Function at 0x503fc2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
lea edi, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov esi, str.S_1_16_8192
mov dword [ebp - 0x30], eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], eax
lea edi, [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x28], ebx
stosd dword es:[edi], eax
push 0x44
push ebx
mov dword [ebp - 0x2c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x90]
push eax
call fcn.00719250
add esp, 0xc
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x50404f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_LoadLibrary_Advapi32.dll_failed__Error___d
call fcn.0050496b
mov esi, dword [ebp - 0x20]
pop ecx
pop ecx
jmp 0x5041a5
push str.ConvertStringSidToSidW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x50406f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_GetProcAddress_Failed__Error___d
jmp 0x504040
lea eax, [ebp - 0x2c]
push eax
push 0x2000000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x504097
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_OpenProcessToken_Failed__Error___d
jmp 0x504040
lea eax, [ebp - 0x24]
push eax
push 1
push 2
push ebx
push 0x2000000
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x5040c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_DuplicateTokenEx_Failed__Error___d
jmp 0x504040
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [0x7f07dc]
call esi
test eax, eax
jne 0x5040ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_ConvertStringSidToSid_Failed__Error___d
call fcn.00504985
jmp 0x504045
mov eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x34], 0x60
mov dword [ebp - 0x38], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x38]
push eax
push 0x19
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x504128
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_SetTokenInformation_Failed__Error___d
jmp 0x504040
call fcn.0050360e
mov esi, dword [ebp - 0x3c]
test eax, eax
lea eax, [ebp - 0x4c]
mov edx, 0x1000000
push eax
lea eax, [ebp - 0x90]
mov ecx, ebx
push eax
push ebx
push ebx
cmovne ecx, edx
push ecx
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x50419a
call fcn.0050360e
test eax, eax
je 0x504189
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x50419a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GPC_CreateMediumProcess:_CreateProcessAsUser_Failed__Error___d
jmp 0x504040
mov esi, dword [ebp - 0x20]
xor ebx, ebx
mov eax, dword [ebp - 0x44]
inc ebx
mov dword [esi], eax
cmp dword [ebp - 0x28], 0
je 0x5041b4
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x2c], 0
je 0x5041c3
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x5041d2
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x5041dd
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x4c], 0xffffffff
je 0x5041ec
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x48], 0xffffffff
je 0x5041fb
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi]
push ebx
push str.GPC_CreateMediumProcess:_CreateProcessAsUser_result_d__pid_d
call fcn.00504985
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00700c25
leave
ret