Function at 0x408410
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0xa2c], 2
jne 0x40856f
call fcn.00408141
test al, al
je 0x40856f
push 6
xor eax, eax
pop ecx
mov esi, 0x401828
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
push esi
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0xd0], esi
call fcn.00406310
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov edi, 0x2000000
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408562
lea eax, [ebp - 4]
push eax
push 1
push 2
push esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x40854b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x8c]
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x40853a
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x18]
push eax
push 0x19
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x408529
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x40852f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x4086a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x408540
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408551
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x28]
jmp 0x408638
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, esi
jmp 0x408638
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.00406310
mov al, byte [ebx + 0xa28]
neg al
push 0x206
push edi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], 0x440
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x2d8], di
sbb eax, eax
and eax, 0xa
mov dword [ebp - 0x48], eax
lea eax, [ebx + 0x208]
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0xa2c]
dec eax
neg eax
sbb eax, eax
not eax
and eax, 0x40181c
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x2d6]
push eax
call fcn.00406310
push ebx
call fcn.0040837d
add esp, 0x1c
test al, al
je 0x40860b
mov esi, 0x104
push esi
lea eax, [ebp - 0x2d8]
push ebx
push eax
call fcn.0040834d
add esp, 0xc
test al, al
je 0x408522
lea eax, [ebp - 0x2d8]
push esi
push eax
call fcn.0040831d
pop ecx
pop ecx
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x408633
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xa34], eax
jmp 0x408522
mov eax, dword [ebp - 0x2c]
mov edi, eax
cmp byte [ebx + 0xa29], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessId]
mov byte [ebp + 0xb], 1
je 0x40865a
push edi
call esi
push eax
push 0x4083d1
call dword [sym.imp.USER32.dll_EnumWindows]
push edi
call esi
cmp byte [ebx + 0xa2a], 0
mov dword [ebx + 0xa38], eax
jne 0x408696
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40867d
mov byte [ebp + 0xb], 0
mov ebx, dword [ebx + 0xa30]
test ebx, ebx
je 0x408696
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x408696
mov byte [ebp + 0xb], al
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
leave
ret