Function at 0x10003b70
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x10061070]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100031e0
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
jne 0x10003bc5
push 0x100076b0
mov eax, dword [ebp - 0x80c]
push eax
push str.Failed_to_CreateProcessAsActiveSession__invalid_session_id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
jmp 0x10003fcf
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x800
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.1002ef20
add esp, 0xc
push 0x100596a0
lea eax, [ebp - 0x808]
push eax
call fcn.100077a0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x808]
push edx
call fcn.100077c0
add esp, 8
push 0x100596a4
lea eax, [ebp - 0x808]
push eax
call fcn.100077c0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x10003c9b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x814], ecx
mov edx, dword [ebp - 0x814]
add edx, 2
mov dword [ebp - 0x820], edx
mov eax, dword [ebp - 0x814]
mov cx, word [eax]
mov word [ebp - 0x81a], cx
add dword [ebp - 0x814], 2
cmp word [ebp - 0x81a], 0
jne 0x10003c3d
mov edx, dword [ebp - 0x814]
sub edx, dword [ebp - 0x820]
sar edx, 1
mov dword [ebp - 0x824], edx
je 0x10003c9b
push 0x100596a8
lea eax, [ebp - 0x808]
push eax
call fcn.100077c0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x808]
push edx
call fcn.100077c0
add esp, 8
mov eax, dword [ebp - 0x80c]
push eax
call fcn.10003700
add esp, 4
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
jne 0x10003d01
push 0x100076b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100596ac
mov ecx, dword [ebp - 0x80c]
push ecx
push str.Failed_to_CreateProcessAsActiveSession__cannot_get_token_session_id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
jmp 0x10003fcf
mov dword [ebp - 0x828], 1
push 4
lea edx, [ebp - 0x828]
push edx
push 0x1a
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x10003d6a
push 0x100076b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005974c
mov ecx, dword [ebp - 0x80c]
push ecx
push str.Failed_to_CreateProcessAsActiveSession__cannot_set_UI_access__session_id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
mov dword [ebp - 0x818], 0
push 1
mov edx, dword [ebp - 0x810]
push edx
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x10003dd6
push 0x100076b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10059788
mov ecx, dword [ebp - 0x80c]
push ecx
push str.Failed_to_CreateEnvironmentBlock__Session_id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
jmp 0x10003fcf
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10003e49
push 0x100076b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100597c8
mov eax, dword [ebp - 0x80c]
push eax
push str.Failed_to_ImpersonateLoggedOnUser__Session_id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
mov ecx, dword [ebp - 0x818]
push ecx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003fcf
push 0x44
push 0
lea eax, [ebp - 0x880]
push eax
call fcn.1002ef20
add esp, 0xc
mov dword [ebp - 0x880], 0x44
mov dword [ebp - 0x878], str.winsta0default
xor ecx, ecx
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], 0x1000400
lea edx, [ebp - 0x83c]
push edx
lea eax, [ebp - 0x880]
push eax
push 0
mov ecx, dword [ebp - 0x818]
push ecx
mov edx, dword [ebp - 0x82c]
push edx
push 0
push 0
push 0
mov eax, 2
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x808]
push edx
push 0
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10003f43
push 0x100076b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10059824
mov ecx, dword [ebp - 0x80c]
push ecx
push str.Failed_to_CreateProcessAsUserW__Session_id_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
mov edx, dword [ebp - 0x818]
push edx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x10003fcf
mov ecx, dword [ebp - 0x838]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x83c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x818]
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push 0x100076b0
mov edx, dword [ebp - 0x80c]
push edx
push str.__sid_:
mov eax, dword [ebp - 0x834]
push eax
push str.Create_child_process__as_user___pid_:
mov ecx, 0x10062fb8
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.100076e0
mov ecx, eax
call fcn.10007740
mov ecx, eax
call fcn.10003130
mov eax, 1
jmp 0x10003fd1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002bcee
mov esp, ebp
pop ebp
ret 8