Function at 0x426fa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4607d7
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
mov eax, dword [0x4a1d50]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
push str.LaunchProcessAsUser...
lea ecx, [esp + 0x18]
call fcn.0040130b
xor esi, esi
push esi
lea eax, [esp + 0x18]
push eax
push 2
mov dword [esp + 0x8c], esi
call fcn.0040fcf3
or dword [esp + 0x8c], 0xffffffff
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004017c4
push 0x44
pop ebx
push ebx
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00448000
add esp, 0xc
push 0x10
lea eax, [esp + 0x20]
push esi
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], str.winsta0default
call fcn.00448000
add esp, 0xc
xor ebx, ebx
inc ebx
push ebx
push dword [edi]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], 0x20
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x42705f
mov dword [esp + 0x18], 0x420
jmp 0x4270a1
push str.CreateEnvironmentBlock_failed
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], esi
call fcn.0040130b
mov dword [esp + 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.0040fcf3
or dword [esp + 0x8c], 0xffffffff
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004017c4
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
push str._Skip
push eax
call fcn.0040107c
add esp, 0xc
push 2
pop ecx
mov dword [esp + 0x80], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
xor ebx, ebx
inc eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.00436333
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x427135
push str.operator_new_failed
lea ecx, [esp + 0x18]
call fcn.0040130b
push esi
lea eax, [esp + 0x18]
push eax
push 1
mov byte [esp + 0x8c], 3
call fcn.0040fcf3
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004017c4
push 8
pop esi
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004017c4
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
push ecx
inc eax
push eax
push ebx
call fcn.00448ce8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x30]
push ecx
push esi
push dword [esp + 0x18]
push dword [esp + 0x28]
push esi
push esi
push esi
push ebx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [esp + 0x14], esi
cmp eax, esi
jne 0x4271bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CreateProcessAsUser_failed:
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.0040130b
mov byte [esp + 0x80], 4
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push 1
call fcn.0040fcf3
mov byte [esp + 0x8c], 2
mov ecx, dword [esp + 0x24]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004017c4
push dword [esp + 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x1c]
call esi
push dword [esp + 0x20]
call esi
push ebx
call fcn.0043633e
mov esi, dword [esp + 0x18]
pop ecx
jmp 0x427115