Function at 0x4cdfa1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x654b34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x8c], eax
lea edi, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov esi, str.S_1_16_8192
mov dword [ebp - 0x88], eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x90], eax
lea edi, [ebp - 0x84]
xor eax, eax
mov dword [ebp - 0x68], ebx
stosd dword es:[edi], eax
push 0x44
push ebx
mov dword [ebp - 0x6c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
call fcn.0056dc10
add esp, 0xc
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x4ce034
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_LoadLibrary_Advapi32.dll_failed__Error___d
call fcn.004ce607
pop ecx
pop ecx
jmp 0x4ce190
push str.ConvertStringSidToSidW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x4ce054
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_GetProcAddress_Failed__Error___d
jmp 0x4ce028
lea eax, [ebp - 0x6c]
push eax
push 0x2000000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4ce07c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_OpenProcessToken_Failed__Error___d
jmp 0x4ce028
lea eax, [ebp - 0x64]
push eax
push 1
push 2
push ebx
push 0x2000000
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4ce0a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_DuplicateTokenEx_Failed__Error___d
jmp 0x4ce028
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x4ce0c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_ConvertStringSidToSid_Failed__Error___d
call fcn.004ce624
jmp 0x4ce02d
mov eax, dword [ebp - 0x68]
push eax
mov dword [ebp - 0x70], 0x60
mov dword [ebp - 0x74], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x74]
push eax
push 0x19
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x4ce105
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_SetTokenInformation_Failed__Error___d
jmp 0x4ce028
call fcn.004cde1b
mov esi, dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
lea eax, [ebp - 0x84]
mov edx, 0x1000000
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
push ebx
push ebx
cmovne ecx, edx
push ecx
push ebx
push ebx
push ebx
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push dword [ebp - 0x64]
call esi
test eax, eax
jne 0x4ce182
call fcn.004cde1b
test eax, eax
je 0x4ce171
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push dword [ebp - 0x64]
call esi
test eax, eax
jne 0x4ce182
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_CreateProcessAsUser_Failed__Error___d
jmp 0x4ce028
mov ecx, dword [ebp - 0x90]
xor ebx, ebx
mov eax, dword [ebp - 0x7c]
inc ebx
mov dword [ecx], eax
cmp dword [ebp - 0x68], 0
je 0x4ce19f
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x6c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4ce1b0
push dword [ebp - 0x6c]
call esi
cmp dword [ebp - 0x64], 0
je 0x4ce1bb
push dword [ebp - 0x64]
call esi
test edi, edi
je 0x4ce1c6
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x84], 0xffffffff
je 0x4ce1d7
push dword [ebp - 0x84]
call esi
cmp dword [ebp - 0x80], 0xffffffff
je 0x4ce1e2
push dword [ebp - 0x80]
call esi
push ebx
push str.GPC_CreateMediumProcess:_CreateProcessAsUser_result_d
call fcn.004ce624
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056ac5f
leave
ret