Function at 0x403120
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414827
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x918
push edi
mov dword [ebp - 0x914], ecx
mov byte [ebp - 0x545], 0x5c
mov byte [ebp - 0x591], 0x20
mov byte [ebp - 0x119], 0x2c
push 0x416349
lea ecx, [ebp - 0x6c4]
call fcn.004020c0
mov dword [ebp - 4], 0
push 0x104
push 0
lea eax, [ebp - 0x83c]
push eax
call fcn.0040cff0
add esp, 0xc
mov ecx, dword [ebp - 0x914]
call fcn.00404df0
test eax, eax
je 0x4031aa
push 0x104
lea ecx, [ebp - 0x83c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4031bc
push 0x104
lea edx, [ebp - 0x83c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x590]
call fcn.004020c0
mov byte [ebp - 4], 1
mov cl, byte [ebp - 0x545]
push ecx
push 1
lea ecx, [ebp - 0x590]
call fcn.00404520
movzx edx, byte [0x416768]
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x144]
add eax, 1
push eax
call fcn.0040b8d1
add esp, 4
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x6a8], ecx
mov edx, dword [ebp - 0x144]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x6a8]
push eax
call fcn.0040cff0
add esp, 0xc
mov ecx, dword [ebp - 0x144]
push ecx
push str.KBXS_b_b
mov edx, dword [ebp - 0x6a8]
push edx
call fcn.0040ccb0
add esp, 0xc
push 0x4166ac
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x6a8]
push ecx
call fcn.00408400
add esp, 0xc
mov edx, dword [ebp - 0x6a8]
push edx
call fcn.0040cc20
add esp, 4
push eax
mov eax, dword [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x6c4]
call fcn.00401fd0
mov ecx, dword [ebp - 0x6a8]
mov dword [ebp - 0x854], ecx
mov edx, dword [ebp - 0x854]
push edx
call fcn.0040ca99
add esp, 4
mov eax, dword [0x4164a0]
push eax
push 0
lea ecx, [ebp - 0x6c4]
push ecx
lea ecx, [ebp - 0x590]
call fcn.004045f0
push 0
mov ecx, dword [ebp - 0x914]
call fcn.004056a0
push 0
push 0
lea ecx, [ebp - 0x574]
call fcn.00401af0
mov edx, dword [0x4164a0]
push edx
push 0
mov eax, dword [ebp - 0x914]
add eax, 0x1c
push eax
lea ecx, [ebp - 0x574]
call fcn.00401ee0
mov byte [ebp - 4], 2
push 0x104
push 0
lea ecx, [ebp - 0x6a4]
push ecx
call fcn.0040cff0
add esp, 0xc
cmp dword [ebp - 0x55c], 0x10
jb 0x403334
mov edx, dword [ebp - 0x570]
mov dword [ebp - 0x918], edx
jmp 0x403340
lea eax, [ebp - 0x570]
mov dword [ebp - 0x918], eax
push 0x104
lea ecx, [ebp - 0x6a4]
push ecx
mov edx, dword [ebp - 0x918]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x730]
call fcn.004020c0
mov byte [ebp - 4], 3
mov cl, byte [ebp - 0x591]
push ecx
lea edx, [ebp - 0x590]
push edx
lea eax, [ebp - 0x140]
push eax
call fcn.004049c0
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, dword [0x4164a0]
push ecx
push 0
lea edx, [ebp - 0x730]
push edx
lea ecx, [ebp - 0x140]
call fcn.004045f0
mov al, byte [ebp - 0x119]
push eax
push 1
lea ecx, [ebp - 0x140]
call fcn.00404520
movzx ecx, byte [0x4164f6]
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x120], 0
mov edx, dword [ebp - 0x118]
add edx, 1
push edx
call fcn.0040b8d1
add esp, 4
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x120]
push edx
call fcn.0040cff0
add esp, 0xc
mov eax, dword [ebp - 0x118]
push eax
push str.xYQXRG
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.0040ccb0
add esp, 0xc
push 0x4166ac
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.00408400
add esp, 0xc
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.0040cc20
add esp, 4
push eax
mov edx, dword [ebp - 0x120]
push edx
lea ecx, [ebp - 0x6c4]
call fcn.00401fd0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x85c], eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.0040ca99
add esp, 4
mov edx, dword [0x4164a0]
push edx
push 0
lea eax, [ebp - 0x6c4]
push eax
lea ecx, [ebp - 0x140]
call fcn.004045f0
mov dword [ebp - 0x714], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x710]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x714], 0x44
mov dword [ebp - 0x6e8], 1
mov word [ebp - 0x6e4], 0xa
mov dword [ebp - 0x70c], str.WinSta0Default
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x124], 0x104
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x6cc], eax
lea eax, [ebp - 0x114]
push eax
call fcn.0040d148
add esp, 4
movzx ecx, byte [0x41658a]
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x598], 0
mov edx, dword [ebp - 0x6c8]
add edx, 1
push edx
call fcn.0040b8d1
add esp, 4
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x598], eax
mov ecx, dword [ebp - 0x6c8]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x598]
push edx
call fcn.0040cff0
add esp, 0xc
mov eax, dword [ebp - 0x6c8]
push eax
push 0x416584
mov ecx, dword [ebp - 0x598]
push ecx
call fcn.0040ccb0
add esp, 0xc
push 0x4166ac
mov edx, dword [ebp - 0x6c8]
push edx
mov eax, dword [ebp - 0x598]
push eax
call fcn.00408400
add esp, 0xc
mov ecx, dword [ebp - 0x598]
push ecx
call fcn.0040cc20
add esp, 4
push eax
mov edx, dword [ebp - 0x598]
push edx
lea ecx, [ebp - 0x6c4]
call fcn.00401fd0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x864], eax
mov ecx, dword [ebp - 0x864]
push ecx
call fcn.0040ca99
add esp, 4
mov dword [ebp - 0x734], 0x400
mov byte [ebp - 0x544], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x543]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 0x128], 0x10
jb 0x403632
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x91c], edx
jmp 0x40363e
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x91c], eax
push 0x200
lea ecx, [ebp - 0x544]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x91c]
push edx
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x6ac], 0x10
jb 0x403674
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x920], eax
jmp 0x403680
lea ecx, [ebp - 0x6c0]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x920]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.0041417e
add esp, 8
test eax, eax
je 0x403759
cmp dword [ebp - 0x6cc], 0
je 0x403759
lea ecx, [ebp - 0x558]
push ecx
lea edx, [ebp - 0x714]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x544]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4036f2
mov ecx, dword [ebp - 0x554]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x558]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401af0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401af0
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401af0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401af0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401af0
jmp 0x40396b
movzx eax, byte [0x4164dc]
mov dword [ebp - 0x84c], eax
mov dword [ebp - 0x844], 0
mov ecx, dword [ebp - 0x84c]
add ecx, 1
push ecx
call fcn.0040b8d1
add esp, 4
mov dword [ebp - 0x868], eax
mov edx, dword [ebp - 0x868]
mov dword [ebp - 0x844], edx
mov eax, dword [ebp - 0x84c]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0x844]
push ecx
call fcn.0040cff0
add esp, 0xc
mov edx, dword [ebp - 0x84c]
push edx
push str.mjhzr_
mov eax, dword [ebp - 0x844]
push eax
call fcn.0040ccb0
add esp, 0xc
push 0x4166ac
mov ecx, dword [ebp - 0x84c]
push ecx
mov edx, dword [ebp - 0x844]
push edx
call fcn.00408400
add esp, 0xc
mov eax, dword [ebp - 0x844]
push eax
call fcn.0040cc20
add esp, 4
push eax
mov ecx, dword [ebp - 0x844]
push ecx
lea ecx, [ebp - 0x6c4]
call fcn.00401fd0
mov edx, dword [ebp - 0x844]
mov dword [ebp - 0x86c], edx
mov eax, dword [ebp - 0x86c]
push eax
call fcn.0040ca99
add esp, 4
cmp dword [ebp - 0x6ac], 0x10
jb 0x403839
mov ecx, dword [ebp - 0x6c0]
mov dword [ebp - 0x924], ecx
jmp 0x403845
lea edx, [ebp - 0x6c0]
mov dword [ebp - 0x924], edx
mov eax, dword [ebp - 0x924]
push eax
lea ecx, [ebp - 0x840]
push ecx
call fcn.00409580
add esp, 8
test eax, eax
jne 0x4038c6
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401af0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401af0
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401af0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401af0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401af0
jmp 0x40396b
lea edx, [ebp - 0x558]
push edx
lea eax, [ebp - 0x714]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x544]
push ecx
push 0
mov edx, dword [ebp - 0x840]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401af0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401af0
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401af0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401af0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret