Function at 0x40ceb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f0
push ebx
push esi
push edi
call fcn.00450041
test eax, eax
jne 0x40cedc
push str.Cannot_create_event_for_admin_instance
push 0x10
push dword [ebp + 8]
call fcn.0040ce92
add esp, 0xc
jmp 0x40d12d
lea eax, [ebp - 0x10]
push eax
call fcn.0041126c
push 1
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push eax
call fcn.00411030
lea eax, [ebp - 0x1c]
push eax
call fcn.0045d0a4
add esp, 0x14
lea ecx, [ebp - 0x8f0]
call fcn.0040a89d
push 5
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push str.runas
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x40d131
call fcn.0045011b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x8f0]
call fcn.0040d185
lea ecx, [ebp - 0x8f0]
mov ebx, eax
call fcn.0040a8db
push eax
lea ecx, [ebp - 0x20]
call fcn.004064a9
mov eax, dword [0x4a9450]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, str.Cannot_start_second_instance_of_TwinkiePaste
mov dword [ebp - 4], eax
mov eax, esi
test eax, eax
jne 0x40cf75
xor eax, eax
jmp 0x40cf78
push esi
call edi
push esi
push eax
lea ecx, [ebp - 4]
call fcn.0040678b
mov esi, 0x4aa044
mov eax, esi
test eax, eax
je 0x40cf90
push esi
call edi
push esi
push eax
lea ecx, [ebp - 4]
call fcn.0040678b
lea eax, [ebp - 8]
push 0x1e
push eax
call fcn.00450833
mov eax, dword [eax]
pop ecx
pop ecx
push eax
lea ecx, [ebp - 4]
push dword [eax - 8]
call fcn.0040678b
lea ecx, [ebp - 8]
call fcn.00401085
mov eax, esi
test eax, eax
je 0x40cfc6
push esi
call edi
push esi
push eax
lea ecx, [ebp - 4]
call fcn.0040678b
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.004504e0
pop ecx
pop ecx
push eax
lea eax, [ebp - 8]
push str.Error_Code:
push eax
call fcn.0040673f
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.0040678b
lea ecx, [ebp - 8]
call fcn.00401085
lea ecx, [ebp - 0xc]
call fcn.00401085
mov eax, esi
test eax, eax
je 0x40d012
push esi
call edi
push esi
push eax
lea ecx, [ebp - 4]
call fcn.0040678b
push dword [ebp - 0x20]
lea eax, [ebp - 8]
push eax
call fcn.004504e0
pop ecx
pop ecx
push eax
lea eax, [ebp - 0xc]
push str.What_is_it:
push eax
call fcn.0040673f
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.0040678b
lea ecx, [ebp - 0xc]
call fcn.00401085
lea ecx, [ebp - 8]
call fcn.00401085
call fcn.0040a4e2
push dword [ebp - 4]
push 0x30
push dword [ebp + 8]
call fcn.0040ce92
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045028e
pop ecx
push eax
lea eax, [ebp - 0x24]
push 0xa20
push eax
call fcn.00411a7d
pop ecx
pop ecx
push eax
lea eax, [ebp - 8]
push str.CAppObjects::RunAsAdmin_
push eax
call fcn.0040673f
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040665f
push eax
lea eax, [ebp + 8]
push eax
call fcn.0040665f
lea ecx, [ebp - 0xc]
call fcn.00401085
lea ecx, [ebp - 8]
call fcn.00401085
lea ecx, [ebp - 0x24]
call fcn.00401085
lea ecx, [ebp - 0x18]
call fcn.00401085
lea eax, [ebp - 0x18]
push eax
call fcn.0045028e
pop ecx
push dword [eax]
lea ecx, [ebp + 8]
push esi
call fcn.004091dc
lea ecx, [ebp - 0x18]
call fcn.00401085
push dword [ebp + 8]
call fcn.0043d497
pop ecx
lea ecx, [ebp + 8]
call fcn.00401085
lea ecx, [ebp - 4]
call fcn.00401085
lea ecx, [ebp - 0x20]
call fcn.00401085
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x1c]
call fcn.00401085
lea ecx, [ebp - 0x14]
call fcn.00401085
lea ecx, [ebp - 0x10]
call fcn.00401085
xor eax, eax
jmp 0x40d180
call fcn.0040a08b
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push ebx
mov edi, eax
push 0xe141
push 0x111
push edi
call esi
push ebx
push ebx
push 0x10
push edi
call esi
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x1c]
call fcn.00401085
lea ecx, [ebp - 0x14]
call fcn.00401085
lea ecx, [ebp - 0x10]
call fcn.00401085
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret