Function at 0x40bcab
Capabilities:
Create process on windows
Create process suspended
Enumerate processes on remote desktop session host
Print debug messages

Disassembly:
push 0x84
mov eax, 0x54f01a
call fcn.00534dad
lea eax, [ebp - 0x18]
push eax
call fcn.0040bf61
test al, al
je 0x40bf59
mov ebx, dword [ebp + 8]
mov ecx, ebx
call fcn.0040af30
test eax, eax
je 0x40bd1c
push str.CreateProcessAsUser_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebx + 4]
add ecx, 4
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 0x18]
push eax
lea eax, [ebp - 0x28]
push str.LaunchAppInActiveConsoleSessionElevated__:_signature_verification_failed_for_file__s
push eax
call fcn.00411470
add esp, 0xc
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], vtable.MA::StringT_wchar_t__char_.0
call fcn.00402ee1
jmp 0x40bf59
push str.localhost
call dword [sym.imp.WTSAPI32.dll_WTSOpenServerW]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesW]
test eax, eax
je 0x40bf4e
mov eax, dword [ebp - 0x14]
xor esi, esi
test eax, eax
je 0x40bf3a
mov edx, dword [ebp - 0x18]
xor edi, edi
mov ecx, dword [ebp - 0x10]
cmp dword [edi + ecx], edx
jne 0x40bde8
push dword [edi + ecx + 8]
lea ecx, [ebp - 0x30]
call fcn.0040301a
and dword [ebp - 4], 0
push str.winlogon.exe
lea ecx, [ebp - 0x20]
call fcn.0040301a
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004082df
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004090f5
mov ebx, eax
neg ebx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
sbb bl, bl
mov dword [ebp - 0x38], vtable.MA::StringT_wchar_t__char_.0
call fcn.00402ee1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], vtable.MA::StringT_wchar_t__char_.0
call fcn.00402ee1
inc bl
jne 0x40bdf9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.MA::StringT_wchar_t__char_.0
call fcn.00402ee1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
inc esi
add edi, 0x10
cmp esi, eax
jb 0x40bd57
jmp 0x40bf3a
mov eax, dword [ebp - 0x10]
add esi, esi
push dword [eax + esi*8 + 4]
mov esi, 0x2000000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x40bf1c
lea eax, [ebp - 0x1c]
push eax
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40bf0c
lea eax, [ebp - 0x18]
push eax
push 1
push 1
push 0
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x40befa
push 0x44
pop esi
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call dword [sym.imp.MSVCR110.dll_memset]
add esp, 0xc
lea ecx, [ebp - 0x38]
push dword [ebp + 0xc]
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x88], str.winsta0default
call fcn.00401704
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 3
mov ecx, dword [ecx + 4]
add ecx, 4
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 0x18]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x90]
push eax
xor eax, eax
push eax
push eax
push 0x30
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x38]
call fcn.004013c3
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40bed5
push dword [ebp - 0x48]
call edi
push dword [ebp - 0x44]
call edi
jmp 0x40bee0
push str.CreateProcessAsUser_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x18]
call edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], vtable.MA::StringT_wchar_t__char_.0
call fcn.00402ee1
jmp 0x40bf05
push str.DuplicateTokenEx___failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x1c]
call edi
jmp 0x40bf17
push str.OpenProcessToken___failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
call edi
jmp 0x40bf27
push str.OpenProcess___failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], vtable.MA::StringT_wchar_t__char_.0
call fcn.00402ee1
push dword [ebp - 0x10]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
push dword [ebp - 0x24]
call dword [sym.imp.WTSAPI32.dll_WTSCloseServer]
jmp 0x40bf59
push str.WTSEnumerateProcesses___failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00534d7b
ret 8