Function at 0x4eef20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x214], 0
push eax
mov dword [ebp - 0x218], 0
call fcn.00551550
add esp, 0x10
test eax, eax
je 0x4eefa6
test byte [0x9538a8], 4
je 0x4ef252
push eax
push str.Failed_to_get_installation_directory._err___d
push 0x2a6
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_svc_svc_init.c
push str.svci_create_missing_epo_entries
push dword [0x7ac6c0]
push 4
jmp 0x4ef24a
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4ef223
push str.InstaConfig.exe__connect
push eax
push 0x6cb7c0
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.004f3b60
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x4ef00e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
je 0x4ef252
push eax
push str.Failed_to_get_sess_id_for_scsrvc._Missing_reg_entries_wont_be_created._err___d
push 0x2ba
jmp 0x4ef238
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x210]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x4ef03f
test byte [0x9538a8], 4
je 0x4ef072
push dword [ebp - 0x210]
push str.Session_id__d_is_not_interactive.
push 0x2c0
jmp 0x4ef058
test byte [0x9538a8], 4
je 0x4ef072
push dword [ebp - 0x210]
push str.Session_id__d_is_interactive.
push 0x2c4
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_svc_svc_init.c
push str.svci_create_missing_epo_entries
push dword [0x7ac6c0]
push 4
call fcn.004f21c0
add esp, 0x1c
push 1
push dword [ebp - 0x214]
lea eax, [ebp - 0x218]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x4ef0d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
je 0x4ef252
push eax
push dword [ebp - 0x210]
push str.Failed_to_create_environment_block_for_session__d___err__d
push 0x2cb
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_svc_svc_init.c
push str.svci_create_missing_epo_entries
push dword [0x7ac6c0]
push 1
call fcn.004f21c0
add esp, 0x20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x270]
push 0x44
push eax
call fcn.004f3630
mov eax, dword [0x9538a8]
add esp, 8
mov dword [ebp - 0x270], 0x44
mov dword [ebp - 0x268], 0x6cba10
test al, 4
je 0x4ef162
push str.Create_environment_block_succeeded
push 0x2d3
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_svc_svc_init.c
push str.svci_create_missing_epo_entries
push dword [0x7ac6c0]
push 4
call fcn.004f21c0
mov eax, dword [0x9538a8]
add esp, 0x18
test al, 4
je 0x4ef162
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push str.Executing_cmd:__s_in_session__d
push 0x2d6
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_svc_svc_init.c
push str.svci_create_missing_epo_entries
push dword [0x7ac6c0]
push 4
call fcn.004f21c0
add esp, 0x20
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x270]
push eax
push 0
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push 0x420
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x4ef207
test byte [0x9538a8], 0x10
je 0x4ef1c9
push str.CreateProcessAsUser_succeeded
push 0x2e5
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_svc_svc_init.c
push str.svci_create_missing_epo_entries
push dword [0x7ac6c0]
push 0x10
call fcn.004f21c0
add esp, 0x18
push esi
push dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x228]
call esi
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x4ef1f0
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
push dword [ebp - 0x214]
call esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x9538a8], 1
je 0x4ef252
push eax
push str.CreateProcessAsUser_failed__err___d
push 0x2ec
jmp 0x4ef238
test byte [0x9538a8], 1
je 0x4ef252
push 0
push str.Failed_to_get_installdir._Missing_registry_entries_wont_be_created._err___d
push 0x2b2
push str.E:_workspace_AC_CC_Windows_TACC_MASTER_master_src_solidifier_svc_svc_init.c
push str.svci_create_missing_epo_entries
push dword [0x7ac6c0]
push 1
call fcn.004f21c0
add esp, 0x1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret