Function at 0x40816f
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0xa2c], 2
jne 0x4082ce
call fcn.00407eb2
test al, al
je 0x4082ce
push 6
xor eax, eax
pop ecx
mov esi, 0x401788
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
push esi
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0xd0], esi
call fcn.004062a0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov edi, 0x2000000
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4082c1
lea eax, [ebp - 4]
push eax
push 1
push 2
push esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4082aa
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x8c]
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x408299
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x18]
push eax
push 0x19
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x408288
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x40828e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x4083fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40829f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4082b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x28]
jmp 0x408394
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, esi
jmp 0x408394
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.004062a0
mov al, byte [ebx + 0xa28]
neg al
push 0x206
push edi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], 0x440
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x2d8], di
sbb eax, eax
and eax, 0xa
mov dword [ebp - 0x48], eax
lea eax, [ebx + 0x208]
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0xa2c]
dec eax
neg eax
sbb eax, eax
not eax
and eax, 0x40177c
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x2d6]
push eax
call fcn.004062a0
add esp, 0x18
cmp word [ebx + 2], 0x3a
jne 0x408367
mov esi, 0x104
push esi
lea eax, [ebp - 0x2d8]
push ebx
push eax
call fcn.004080be
add esp, 0xc
test al, al
je 0x408281
lea eax, [ebp - 0x2d8]
push esi
push eax
call fcn.0040808e
pop ecx
pop ecx
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40838f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xa34], eax
jmp 0x408281
mov eax, dword [ebp - 0x2c]
mov edi, eax
cmp byte [ebx + 0xa29], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessId]
mov byte [ebp + 0xb], 1
je 0x4083b6
push edi
call esi
push eax
push 0x408130
call dword [sym.imp.USER32.dll_EnumWindows]
push edi
call esi
cmp byte [ebx + 0xa2a], 0
mov dword [ebx + 0xa38], eax
jne 0x4083f2
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4083d9
mov byte [ebp + 0xb], 0
mov ebx, dword [ebx + 0xa30]
test ebx, ebx
je 0x4083f2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4083f2
mov byte [ebp + 0xb], al
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
leave
ret