Function at 0x48f180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58e696
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x5eb3c0]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x2b8]
mov dword fs:[0], eax
xor eax, eax
mov esi, edx
mov edi, ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0xa8], 7
mov dword [esp + 0xa4], eax
mov word [esp + 0x94], ax
mov dword [esp + 0x2c0], eax
push 0x40
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x50]
push eax
call fcn.005695a0
xor ebx, ebx
add esp, 0xc
cmp word [edi], 0x22
mov eax, 1
setne bl
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x70], eax
mov word [esp + 0x74], ax
test ebx, ebx
je 0x48f25c
push eax
push 0x5aeae8
lea esi, [esp + 0x98]
call fcn.0043a8d0
mov esi, dword [esp + 0x24]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48f261
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x98]
call fcn.0043a690
test ebx, ebx
je 0x48f295
push 1
push 0x5aeae8
lea ecx, [esp + 0x98]
call fcn.0043a690
test esi, esi
je 0x48f2ce
push 1
push 0x5aeaec
lea ecx, [esp + 0x98]
call fcn.0043a690
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48f2b1
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x98]
call fcn.0043a690
lea ecx, [esp + 0x2c]
push ecx
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push eax
call edi
test eax, eax
jne 0x48f2f8
mov dword [esp + 0x14], 0xfffffff9
jmp 0x48f627
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x24]
push edx
push eax
lea ebx, [esp + 0x38]
call fcn.0053a450
add esp, 8
test eax, eax
jne 0x48f31f
mov dword [esp + 0x14], 0xfffffff8
jmp 0x48f627
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
call fcn.0053a320
test eax, eax
je 0x48f404
lea edx, [esp + 0x18]
push edx
call fcn.0053a4f0
add esp, 4
test eax, eax
jne 0x48f350
mov dword [esp + 0x14], 0xfffffffe
jmp 0x48f627
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0053a5d0
add esp, 8
test eax, eax
jne 0x48f373
mov dword [esp + 0x14], 0xfffffffd
jmp 0x48f627
mov edx, dword [esp + 0x1c]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x48f627
lea eax, [esp + 0x20]
push eax
push 0xf01ff
push esi
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [esp + 0xa8], 8
mov eax, dword [esp + 0x94]
jae 0x48f3bd
lea eax, [esp + 0x94]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x44]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x48f627
mov ecx, dword [esp + 0x38]
push ecx
call esi
mov edx, dword [esp + 0x34]
push edx
call esi
mov dword [esp + 0x14], 0
jmp 0x48f627
xor eax, eax
lea ebx, [esp + 0x24]
lea edi, [esp + 0x18]
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
call fcn.0053a280
test eax, eax
je 0x48f61f
cmp dword [esp + 0x1c], 2
jne 0x48f5c6
cmp dword [esp + 0x18], 6
jb 0x48f5c6
mov edi, dword [esp + 0x2c]
call fcn.0053a3d0
call dword [sym.imp.USER32.dll_GetShellWindow]
xor edi, edi
cmp eax, edi
jne 0x48f463
mov dword [esp + 0x14], 0xfffffff6
jmp 0x48f627
lea ecx, [esp + 0x1c]
push ecx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0x48f484
mov dword [esp + 0x14], 0xfffffff5
jmp 0x48f627
mov edx, dword [esp + 0x1c]
push edx
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x24], esi
jne 0x48f4ac
mov dword [esp + 0x14], 0xfffffff3
jmp 0x48f627
lea eax, [esp + 0x18]
push eax
push 2
push esi
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x48f5bd
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push 1
push 2
push edi
push 0x18b
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x48f5b2
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x48f5b2
push str.CreateProcessWithTokenW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x48f5a7
cmp dword [esp + 0xa8], 8
mov eax, dword [esp + 0x94]
jae 0x48f52b
lea eax, [esp + 0x94]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
push edi
push edi
push edi
push eax
mov eax, dword [esp + 0x38]
push edi
push edi
push eax
call esi
cmp eax, edi
jne 0x48f58f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x422
jne 0x48f5a7
call fcn.0048f760
test eax, eax
je 0x48f5a7
cmp dword [esp + 0xa8], 8
mov eax, dword [esp + 0x94]
jae 0x48f574
lea eax, [esp + 0x94]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
push edi
push edi
push edi
push eax
mov eax, dword [esp + 0x38]
push edi
push edi
push eax
call esi
cmp eax, edi
je 0x48f5a7
mov ecx, dword [esp + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x34]
push edx
call esi
mov dword [esp + 0x14], edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48f627
cmp dword [esp + 0xa8], 8
mov eax, dword [esp + 0x94]
jae 0x48f5de
lea eax, [esp + 0x94]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x48f627
mov eax, dword [esp + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x34]
push ecx
call esi
mov dword [esp + 0x14], 0
jmp 0x48f627
mov dword [esp + 0x14], 0xfffffff4
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x48f636
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x48f645
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x48f656
push eax
call fcn.00566eaf
add esp, 4
push 0x1fe
lea edx, [esp + 0xb2]
push 0
push edx
mov word [esp + 0xb8], 0
call fcn.005695a0
mov edi, dword [esp + 0x20]
add esp, 0xc
push edi
lea eax, [esp + 0xb0]
push str.from1ver0.3errcode_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea esi, [esp + 0x24]
call fcn.0048fbb0
mov byte [esp + 0x2c0], 1
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x48f6b7
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push str.duba_createprocess_by_svc
call eax
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x28]
call fcn.0048fa90
mov eax, dword [esp + 0x98]
mov ebx, 8
add esp, 4
cmp dword [esp + 0xa8], ebx
jae 0x48f6e7
lea eax, [esp + 0x94]
mov esi, dword [esp + 0x28]
test esi, esi
je 0x48f709
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x18]
push str.cmdline
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
push 0
mov ecx, esi
call eax
test esi, esi
mov byte [esp + 0x2c0], 0
je 0x48f71e
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
cmp dword [esp + 0xa8], ebx
jb 0x48f737
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00563626
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x2b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.00564207
mov esp, ebp
pop ebp
ret