Function at 0x10004c5d
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1114
call fcn.1001c5b0
mov eax, dword [0x10032010]
xor eax, esp
mov dword [esp + 0x1110], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
xor eax, eax
mov esi, 0x7fe
push esi
mov word [esp + 0x11c], ax
xor ebx, ebx
lea eax, [esp + 0x11e]
push ebx
push eax
mov dword [esp + 0x1c], edi
call fcn.1001c790
add esp, 0xc
xor eax, eax
push esi
mov word [esp + 0x91c], ax
lea eax, [esp + 0x91e]
push ebx
push eax
call fcn.1001c790
add esp, 0xc
mov esi, 0x400
push esi
lea eax, [esp + 0x11c]
push eax
push dword [esp + 0x14]
mov dword [edi + 8], ebx
call fcn.100035bc
add esp, 0xc
test eax, eax
jne 0x10004d04
push dword [ebp + 0xc]
push 7
call fcn.10001ad4
pop ecx
pop ecx
jmp 0x10004e77
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
push ebx
call edi
cmp eax, esi
jae 0x10004d24
lea eax, [esp + 0x918]
push eax
push esi
call edi
lea ebx, [esp + 0x918]
push dword [esp + 0x14]
xor esi, esi
push dword [esp + 0x14]
lea eax, [esp + 0x120]
push ebx
push esi
push dword [ebp + 0x18]
push eax
push esi
push 2
push dword [0x1003e924]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x10004d56
xor eax, eax
inc eax
jmp 0x10004e79
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x522
jne 0x10004d9c
cmp dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW], esi
je 0x10004d9c
cmp dword [0x1003e938], 1
jne 0x10004d9c
push dword [ebp + 0x18]
mov edx, dword [esp + 0x14]
push dword [esp + 0x18]
lea eax, [esp + 0x120]
push eax
push dword [esp + 0x18]
mov ecx, ebx
call fcn.10004af5
add esp, 0x10
jmp 0x10004e79
call edi
cmp eax, 3
jne 0x10004e62
mov ebx, dword [esp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004db0
sub eax, edx
mov edi, 0x100
cmp eax, edi
jae 0x10004e62
push str.sysnative
push ebx
call fcn.10014aa0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10004e62
push edi
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.1001c790
mov eax, dword [str.system32]
mov dword [esi], eax
mov eax, dword [0x1002d8d4]
mov dword [esi + 4], eax
add esp, 0xc
add esi, 9
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004e04
sub eax, ecx
push eax
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.1001b5b0
lea eax, [esp + 0x24]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004e23
sub eax, ecx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
dec esi
push esi
call fcn.1001b5b0
mov eax, ebx
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004e42
push dword [ebp + 0x18]
sub eax, ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
push ebx
call fcn.10004c5d
add esp, 0x14
jmp 0x10004e79
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esp + 0x10]
push 0x29
call fcn.10001b02
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x111c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100148e0
mov esp, ebp
pop ebp
ret