Function at 0x450403
Capabilities:
Create process on windows
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x40c], eax
xor eax, eax
mov dword [ebp - 0x434], esi
lea edi, [ebp - 0x430]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x49c]
push esi
push eax
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x408], esi
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x4a0], 0x44
call sub.MSVCR100.dll_memset
xor eax, eax
push 0x3fe
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x402]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
push ebx
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x424], eax
cmp eax, esi
je 0x4506c8
mov edi, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0x408]
push ecx
push 0x60000
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x45069c
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x43c]
push eax
push esi
push esi
push 4
push 6
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x45069c
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x45069c
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x420], 0x200
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x45069c
push esi
push 1
push 0xb
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
lea ecx, [ebp - 0x410]
push ecx
push dword [ebp - 0x41c]
xor eax, eax
lea ecx, [ebp - 0x45c]
inc eax
push ecx
push eax
mov dword [ebp - 0x444], eax
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x45069c
push esi
push dword [ebp - 0x410]
push esi
push esi
push 4
push 6
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
jne 0x450688
push dword [ebp - 0x408]
call ebx
lea eax, [ebp - 0x408]
push eax
push 0xb
push dword [ebp - 0x424]
mov dword [ebp - 0x408], esi
call edi
test eax, eax
je 0x450688
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x4a0]
push eax
push esi
push esi
push dword [ebp + 0x14]
push esi
push esi
push esi
push dword [ebp - 0x438]
push esi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x418], eax
cmp eax, esi
jne 0x450629
mov dword [ebp - 0x40c], 0x80004005
cmp dword [ebp + 0x18], esi
je 0x45066f
cmp eax, esi
je 0x45066f
cmp dword [ebp - 0x434], 0xffffffff
je 0x45066f
push 0xffffffffffffffff
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x418], eax
cmp eax, esi
jne 0x45066f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x434]
call ebx
cmp dword [ebp - 0x430], 0xffffffff
je 0x450688
push dword [ebp - 0x430]
call ebx
cmp dword [ebp - 0x410], esi
je 0x45069c
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x414], esi
je 0x4506b0
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x408], esi
je 0x4506c0
push dword [ebp - 0x408]
call ebx
push dword [ebp - 0x424]
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x40c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004534b8
leave
ret