Function at 0x44c1e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, eax
push edi
push esi
lea eax, [esp + 0x24]
xor ebp, ebp
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea ebx, [edi + 1]
test eax, eax
jne 0x44c216
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44c231
cmp dword [0x65236c], ebx
jl 0x44c231
push str.Environment_created
push str.StartInteractiveClientProcess
push ebx
call fcn.004fa3c2
add esp, 0xc
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [esp + 0x20], eax
test eax, eax
je 0x44c440
push 0x60000
push 0
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov dword [esp + 0x18], eax
test eax, eax
je 0x44c403
cmp dword [0x65236c], ebx
jl 0x44c280
push str.WindowStation_created
push str.StartInteractiveClientProcess
push ebx
call fcn.004fa3c2
mov eax, dword [esp + 0x24]
add esp, 0xc
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x44c403
push 0x60081
push 0
push 0
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov ecx, dword [esp + 0x20]
push ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x44c403
cmp dword [esp + 0x10], edi
je 0x44c403
lea edx, [esp + 0x14]
push edx
mov eax, esi
call fcn.0044c0d0
mov ebp, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x44c403
mov eax, dword [esp + 0x18]
push ebp
push eax
call fcn.0044c450
add esp, 8
test eax, eax
je 0x44c403
mov ecx, dword [esp + 0x10]
push ebp
push ecx
call fcn.0044c750
add esp, 8
test eax, eax
je 0x44c403
push esi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x44c403
cmp dword [0x65236c], ebx
jl 0x44c335
push str.CreateProcessAsUser
push str.StartInteractiveClientProcess
push ebx
call fcn.004fa3c2
add esp, 0xc
push 0x44
lea edx, [esp + 0x38]
push 0
push edx
call fcn.00501e30
mov edx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x38]
push ecx
push 0
push edx
push 0x430
push 0
push 0
push 0
push eax
push 0
push esi
mov dword [esp + 0x60], 0x44
mov dword [esp + 0x68], str.winsta0default
mov dword [esp + 0x8c], ebx
mov word [esp + 0x90], bx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
test edi, edi
jne 0x44c3be
cmp dword [0x65236c], 3
jl 0x44c3db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process_creation_failed____i
push str.StartInteractiveClientProcess
push 3
call fcn.004fa3c2
add esp, 0x10
jmp 0x44c3db
cmp dword [0x65236c], 3
jl 0x44c3db
push str.Process_creation_successfully
push str.StartInteractiveClientProcess
push 3
call fcn.004fa3c2
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x44c3f7
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x44c3f7
push eax
call esi
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
je 0x44c403
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test ebp, ebp
je 0x44c422
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44c431
push eax
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44c440
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret