Function at 0x460910
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, eax
push edi
push esi
lea eax, [esp + 0x24]
xor ebp, ebp
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea ebx, [edi + 1]
test eax, eax
jne 0x460946
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x460961
cmp dword [0x6d138c], ebx
jl 0x460961
push str.Environment_created
push str.StartInteractiveClientProcess
push ebx
call fcn.00552bc2
add esp, 0xc
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [esp + 0x20], eax
test eax, eax
je 0x460b70
push 0x60000
push 0
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov dword [esp + 0x18], eax
test eax, eax
je 0x460b33
cmp dword [0x6d138c], ebx
jl 0x4609b0
push str.WindowStation_created
push str.StartInteractiveClientProcess
push ebx
call fcn.00552bc2
mov eax, dword [esp + 0x24]
add esp, 0xc
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x460b33
push 0x60081
push 0
push 0
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov ecx, dword [esp + 0x20]
push ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x460b33
cmp dword [esp + 0x10], edi
je 0x460b33
lea edx, [esp + 0x14]
push edx
mov eax, esi
call fcn.00460800
mov ebp, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x460b33
mov eax, dword [esp + 0x18]
push ebp
push eax
call fcn.00460b80
add esp, 8
test eax, eax
je 0x460b33
mov ecx, dword [esp + 0x10]
push ebp
push ecx
call fcn.00460e80
add esp, 8
test eax, eax
je 0x460b33
push esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x460b33
cmp dword [0x6d138c], ebx
jl 0x460a65
push str.CreateProcessAsUser
push str.StartInteractiveClientProcess
push ebx
call fcn.00552bc2
add esp, 0xc
push 0x44
lea edx, [esp + 0x38]
push 0
push edx
call fcn.005985f0
mov edx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x38]
push ecx
push 0
push edx
push 0x430
push 0
push 0
push 0
push eax
push 0
push esi
mov dword [esp + 0x60], 0x44
mov dword [esp + 0x68], str.winsta0default
mov dword [esp + 0x8c], ebx
mov word [esp + 0x90], bx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test edi, edi
jne 0x460aee
cmp dword [0x6d138c], 3
jl 0x460b0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process_creation_failed____i
push str.StartInteractiveClientProcess
push 3
call fcn.00552bc2
add esp, 0x10
jmp 0x460b0b
cmp dword [0x6d138c], 3
jl 0x460b0b
push str.Process_creation_successfully
push str.StartInteractiveClientProcess
push 3
call fcn.00552bc2
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x460b27
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x460b27
push eax
call esi
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
je 0x460b33
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test ebp, ebp
je 0x460b52
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x460b61
push eax
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x460b70
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret