Function at 0x405796
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1304
call fcn.0041faf0
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x12a0], ecx
call fcn.00405a9a
test al, al
je 0x4057f6
call fcn.00405101
mov esi, eax
mov dword [ebp - 0x12a4], esi
test esi, esi
je 0x4057f6
lea eax, [ebp - 0x1298]
xor ebx, ebx
push eax
push 0xf01ff
push esi
mov dword [ebp - 0x1298], ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x405807
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f870
leave
ret
lea eax, [ebp - 0x1294]
mov dword [ebp - 0x1294], ebx
push eax
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 0x1298]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x405841
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1298]
call esi
jmp 0x4057f6
push dword [ebp - 0x1294]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x40586a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1298]
call esi
push dword [ebp - 0x1294]
jmp 0x40583d
push 0x44
pop esi
push esi
lea eax, [ebp - 0x1300]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x1300], esi
lea edi, [ebp - 0x12b4]
mov dword [ebp - 0x12f8], str.WinSta0Default
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x12d4], 1
mov dword [ebp - 0x129c], ebx
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push ebx
push dword [ebp - 0x1294]
mov word [ebp - 0x12d0], ax
lea eax, [ebp - 0x129c]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea eax, [ebp - 0x290]
push eax
push ebx
push ebx
push 0x29
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ecx
mov edx, str.inetcpl.cpl
lea ecx, [ebp - 0x1290]
call fcn.00405b31
mov eax, dword [ebp - 0x12a0]
pop ecx
test eax, eax
je 0x405925
push eax
push str.___d
lea eax, [ebp - 0x88]
push 0x40
push eax
call fcn.00404f8a
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x1290]
push 0x800
push eax
call fcn.004185d0
add esp, 0x1c
lea eax, [ebp - 0x12b4]
push eax
lea eax, [ebp - 0x1300]
push eax
lea eax, [ebp - 0x290]
push eax
push dword [ebp - 0x129c]
lea eax, [ebp - 0x1290]
push 0x4000410
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x1294]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40598d
lea eax, [ebp - 0x12b4]
push eax
lea eax, [ebp - 0x1300]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1290]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40599f
push dword [ebp - 0x12b4]
call esi
push dword [ebp - 0x12b0]
call esi
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x129c], 0
je 0x4059ba
push dword [ebp - 0x129c]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 0x1298]
call esi
push dword [ebp - 0x1294]
call esi
push dword [ebp - 0x12a4]
call esi
mov al, bl
jmp 0x4057f8