Function at 0x40f740
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x461008]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov esi, ecx
mov byte [esp + 0xf], 0
mov dword [esp + 0x1c], 0
test edi, edi
jne 0x40f78b
lea ecx, [esp + 0x1c]
call fcn.00415260
test al, al
je 0x40f7aa
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.00404bd0
test al, al
jne 0x40f7cb
push edi
push str.Failed_to_trust___ws__r_n
call fcn.00416f00
add esp, 8
jmp 0x40f805
push str.No_HitmanPro_installed_r_n
call fcn.00416f00
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
push eax
mov bl, byte [eax + 8]
call fcn.004323fa
add esp, 4
test bl, bl
jne 0x40f801
push edi
push str.__ws__is_not_signed__r_n
call fcn.00416f00
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x14]
mov ecx, esi
call fcn.0040f9d0
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40f838
push esi
push str.Service::GetSessionToken___returned_no_token_for_session__d_r_n
call fcn.00416f00
mov al, byte [esp + 0x17]
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0043183b
mov esp, ebp
pop ebp
ret
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.0043cf50
mov esi, edi
mov dword [esp + 0x3c], 0x44
add esp, 0xc
mov dword [esp + 0x38], str.winsta0Default
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea ecx, [esi + 2]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40f870
sub esi, ecx
sar esi, 1
add esi, 2
test ebx, ebx
je 0x40f8a2
mov ecx, ebx
lea edx, [ecx + 2]
jmp 0x40f890
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f890
sub ecx, edx
inc esi
sar ecx, 1
add esi, ecx
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00432432
push 0x455f5c
mov ebx, eax
push esi
push ebx
call fcn.0043256a
push edi
push esi
push ebx
call fcn.004325c6
push 0x455f5c
push esi
push ebx
call fcn.004325c6
add esp, 0x28
cmp dword [esp + 0x14], 0
je 0x40f901
push 0x455fd4
push esi
push ebx
call fcn.004325c6
push dword [esp + 0x20]
push esi
push ebx
call fcn.004325c6
add esp, 0x18
xor esi, esi
mov dword [esp + 0x1c], 0
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x40f924
mov esi, 0x400
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x28]
push esi
push 0
push 0
push 0
push ebx
mov ebx, dword [esp + 0x34]
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40f96e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcessAsUser
push 0x4566ac
call fcn.00416f00
add esp, 0xc
jmp 0x40f99b
push dword [esp + 0x28]
push edi
push str.__ws__started_with_PID__u_r_n
call fcn.00416f00
add esp, 0xc
push dword [esp + 0x24]
call esi
push dword [esp + 0x20]
call esi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov byte [esp + 0xf], 1
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x40f9aa
push ecx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push ebx
call esi
mov ecx, dword [esp + 0x7c]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043183b
mov esp, ebp
pop ebp
ret