Function at 0x40b020
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
sub esp, 0x470
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], bl
mov byte [esp + 0x288], bl
rep stosd dword es:[edi], eax
mov ecx, 0x7d
lea edi, [esp + 0x289]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x185]
mov byte [esp + 0x184], bl
mov ebp, dword [esp + 0x484]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebp
lea eax, [esp + 0x34]
push str.SessionId_:___d_
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ebx
call fcn.00433d38
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040b010
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add esp, 0x10
mov esi, 0x45f8e8
cmp dword [esi + 0x10], ebp
jne 0x40b0c6
mov eax, dword [esi]
lea edx, [esp + 0x28]
push edx
push eax
call edi
cmp dword [esp + 0x28], 0x103
je 0x40b10a
add esi, 0x14
cmp esi, 0x45fa78
jl 0x40b0ad
lea ecx, [esp + 0x14]
push ecx
push ebp
call sub.WTSAPI32.dll_WTSQueryUserToken
mov edi, eax
cmp edi, ebx
jne 0x40b127
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x34]
push str._____Failed_to_QueryUserToken_______error_code___d
push edx
call fcn.00433d38
lea eax, [esp + 0x3c]
push eax
call fcn.0040b010
add esp, 0x10
jmp 0x40b531
push str._____STILL_ACTIVE______
call fcn.0040b010
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x470
ret
xor edi, edi
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov esi, eax
cmp esi, ebx
jne 0x40b15d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x34]
push str._____Failed_to_GetProcessWindowStation_______error_code___d
push ecx
call fcn.00433d38
lea edx, [esp + 0x3c]
push edx
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
push 0x60000
push ebx
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationA]
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x40b19e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x34]
push str._____Failed_to_OpenWindowStation_______error_code___d
push eax
call fcn.00433d38
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
jne 0x40b1d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x34]
push str._____Failed_to_SetProcessWindowStation_______error_code___d
push edx
call fcn.00433d38
lea eax, [esp + 0x3c]
push eax
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
push 0x60081
push ebx
push ebx
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopA]
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
jne 0x40b21a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x34]
push str._____Failed_to_SetProcessWindowStation_______error_code___d
push ecx
call fcn.00433d38
lea edx, [esp + 0x3c]
push edx
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
cmp dword [esp + 0x18], ebx
jne 0x40b248
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x34]
push str._____Failed_to_OpenDesktop_______error_code___d
push eax
call fcn.00433d38
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.0040a970
add esp, 8
test eax, eax
jne 0x40b286
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x34]
push str._____Failed_to_GetLogonSID_______error_code___d
push ecx
call fcn.00433d38
lea edx, [esp + 0x3c]
push edx
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call fcn.0040aaa0
add esp, 8
test eax, eax
jne 0x40b2c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x34]
push str._____Failed_to_AddAceToWindowStation_______error_code___d
push edx
call fcn.00433d38
lea eax, [esp + 0x3c]
push eax
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.0040ada0
add esp, 8
test eax, eax
jne 0x40b302
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x34]
push str._____Failed_to_AddAceToDesktop_______error_code___d
push eax
call fcn.00433d38
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x40b339
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x34]
push str._____Failed_to_ImpersonateLoggedOnUser_______error_code___d
push eax
call fcn.00433d38
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push 1
push 2
push ebx
push 0x2000f
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40b385
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x34]
push str._____Failed_to_DuplicateTokenEx_______error_code___d
push ecx
call fcn.00433d38
lea edx, [esp + 0x3c]
push edx
call fcn.0040b010
add esp, 0x10
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x40b526
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xac]
push str.jjmrun.exe
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28c]
mov dword [esp + 0xb0], 0x44
push eax
mov dword [esp + 0xbc], str.winsta0default
mov word [esp + 0xe4], bx
mov dword [esp + 0xe0], 1
call fcn.00433d38
mov ecx, dword [esp + 0x2c]
add esp, 8
lea edx, [esp + 0x20]
push ebx
push ecx
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov edi, eax
cmp edi, ebx
jne 0x40b418
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x34]
push str._____Failed_to_CreateEnvironmentBlock_______error_code___d
push eax
call fcn.00433d38
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040b010
add esp, 0x10
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x40b526
lea edx, [esp + 0x184]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0xf0]
mov dword [esp + 0xf0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40b4ea
cmp dword [esp + 0x100], 2
jne 0x40b4ea
cmp dword [esp + 0xf4], 6
jne 0x40b4ea
mov eax, dword [esp + 0xf8]
cmp eax, 1
je 0x40b478
cmp eax, ebx
jne 0x40b4ea
lea ecx, [ebp + ebp*4]
lea eax, [esp + 0xac]
lea edx, [ecx*4 + 0x45f8e8]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push eax
push ebx
push ecx
push 0x430
push ebx
push ebx
push ebx
push ebx
push str.C:Program_Files_
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov edi, eax
lea eax, [esp + 0x2c]
push ebx
push eax
push ebx
push ebx
push str.advvvv
call fcn.00434ce4
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push 0x4552e8
push str.advvvv
call fcn.00434ce4
add esp, 4
lea edx, [eax + eax + 2]
push edx
push 0x4552e8
push ebp
push ebx
call sub.WTSAPI32.dll_WTSSendMessageA
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp edi, ebx
jne 0x40b519
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x34]
push str._____Failed_to_CreateProcessAsUser_______error_code___d
push eax
call fcn.00433d38
lea ecx, [esp + 0x3c]
push ecx
call fcn.0040b010
add esp, 0x10
jmp 0x40b526
push str._CreateProcessAsUser_seccess__
call fcn.0040b010
add esp, 4
cmp esi, ebx
je 0x40b531
push esi
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
cmp dword [esp + 0x10], ebx
je 0x40b544
lea edx, [esp + 0x10]
push edx
call fcn.0040aa80
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40b553
push eax
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40b562
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x40b571
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x40b583
push eax
call esi
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
je 0x40b58f
push eax
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x470
ret