Function at 0x463388
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054f4
mov eax, dword [ebp - 8]
call fcn.004054f4
xor eax, eax
push ebp
push 0x46368d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
xor eax, eax
push ebp
push 0x46363c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x463628
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4636a0
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x20], eax
push 0x4636b0
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x2c], eax
push 0x4636c4
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x24], eax
push 0x4636d4
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x30], eax
push 0x4636f4
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x28], eax
push 0x463700
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x34], eax
push 0x463718
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x38], eax
call dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [ebp - 0x2c]
test eax, eax
je 0x463587
cmp dword [ebp - 4], 0
jne 0x4634c7
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ImpersonateLoggedOnUser
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4634b4
lea eax, [ebp - 0x98]
call fcn.004632cc
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xc]
call fcn.00405098
call sub.advapi32.dll_RevertToSelf
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x463587
push 0
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [ebp - 0x34]
test eax, eax
je 0x463587
lea eax, [ebp - 0x84]
xor ecx, ecx
mov edx, 0x44
call fcn.004036c0
mov dword [ebp - 0x84], 0x44
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0x420
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00405504
push eax
mov eax, dword [ebp - 4]
call fcn.00405504
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
test eax, eax
je 0x463550
mov eax, dword [ebp - 0x94]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x90]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x463577
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x9c]
call fcn.0044cc98
mov ecx, dword [ebp - 0x9c]
mov dl, 1
mov eax, dword [0x408bc8]
call fcn.0040de04
call fcn.004049b4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x18]
push eax
call dword [ebp - 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463632
cmp dword [ebp - 0x20], 0xffffffff
je 0x4635c5
xor eax, eax
push ebp
push 0x4635bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4635c5
cmp dword [ebp - 0x24], 0xffffffff
je 0x4635f6
xor eax, eax
push ebp
push 0x4635ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4635f6
cmp dword [ebp - 0x28], 0xffffffff
je 0x463627
xor eax, eax
push ebp
push 0x46361d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463627
ret