Function at 0x4031c0
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414a77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x918
push edi
mov dword [ebp - 0x914], ecx
mov byte [ebp - 0x545], 0x5c
mov byte [ebp - 0x591], 0x20
mov byte [ebp - 0x119], 0x2c
push 0x416361
lea ecx, [ebp - 0x6c4]
call fcn.00402160
mov dword [ebp - 4], 0
push 0x104
push 0
lea eax, [ebp - 0x83c]
push eax
call fcn.0040d240
add esp, 0xc
mov ecx, dword [ebp - 0x914]
call fcn.00405040
test eax, eax
je 0x40324a
push 0x104
lea ecx, [ebp - 0x83c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40325c
push 0x104
lea edx, [ebp - 0x83c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x590]
call fcn.00402160
mov byte [ebp - 4], 1
mov cl, byte [ebp - 0x545]
push ecx
push 1
lea ecx, [ebp - 0x590]
call fcn.00404650
movzx edx, byte [0x416780]
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x144]
add eax, 1
push eax
call fcn.0040bb21
add esp, 4
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x6a8], ecx
mov edx, dword [ebp - 0x144]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x6a8]
push eax
call fcn.0040d240
add esp, 0xc
mov ecx, dword [ebp - 0x144]
push ecx
push str.KBXS_b_b
mov edx, dword [ebp - 0x6a8]
push edx
call fcn.0040cf00
add esp, 0xc
push 0x4166c4
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x6a8]
push ecx
call fcn.00408650
add esp, 0xc
mov edx, dword [ebp - 0x6a8]
push edx
call fcn.0040ce70
add esp, 4
push eax
mov eax, dword [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x6c4]
call fcn.00402070
mov ecx, dword [ebp - 0x6a8]
mov dword [ebp - 0x854], ecx
mov edx, dword [ebp - 0x854]
push edx
call fcn.0040cce9
add esp, 4
mov eax, dword [0x4164b8]
push eax
push 0
lea ecx, [ebp - 0x6c4]
push ecx
lea ecx, [ebp - 0x590]
call fcn.00404720
push 0
mov ecx, dword [ebp - 0x914]
call fcn.004058f0
push 0
push 0
lea ecx, [ebp - 0x574]
call fcn.00401b90
mov edx, dword [0x4164b8]
push edx
push 0
mov eax, dword [ebp - 0x914]
add eax, 0x1c
push eax
lea ecx, [ebp - 0x574]
call fcn.00401f80
mov byte [ebp - 4], 2
push 0x104
push 0
lea ecx, [ebp - 0x6a4]
push ecx
call fcn.0040d240
add esp, 0xc
cmp dword [ebp - 0x55c], 0x10
jb 0x4033d4
mov edx, dword [ebp - 0x570]
mov dword [ebp - 0x918], edx
jmp 0x4033e0
lea eax, [ebp - 0x570]
mov dword [ebp - 0x918], eax
push 0x104
lea ecx, [ebp - 0x6a4]
push ecx
mov edx, dword [ebp - 0x918]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x730]
call fcn.00402160
mov byte [ebp - 4], 3
mov cl, byte [ebp - 0x591]
push ecx
lea edx, [ebp - 0x590]
push edx
lea eax, [ebp - 0x140]
push eax
call fcn.00404c10
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, dword [0x4164b8]
push ecx
push 0
lea edx, [ebp - 0x730]
push edx
lea ecx, [ebp - 0x140]
call fcn.00404720
mov al, byte [ebp - 0x119]
push eax
push 1
lea ecx, [ebp - 0x140]
call fcn.00404650
movzx ecx, byte [0x41650e]
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x120], 0
mov edx, dword [ebp - 0x118]
add edx, 1
push edx
call fcn.0040bb21
add esp, 4
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x120]
push edx
call fcn.0040d240
add esp, 0xc
mov eax, dword [ebp - 0x118]
push eax
push str.xYQXRG
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.0040cf00
add esp, 0xc
push 0x4166c4
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.00408650
add esp, 0xc
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.0040ce70
add esp, 4
push eax
mov edx, dword [ebp - 0x120]
push edx
lea ecx, [ebp - 0x6c4]
call fcn.00402070
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x85c], eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.0040cce9
add esp, 4
mov edx, dword [0x4164b8]
push edx
push 0
lea eax, [ebp - 0x6c4]
push eax
lea ecx, [ebp - 0x140]
call fcn.00404720
mov dword [ebp - 0x714], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x710]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x714], 0x44
mov dword [ebp - 0x6e8], 1
mov word [ebp - 0x6e4], 0xa
mov dword [ebp - 0x70c], str.WinSta0Default
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x124], 0x104
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x6cc], eax
lea eax, [ebp - 0x114]
push eax
call fcn.0040d398
add esp, 4
movzx ecx, byte [0x4165a2]
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x598], 0
mov edx, dword [ebp - 0x6c8]
add edx, 1
push edx
call fcn.0040bb21
add esp, 4
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x598], eax
mov ecx, dword [ebp - 0x6c8]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x598]
push edx
call fcn.0040d240
add esp, 0xc
mov eax, dword [ebp - 0x6c8]
push eax
push 0x41659c
mov ecx, dword [ebp - 0x598]
push ecx
call fcn.0040cf00
add esp, 0xc
push 0x4166c4
mov edx, dword [ebp - 0x6c8]
push edx
mov eax, dword [ebp - 0x598]
push eax
call fcn.00408650
add esp, 0xc
mov ecx, dword [ebp - 0x598]
push ecx
call fcn.0040ce70
add esp, 4
push eax
mov edx, dword [ebp - 0x598]
push edx
lea ecx, [ebp - 0x6c4]
call fcn.00402070
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x864], eax
mov ecx, dword [ebp - 0x864]
push ecx
call fcn.0040cce9
add esp, 4
mov dword [ebp - 0x734], 0x400
mov byte [ebp - 0x544], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x543]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 0x128], 0x10
jb 0x4036d2
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x91c], edx
jmp 0x4036de
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x91c], eax
push 0x200
lea ecx, [ebp - 0x544]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x91c]
push edx
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x6ac], 0x10
jb 0x403714
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x920], eax
jmp 0x403720
lea ecx, [ebp - 0x6c0]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x920]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.004143ce
add esp, 8
test eax, eax
je 0x4037f9
cmp dword [ebp - 0x6cc], 0
je 0x4037f9
lea ecx, [ebp - 0x558]
push ecx
lea edx, [ebp - 0x714]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x544]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403792
mov ecx, dword [ebp - 0x554]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x558]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401b90
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401b90
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401b90
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401b90
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401b90
jmp 0x403a0b
movzx eax, byte [0x4164f4]
mov dword [ebp - 0x84c], eax
mov dword [ebp - 0x844], 0
mov ecx, dword [ebp - 0x84c]
add ecx, 1
push ecx
call fcn.0040bb21
add esp, 4
mov dword [ebp - 0x868], eax
mov edx, dword [ebp - 0x868]
mov dword [ebp - 0x844], edx
mov eax, dword [ebp - 0x84c]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0x844]
push ecx
call fcn.0040d240
add esp, 0xc
mov edx, dword [ebp - 0x84c]
push edx
push str.mjhzr_
mov eax, dword [ebp - 0x844]
push eax
call fcn.0040cf00
add esp, 0xc
push 0x4166c4
mov ecx, dword [ebp - 0x84c]
push ecx
mov edx, dword [ebp - 0x844]
push edx
call fcn.00408650
add esp, 0xc
mov eax, dword [ebp - 0x844]
push eax
call fcn.0040ce70
add esp, 4
push eax
mov ecx, dword [ebp - 0x844]
push ecx
lea ecx, [ebp - 0x6c4]
call fcn.00402070
mov edx, dword [ebp - 0x844]
mov dword [ebp - 0x86c], edx
mov eax, dword [ebp - 0x86c]
push eax
call fcn.0040cce9
add esp, 4
cmp dword [ebp - 0x6ac], 0x10
jb 0x4038d9
mov ecx, dword [ebp - 0x6c0]
mov dword [ebp - 0x924], ecx
jmp 0x4038e5
lea edx, [ebp - 0x6c0]
mov dword [ebp - 0x924], edx
mov eax, dword [ebp - 0x924]
push eax
lea ecx, [ebp - 0x840]
push ecx
call fcn.004097d0
add esp, 8
test eax, eax
jne 0x403966
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401b90
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401b90
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401b90
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401b90
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401b90
jmp 0x403a0b
lea edx, [ebp - 0x558]
push edx
lea eax, [ebp - 0x714]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x544]
push ecx
push 0
mov edx, dword [ebp - 0x840]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401b90
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401b90
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401b90
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401b90
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401b90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret