Function at 0x40911c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff780
push esi
push edi
mov eax, 0x4b8bf8
call fcn.004a40b4
xor edx, edx
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x28]
push eax
push 0x2000000
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
jne 0x409164
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x409360
lea ecx, [ebp - 0x2c]
push ecx
push 1
push 0
push 0
push 0x2000000
push dword [ebp - 0x28]
call sub.ADVAPI32.DLL_DuplicateTokenEx
test eax, eax
jne 0x409198
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x409360
xor ecx, ecx
mov dword [ebp - 0x34], ecx
call sub.KERNEL32.DLL_WTSGetActiveConsoleSessionId
mov dword [ebp - 0x38], eax
push 0x44
push 0
lea eax, [ebp - 0x80]
push eax
call fcn.004a3c28
add esp, 0xc
push 4
lea edx, [ebp - 0x38]
push edx
push 1
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_SetTokenInformation
mov dword [ebp - 0x3c], eax
push 4
lea ecx, [ebp - 0x38]
push ecx
push 0xc
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_SetTokenInformation
test eax, eax
jne 0x4091ef
push str.Driver___RUN_Update:_Not_SYSTEM_trigger___SetTokenInformation__n
push dword [sym.ArmouryUpdate.exe__fmMain]
call fcn.004093ec
add esp, 8
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x78], str.WinSta0Default
mov word [ebp - 0x50], 5
mov dword [ebp - 0x54], 1
push 0
push dword [ebp - 0x2c]
lea eax, [ebp - 0x34]
push eax
call sub.USERENV.DLL_CreateEnvironmentBlock
test eax, eax
jne 0x409250
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x2c]
call sub.KERNEL32.DLL_CloseHandle
push str.Driver___RUN_Update:__CreateEnvironmentBlock_n
push dword [sym.ArmouryUpdate.exe__fmMain]
call fcn.004093ec
add esp, 8
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x409360
mov esi, 0x4b70be
lea edi, [ebp - 0x480]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0xc
push dword [ebp + 8]
push str._s__driverinstall
lea eax, [ebp - 0x480]
push eax
call fcn.004a6fe8
add esp, 0xc
mov esi, 0x4b74be
lea edi, [ebp - 0x880]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0x14], 0x18
lea eax, [ebp - 0x480]
push eax
push str.Driver___RUN_Update:__s__n
push pe_nt_image_headers32
lea edx, [ebp - 0x880]
push edx
call fcn.004a7308
add esp, 0x10
lea ecx, [ebp - 0x880]
push ecx
push dword [sym.ArmouryUpdate.exe__fmMain]
call fcn.004093ec
add esp, 8
push dword [ebp - 0x30]
lea eax, [ebp - 0x80]
push eax
push 0
push dword [ebp - 0x34]
push 0x430
push 0
push 0
push 0
lea edx, [ebp - 0x480]
push edx
push 0
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_CreateProcessAsUserW
test eax, eax
jne 0x409316
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x2c]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x409360
cmp dword [ebp - 0x34], 0
je 0x409324
push dword [ebp - 0x34]
call sub.USERENV.DLL_DestroyEnvironmentBlock
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x2c]
call sub.KERNEL32.DLL_CloseHandle
push str.Driver_trigger_Setup_Finish____n
push dword [sym.ArmouryUpdate.exe__fmMain]
call fcn.004093ec
add esp, 8
push 0x7d0
call sub.KERNEL32.DLL_Sleep
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret