Function at 0x401000
Capabilities:
Create process on windows
Find taskbar
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45bcf6
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x47ca80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x29c], 0
push 0x460918
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jne 0x40106a
xor eax, eax
jmp 0x40134d
push 0x460928
mov eax, dword [ebp - 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47df20], eax
push str.ImpersonateLoggedOnUser
mov ecx, dword [ebp - 0x298]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x47df24], eax
cmp dword [0x47df24], 0
je 0x4010aa
cmp dword [0x47df20], 0
jne 0x4010b5
mov eax, dword [ebp - 0x248]
jmp 0x40134d
push 0
push 0x460954
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x4010e5
lea edx, [ebp - 0x29c]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x29c]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x228], eax
lea edx, [ebp - 0x22c]
push edx
push 0xf00ff
mov eax, dword [ebp - 0x228]
push eax
call dword [0x47df20]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jne 0x401148
lea ecx, [ebp - 0x22c]
push ecx
push 0x1a
mov edx, dword [ebp - 0x228]
push edx
call dword [0x47df20]
test eax, eax
jne 0x401148
xor eax, eax
jmp 0x40134d
mov dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x22c]
push eax
call dword [0x47df24]
cmp eax, 1
jne 0x401170
mov dword [ebp - 0x248], 1
jmp 0x401188
push 0x460964
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.ImpersonateLoggedOnUser_error
call fcn.00411940
add esp, 4
mov dword [ebp - 0x294], 0
push 0x40
push 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.00440170
add esp, 0xc
mov dword [ebp - 0x244], 0
xor edx, edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x294], 0x44
mov eax, 5
mov word [ebp - 0x264], ax
lea ecx, [ebp - 0x234]
call fcn.00402f90
mov dword [ebp - 4], 0
push 0x200
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x224], eax
mov edx, 1
test edx, edx
je 0x401234
mov eax, dword [ebp - 0x224]
movsx ecx, byte [ebp + eax - 0x21c]
mov edx, dword [ebp - 0x224]
sub edx, 1
mov dword [ebp - 0x224], edx
cmp ecx, 0x5c
jne 0x401232
jmp 0x401234
jmp 0x401205
mov eax, dword [ebp - 0x224]
add eax, 1
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov byte [ebp + ecx - 0x21c], 0
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x234]
call fcn.00403070
lea ecx, [ebp - 0x230]
call fcn.00402f90
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x234]
push eax
push str.hh.exe__sEdpDisk.chm
lea ecx, [ebp - 0x230]
push ecx
call fcn.00404400
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.00403130
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
lea ecx, [ebp - 0x230]
call fcn.00403140
push eax
call fcn.00411940
add esp, 4
lea edx, [ebp - 0x244]
push edx
lea eax, [ebp - 0x294]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea ecx, [ebp - 0x230]
call fcn.00403130
push eax
push 0
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x298], 0
je 0x40131a
mov ecx, dword [ebp - 0x298]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x248]
mov dword [ebp - 0x2a0], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00403050
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.00403050
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00440160
mov esp, ebp
pop ebp
ret