Function at 0x412a9a
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
push ebx
push esi
push edi
lea edi, [ebp - 0x5b4]
mov ecx, 0x16d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.00412314
pop ecx
pop ecx
test eax, eax
jne 0x412b04
mov eax, dword [ebp - 0xc]
jmp 0x412dbb
and dword [ebp - 0x228], 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00412025
pop ecx
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jne 0x412b2f
mov eax, dword [ebp - 0xc]
jmp 0x412dbb
xor eax, eax
mov word [ebp - 0x438], ax
push 0x206
push 0
lea eax, [ebp - 0x436]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov esi, esp
push dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00414070
and dword [ebp - 0x444], 0
and dword [ebp - 0x490], 0
push 0x40
push 0
lea eax, [ebp - 0x48c]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
and dword [ebp - 0x4a8], 0
xor eax, eax
lea edi, [ebp - 0x4a4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x4b4], 0
mov esi, esp
push dword [ebp - 0x228]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.00414070
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0
je 0x412d22
mov dword [ebp - 0x4cc], 0xb
mov esi, esp
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x4cc]
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp esi, esp
call fcn.00414070
test eax, eax
je 0x412d22
mov dword [ebp - 0x4d8], 0x18b
mov esi, esp
lea eax, [ebp - 0x4b4]
push eax
push 1
push 2
push 0
push dword [ebp - 0x4d8]
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp esi, esp
call fcn.00414070
test eax, eax
je 0x412d22
mov dword [ebp - 0x490], 0x44
and dword [ebp - 0x4e4], 0
mov esi, esp
lea eax, [ebp - 0x4e4]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, esp
call fcn.00414070
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp esi, esp
call fcn.00414070
test eax, eax
jne 0x412c88
and dword [ebp - 0x4e4], 0
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4e4], 0
je 0x412cd4
mov esi, esp
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x490]
push eax
push 0
push 0
push 0x10
lea eax, [ebp - 0x438]
push eax
push 0
push 0
push dword [ebp - 0x4b4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
cmp esi, esp
call fcn.00414070
mov dword [ebp - 0x4f0], eax
jmp 0x412d12
mov esi, esp
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x490]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x438]
push eax
push 0
push dword [ebp - 0x4b4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp esi, esp
call fcn.00414070
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0
je 0x412d22
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0x444], 0
je 0x412d40
mov esi, esp
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00414070
cmp dword [ebp - 0x4c0], 0
je 0x412d5e
mov esi, esp
push dword [ebp - 0x4c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00414070
cmp dword [ebp - 0x4a8], 0
je 0x412d7c
mov esi, esp
push dword [ebp - 0x4a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00414070
cmp dword [ebp - 0x4a4], 0
je 0x412d9a
mov esi, esp
push dword [ebp - 0x4a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00414070
cmp dword [ebp - 0x4b4], 0
je 0x412db8
mov esi, esp
push dword [ebp - 0x4b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00414070
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x412dea]
call fcn.00414018
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414093
add esp, 0x5b4
cmp ebp, esp
call fcn.00414070
mov esp, ebp
pop ebp
ret