Function at 0x409320
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd28
mov eax, dword [0x46b880]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc9c], ebx
mov dword [ebp - 0xcbc], eax
test esi, esi
jne 0x409356
or eax, 0xffffffff
jmp 0x4098ac
push edi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0xc44], ecx
xor edi, edi
mov word [ebp - 0xc58], ax
push 0x20a
mov word [ebp - 0xc40], ax
lea eax, [ebp - 0x418]
push edi
push eax
mov dword [ebp - 0xc48], edi
mov dword [ebp - 0xc30], edi
mov dword [ebp - 0xc2c], ecx
call fcn.00425c30
push 0x104
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0042d385
xor eax, eax
mov dword [ebp - 0xc94], edi
add esp, 0x18
mov word [ebp - 0x212], ax
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x40943d
mov esi, dword [edi]
push esi
call fcn.0042d325
pop ecx
push eax
push esi
lea ecx, [ebp - 0xc58]
call fcn.004092cf
xor eax, eax
inc eax
cmp dword [ebp - 0xc94], eax
jle 0x409436
mov ebx, eax
mov esi, dword [edi + ebx*4]
push esi
call fcn.0042d325
pop ecx
push eax
push esi
lea ecx, [ebp - 0xc40]
call fcn.00408729
mov esi, 0x44e3fc
push esi
call fcn.0042d325
pop ecx
push eax
push esi
lea ecx, [ebp - 0xc40]
call fcn.00408729
inc ebx
cmp ebx, dword [ebp - 0xc94]
jl 0x4093f7
mov ebx, dword [ebp - 0xc9c]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 8
pop ecx
push 0x44
pop esi
xor eax, eax
lea edi, [ebp - 0xcdc]
push esi
xor edx, edx
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0xd28]
push eax
call fcn.00425c30
xor eax, eax
mov dword [ebp - 0xd28], esi
lea edi, [ebp - 0xcac]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
cmp dword [ebp + 8], 0xffffff9c
mov dword [ebp - 0xc8c], edi
mov dword [ebp - 0xc90], edi
jne 0x409503
cmp dword [ebp - 0xc2c], 8
lea edx, [ebp - 0xcac]
push edx
lea edx, [ebp - 0xd28]
push edx
push edi
push edi
push 8
push edi
push edi
lea ecx, [ebp - 0xc40]
cmovae ecx, dword [ebp - 0xc40]
lea eax, [ebp - 0xc58]
cmp dword [ebp - 0xc44], 8
push edi
cmovae eax, dword [ebp - 0xc58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 2
sub edi, 2
test ebx, ebx
je 0x4094e3
mov eax, dword [ebp - 0xca4]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xcbc]
test ecx, ecx
je 0x409810
xor eax, eax
test edi, edi
cmove eax, dword [ebp - 0xcac]
mov dword [ecx], eax
jmp 0x409825
push dword [ebp + 0x18]
lea eax, [ebp - 0xc8c]
push eax
push dword [ebp + 8]
call fcn.00409b0a
mov edi, eax
add esp, 0xc
test edi, edi
js 0x409893
xor esi, esi
lea eax, [ebp - 0xc90]
push esi
push dword [ebp - 0xc8c]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
push 8
pop ecx
test eax, eax
mov edx, 0x408
lea eax, [ebp - 0xce0]
push eax
push 0x400
lea eax, [ebp - 0xc28]
cmovne ecx, edx
push eax
push 1
push dword [ebp - 0xc8c]
mov dword [ebp - 0xc9c], ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x409583
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffffb
pop edi
jmp 0x4094e3
mov eax, 0x104
push 0x208
mov dword [ebp - 0xcb4], eax
mov dword [ebp - 0xcb8], eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00425c30
push 0x208
lea eax, [ebp - 0x828]
push esi
push eax
call fcn.00425c30
add esp, 0x18
lea eax, [ebp - 0xce4]
push eax
lea eax, [ebp - 0xcb4]
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0xcb8]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xc28]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x409602
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffffa
jmp 0x40957d
mov dword [ebp - 0xc98], esi
lea eax, [ebp - 0x20c]
mov esi, dword [0x46c9c4]
mov dword [ebp - 0xcdc], 0x20
mov dword [ebp - 0xcd4], eax
test esi, esi
je 0x409635
cmp dword [0x46c9c0], 0
jne 0x4096fd
push 0x208
xor edx, edx
lea eax, [ebp - 0x620]
push edx
push eax
call fcn.00425c30
add esp, 0xc
lea eax, [ebp - 0x620]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4096f7
push 0x44e400
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0xc88]
call fcn.004090db
push eax
lea eax, [ebp - 0xc70]
push eax
call fcn.00409013
add esp, 0xc
lea ecx, [ebp - 0xc88]
call fcn.004086f1
push str.Netapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4096ca
cmp dword [ebp - 0xc5c], 8
lea eax, [ebp - 0xc70]
cmovae eax, dword [ebp - 0xc70]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4096ec
push str.NetApiBufferFree
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NetUserGetInfo
push esi
mov dword [0x46c9c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46c9c4], eax
lea ecx, [ebp - 0xc70]
call fcn.004086f1
mov esi, dword [0x46c9c4]
test esi, esi
je 0x4094e3
cmp dword [0x46c9c0], 0
je 0x4094e3
lea eax, [ebp - 0xc98]
mov ecx, esi
push eax
push 4
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
push eax
call dword [0x44d42c]
call esi
test eax, eax
jne 0x40976b
mov ecx, dword [ebp - 0xc98]
mov eax, dword [ecx + 0x68]
test eax, eax
je 0x40975a
xor edx, edx
cmp word [eax], dx
je 0x40975a
push eax
call fcn.0042d262
pop ecx
mov ecx, dword [ebp - 0xc98]
mov dword [ebp - 0xcd0], eax
mov esi, dword [0x46c9c0]
push ecx
mov ecx, esi
call dword [0x44d42c]
call esi
lea eax, [ebp - 0xcdc]
push eax
push dword [ebp - 0xc8c]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x409795
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffff9
jmp 0x40957d
cmp dword [ebp - 0xc2c], 8
lea ecx, [ebp - 0xc40]
lea edx, [ebp - 0xcac]
mov dword [ebp - 0xd20], 0x44dbac
cmovae ecx, dword [ebp - 0xc40]
lea eax, [ebp - 0xc58]
cmp dword [ebp - 0xc44], 8
push edx
cmovae eax, dword [ebp - 0xc58]
lea edx, [ebp - 0xd28]
push edx
xor edx, edx
push edx
push dword [ebp - 0xc90]
push dword [ebp - 0xc9c]
push edx
push edx
push edx
push ecx
push eax
push dword [ebp - 0xc8c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4094d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffff8
jmp 0x40957d
cmp dword [ebp - 0xcac], 0
je 0x409825
push dword [ebp - 0xcac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xcc0], 0
je 0x409840
push dword [ebp - 0xcc0]
push dword [ebp - 0xc8c]
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
cmp dword [ebp - 0xcd0], 0
je 0x409855
push dword [ebp - 0xcd0]
call fcn.0042d6f6
pop ecx
cmp dword [ebp - 0xc90], 0
je 0x409869
push dword [ebp - 0xc90]
call sub.USERENV.dll_DestroyEnvironmentBlock
cmp dword [ebp - 0xc8c], 0
je 0x40987e
push dword [ebp - 0xc8c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xca8], 0
je 0x409893
push dword [ebp - 0xca8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xc40]
call fcn.004086f1
lea ecx, [ebp - 0xc58]
call fcn.004086f1
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00423dc5
mov esp, ebp
pop ebp
ret