]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x45c5f5
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x206c]
push eax
push ebx
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push 0x430
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x45c5f5
cmp dword [ebp - 0x2008], 0
je 0x45c5f5
push dword [ebp - 0x2008]
call sub.USERENV.dll_DestroyEnvironmentBlock
call fcn.00452551
test al, al
je 0x45c61a
sti
xor eax, 0x2e1b9565
push edi
and byte [esi + 0x70], dl
clc
call 0x342d8eac
sar byte [edx + 0x6a], 1
sub dword [esp + ebx], esp
ljmp 0x8bb5
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x45c630
cmp eax, 0xffffffff
je 0x45c630
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00452620
test al, al
je 0x45c654
and eax, 0x1b233f5d
sub dl, byte [edi - 6]
mov cl, 0x3d
int1
pop edi
enter 0xee5, 0xffffffffffffff91
pop ecx
std
ja 0x45c6c2
xor dword [0xafd54f84], esp
mov eax, dword [di - 0x2010]
invalid
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x45c66a
cmp eax, 0xffffffff
je 0x45c66a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2018], 0
jne 0x45c67b
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00452551
test al, al
je 0x45c6a0
test dword [esi + 0x7bf05fb3], esi
rep insd dword es:[edi], dx
inc eax
push es
add eax, 0xa442755b
xor al, 8
mov byte [eax - 0x6b], bh
popal
les ebp, [edi]
cmc
mov edi, 0xc03209fb
xor al, al
jmp 0x45c6b9
push 0
push 0
push 0
push eax
push edi
call fcn.0045bffe
add esp, 0x14
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d802
cmp al, 0x11
add dword [eax], eax
mov esp, ebp
pop ebp
ret