Function at 0x6663bc
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Terminate process

Disassembly:
push 0x80
mov eax, 0x69e705
call fcn.0049be90
mov esi, ecx
mov dword [ebp - 0x28], esi
and dword [ebp - 4], 0
mov byte [ebp - 4], 3
xor edi, edi
mov eax, dword [ebp + 8]
inc edi
push 0xd
pop ebx
mov dword [ebp - 0x18], ebx
cmp dword [eax - 4], edi
jle 0x6663f7
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x66643c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
cmp dword [eax - 4], edi
jle 0x666423
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov eax, dword [ebp + 8]
push ebx
push eax
push str.RunAsSvcHandler::ExecuteAppWithUserToken
push str._s::_Unable_to_find_the_file___s___Error:__d
call fcn.00677869
add esp, 0x10
jmp 0x666a59
mov ecx, dword [ebp + 8]
cmp dword [ecx - 4], edi
jle 0x666452
push dword [ecx - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov ecx, dword [ebp + 8]
push edi
xor dl, dl
call fcn.0068a223
pop ecx
test al, al
jne 0x6664af
mov esi, dword [ebp + 8]
cmp dword [esi - 4], edi
jle 0x666475
push dword [esi - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.RunAsSvcHandler::ExecuteAppWithUserToken
push str._s::_Signature_validation_failed_for_file___s___Error:__d
call fcn.00677869
mov ecx, dword [ebp + 8]
add esp, 0x10
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ebx, 0x570
jmp 0x666a6f
call fcn.00474f38
push eax
lea ecx, [ebp - 0x24]
call fcn.00451c1b
mov byte [ebp - 4], 4
lea eax, [ebp - 0x24]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.00452465
add esp, 0x10
lea ecx, [ebp - 0x14]
mov edi, 0x750660
push edi
call fcn.004514db
push edi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.004514db
xor eax, eax
mov byte [ebp - 4], 6
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x8c]
pop edi
push edi
push 0
push eax
call fcn.00506c70
and dword [ebp - 0x20], 0
add esp, 0xc
cmp byte [ebp + 0x1c], 0
mov dword [ebp - 0x8c], edi
je 0x66655e
cmp dword [esi + 0x14], 0
je 0x66655e
push 0
push dword [esi + 0x14]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x66655e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, str.RunAsSvcHandler::ExecuteAppWithUserToken
push edi
push str._s::_Unable_to_create_environment_block._Error:__d
call fcn.00677869
add esp, 0xc
and dword [ebp - 0x20], 0
jmp 0x666563
mov edi, str.RunAsSvcHandler::ExecuteAppWithUserToken
xor eax, eax
cmp byte [ebp + 0x24], al
setne al
dec eax
and eax, 0x7fffff0
add eax, 0x430
mov dword [ebp + 0x24], eax
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x6668af
lea eax, [esi + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x6668af
mov ebx, dword [ebp + 0xc]
cmp dword [ebx - 4], 1
jle 0x6665ae
push dword [ebx - 0xc]
lea ecx, [ebp + 0xc]
call fcn.00451ca4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp + 0x1c], eax
cmp dword [eax - 4], 1
jle 0x6665cb
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov eax, dword [ebp + 8]
mov dword [ebp + 0x1c], eax
lea ecx, [esi + 4]
call fcn.0045156f
mov ecx, esi
mov dword [ebp - 0x30], eax
call fcn.0045156f
lea ecx, [ebp - 0x48]
xor esi, esi
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push esi
push dword [ebp - 0x20]
push dword [ebp + 0x24]
push ebx
push dword [ebp + 0x1c]
push 1
push dword [ebp - 0x30]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x1c], eax
test eax, eax
jne 0x66662f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x28]
push ebx
push esi
mov esi, dword [ebp - 0x24]
push esi
push dword [eax]
mov dword [ebp - 0x18], ebx
push edi
push str._s::CreateProcessWithLogonW_Trying_with_raw_username____raw_username:_s___appdetails:_s___RES:_d_Error:_d
call fcn.00677869
add esp, 0x18
jmp 0x66664b
mov eax, dword [ebp - 0x28]
mov ebx, esi
mov esi, dword [ebp - 0x24]
push esi
mov dword [ebp - 0x18], ebx
push dword [eax]
push edi
push str._s::CreateProcessWithLogonW_Trying_with_raw_username____raw_username:_s___appdetails:_s___SUCCEEDED
call fcn.00677869
add esp, 0x10
mov eax, dword [ebp - 0x28]
push ecx
mov dword [ebp - 0x30], esp
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0045207b
pop ecx
mov ecx, dword [ebp - 0x30]
add eax, 0x10
mov dword [ecx], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00666da5
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x14]
call fcn.00451d78
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00451d78
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x14]
push dword [eax]
push edi
push str._s::Rawusername___s____After_Splitting__Username:_s__Domain_name:_s
call fcn.00677869
mov eax, dword [ebp - 0x1c]
add esp, 0x14
cmp dword [eax - 0xc], 0
je 0x6667a3
cmp dword [ebp + 0x1c], 0
jne 0x66689e
cmp ebx, 5
je 0x66689e
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x1c], eax
cmp dword [eax - 4], 1
jle 0x6666e1
push dword [eax - 0xc]
lea ecx, [ebp + 0xc]
call fcn.00451ca4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
cmp dword [eax - 4], 1
jle 0x6666fe
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 4], 1
jle 0x666712
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
call fcn.00451ca4
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
cmp dword [ebx - 4], 1
jle 0x66672f
push dword [ebx - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00451ca4
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
call fcn.0045156f
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push 0
push dword [ebp - 0x20]
push dword [ebp + 0x24]
push dword [ebp + 0x1c]
push dword [ebp - 0x28]
push 1
push eax
push dword [ebp - 0x30]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x1c], eax
test eax, eax
jne 0x666789
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0
push esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x14]
push edi
push str._s::CreateProcessWithLogonW1_Trying_with_domain_name____username:_s__domainname:_s___appdetails:_s___RES:_d_Error:_d
call fcn.00677869
add esp, 0x1c
jmp 0x6667ad
push esi
push dword [ebp - 0x1c]
xor ebx, ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push edi
push str._s::CreateProcessWithLogonW1_Trying_with_domain_name____username:_s__domainname:_s___appdetails:_s___SUCCEEDED
call fcn.00677869
add esp, 0x14
cmp dword [ebp + 0x1c], 0
jne 0x66689e
cmp ebx, 5
je 0x66689e
mov ebx, dword [ebp + 0xc]
cmp dword [ebx - 4], 1
jle 0x6667cd
push dword [ebx - 0xc]
lea ecx, [ebp + 0xc]
call fcn.00451ca4
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x1c], ecx
cmp dword [ecx - 4], 1
jle 0x6667ea
push dword [ecx - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov eax, dword [ebp + 8]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
cmp dword [eax - 4], 1
jle 0x666807
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00451ca4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
call fcn.0045156f
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push 0
push dword [ebp - 0x20]
push dword [ebp + 0x24]
push ebx
push dword [ebp + 0x1c]
push 1
push eax
push 0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x1c], eax
test eax, eax
jne 0x666872
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
cmp dword [eax - 4], 1
jle 0x66685d
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00451ca4
mov eax, dword [ebp - 0x14]
push ebx
push 0
push esi
push eax
push edi
push str._s::CreateProcessWithLogonW2_Trying_without_domain_name____username:_s___appdetails:_s___RES:_d_Error:_d
call fcn.00677869
add esp, 0x18
jmp 0x66689e
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp dword [eax - 4], 1
jle 0x66688e
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00451ca4
mov eax, dword [ebp - 0x14]
push esi
push eax
push edi
push str._s::CreateProcessWithLogonW2_Trying_without_domain_name____username:_s___appdetails:_s___SUCCEEDED
call fcn.00677869
add esp, 0x10
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 6
call fcn.00450c8e
jmp 0x666974
mov esi, dword [ebp + 0xc]
cmp dword [esi - 4], 1
jle 0x6668c6
push dword [esi - 0xc]
lea ecx, [ebp + 0xc]
call fcn.00451ca4
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x6668dd
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00451ca4
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
xor ecx, ecx
push ecx
push ecx
push dword [ebp + 0x24]
push ecx
push ecx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp + 0x1c], eax
test eax, eax
jne 0x666962
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x24]
mov ebx, eax
push ebx
push esi
push edi
push str._s::CreateProcess__s____FAILED___Err:_d
mov dword [ebp - 0x18], ebx
call fcn.00677869
add esp, 0x10
push ebx
push 0
push edi
push str._s::_FAILED_RES:_d_Error:_d
call fcn.00677869
add esp, 0x10
cmp dword [ebp - 0x20], 0
je 0x66693f
push dword [ebp - 0x20]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
lea ecx, [esi - 0x10]
call fcn.0044ec01
jmp 0x666a59
mov esi, dword [ebp - 0x24]
push esi
push edi
push str._s::CreateProcess__s____SUCCEEDED
call fcn.00677869
add esp, 0xc
cmp dword [ebp + 0x1c], 0
je 0x66691f
cmp byte [ebp + 0x14], 0
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ebp - 0x48]
push edi
mov dword [ecx], eax
mov ecx, dword [ebp + 0x28]
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
je 0x666a2c
push str._s::_Process_created_successfully..._Waiting_for_termination
call fcn.00677869
pop ecx
pop ecx
push dword [ebp + 0x18]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x666a24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push edi
push str._s::_Wait_for_process_execution_failed_due_to_error____d__LastError:__d
call fcn.00677869
add esp, 0x10
push edi
push str._s::_Trying_to_terminate_process
call fcn.00677869
cmp byte [ebp + 0x20], 0
pop ecx
pop ecx
je 0x666a05
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x666a05
push edi
push str._s::_Process_terminated_successfully
xor ebx, ebx
mov dword [ebp - 0x18], ebx
call fcn.00677869
pop ecx
pop ecx
jmp 0x666930
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push edi
push str._s::_Unable_to_terminate_process._Errorcode:__d
mov dword [ebp - 0x18], ebx
call fcn.00677869
add esp, 0xc
jmp 0x666930
push edi
push str._s::_Process_execution_completed_successfully
jmp 0x6669f4
push str._s::_Process_created_successfully_in_non_blocking_mode
call fcn.00677869
pop ecx
pop ecx
xor ebx, ebx
jmp 0x666930
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0044ec01
mov eax, ebx
call fcn.0049bdee
ret 0x28