Function at 0x403210
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414ab7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x918
push edi
mov dword [ebp - 0x914], ecx
mov byte [ebp - 0x545], 0x5c
mov byte [ebp - 0x591], 0x20
mov byte [ebp - 0x119], 0x2c
push 0x416369
lea ecx, [ebp - 0x6c4]
call fcn.00402170
mov dword [ebp - 4], 0
push 0x104
push 0
lea eax, [ebp - 0x83c]
push eax
call fcn.0040d280
add esp, 0xc
mov ecx, dword [ebp - 0x914]
call fcn.004050a0
test eax, eax
je 0x40329a
push 0x104
lea ecx, [ebp - 0x83c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4032ac
push 0x104
lea edx, [ebp - 0x83c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x590]
call fcn.00402170
mov byte [ebp - 4], 1
mov cl, byte [ebp - 0x545]
push ecx
push 1
lea ecx, [ebp - 0x590]
call fcn.004046b0
movzx edx, byte [0x416790]
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x144]
add eax, 1
push eax
call fcn.0040bb61
add esp, 4
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x6a8], ecx
mov edx, dword [ebp - 0x144]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x6a8]
push eax
call fcn.0040d280
add esp, 0xc
mov ecx, dword [ebp - 0x144]
push ecx
push 0x416788
mov edx, dword [ebp - 0x6a8]
push edx
call fcn.0040cf40
add esp, 0xc
push 0x4166d4
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x6a8]
push ecx
call fcn.004086b0
add esp, 0xc
mov edx, dword [ebp - 0x6a8]
push edx
call fcn.0040ceb0
add esp, 4
push eax
mov eax, dword [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x6c4]
call fcn.00402080
mov ecx, dword [ebp - 0x6a8]
mov dword [ebp - 0x854], ecx
mov edx, dword [ebp - 0x854]
push edx
call fcn.0040cd29
add esp, 4
mov eax, dword [0x4164d0]
push eax
push 0
lea ecx, [ebp - 0x6c4]
push ecx
lea ecx, [ebp - 0x590]
call fcn.00404780
push 0
mov ecx, dword [ebp - 0x914]
call fcn.00405950
push 0
push 0
lea ecx, [ebp - 0x574]
call fcn.00401ba0
mov edx, dword [0x4164d0]
push edx
push 0
mov eax, dword [ebp - 0x914]
add eax, 0x1c
push eax
lea ecx, [ebp - 0x574]
call fcn.00401f90
mov byte [ebp - 4], 2
push 0x104
push 0
lea ecx, [ebp - 0x6a4]
push ecx
call fcn.0040d280
add esp, 0xc
cmp dword [ebp - 0x55c], 0x10
jb 0x403424
mov edx, dword [ebp - 0x570]
mov dword [ebp - 0x918], edx
jmp 0x403430
lea eax, [ebp - 0x570]
mov dword [ebp - 0x918], eax
push 0x104
lea ecx, [ebp - 0x6a4]
push ecx
mov edx, dword [ebp - 0x918]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x730]
call fcn.00402170
mov byte [ebp - 4], 3
mov cl, byte [ebp - 0x591]
push ecx
lea edx, [ebp - 0x590]
push edx
lea eax, [ebp - 0x140]
push eax
call fcn.00404c70
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, dword [0x4164d0]
push ecx
push 0
lea edx, [ebp - 0x730]
push edx
lea ecx, [ebp - 0x140]
call fcn.00404780
mov al, byte [ebp - 0x119]
push eax
push 1
lea ecx, [ebp - 0x140]
call fcn.004046b0
movzx ecx, byte [0x41651e]
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x120], 0
mov edx, dword [ebp - 0x118]
add edx, 1
push edx
call fcn.0040bb61
add esp, 4
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x120]
push edx
call fcn.0040d280
add esp, 0xc
mov eax, dword [ebp - 0x118]
push eax
push 0x416518
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.0040cf40
add esp, 0xc
push 0x4166d4
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x120]
push eax
call fcn.004086b0
add esp, 0xc
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.0040ceb0
add esp, 4
push eax
mov edx, dword [ebp - 0x120]
push edx
lea ecx, [ebp - 0x6c4]
call fcn.00402080
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x85c], eax
mov ecx, dword [ebp - 0x85c]
push ecx
call fcn.0040cd29
add esp, 4
mov edx, dword [0x4164d0]
push edx
push 0
lea eax, [ebp - 0x6c4]
push eax
lea ecx, [ebp - 0x140]
call fcn.00404780
mov dword [ebp - 0x714], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x710]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x714], 0x44
mov dword [ebp - 0x6e8], 1
mov word [ebp - 0x6e4], 0xa
mov dword [ebp - 0x70c], str.WinSta0Default
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x124], 0x104
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x6cc], eax
lea eax, [ebp - 0x114]
push eax
call fcn.0040d3d8
add esp, 4
movzx ecx, byte [0x4165b2]
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x598], 0
mov edx, dword [ebp - 0x6c8]
add edx, 1
push edx
call fcn.0040bb61
add esp, 4
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x598], eax
mov ecx, dword [ebp - 0x6c8]
add ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x598]
push edx
call fcn.0040d280
add esp, 0xc
mov eax, dword [ebp - 0x6c8]
push eax
push str.jn4_0
mov ecx, dword [ebp - 0x598]
push ecx
call fcn.0040cf40
add esp, 0xc
push 0x4166d4
mov edx, dword [ebp - 0x6c8]
push edx
mov eax, dword [ebp - 0x598]
push eax
call fcn.004086b0
add esp, 0xc
mov ecx, dword [ebp - 0x598]
push ecx
call fcn.0040ceb0
add esp, 4
push eax
mov edx, dword [ebp - 0x598]
push edx
lea ecx, [ebp - 0x6c4]
call fcn.00402080
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x864], eax
mov ecx, dword [ebp - 0x864]
push ecx
call fcn.0040cd29
add esp, 4
mov dword [ebp - 0x734], 0x400
mov byte [ebp - 0x544], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x543]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 0x128], 0x10
jb 0x403722
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x91c], edx
jmp 0x40372e
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x91c], eax
push 0x200
lea ecx, [ebp - 0x544]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x91c]
push edx
push 8
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x6ac], 0x10
jb 0x403764
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x920], eax
jmp 0x403770
lea ecx, [ebp - 0x6c0]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x920]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.0041440e
add esp, 8
test eax, eax
je 0x403849
cmp dword [ebp - 0x6cc], 0
je 0x403849
lea ecx, [ebp - 0x558]
push ecx
lea edx, [ebp - 0x714]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x544]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4037e2
mov ecx, dword [ebp - 0x554]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x558]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401ba0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401ba0
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401ba0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401ba0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401ba0
jmp 0x403a5b
movzx eax, byte [0x416504]
mov dword [ebp - 0x84c], eax
mov dword [ebp - 0x844], 0
mov ecx, dword [ebp - 0x84c]
add ecx, 1
push ecx
call fcn.0040bb61
add esp, 4
mov dword [ebp - 0x868], eax
mov edx, dword [ebp - 0x868]
mov dword [ebp - 0x844], edx
mov eax, dword [ebp - 0x84c]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0x844]
push ecx
call fcn.0040d280
add esp, 0xc
mov edx, dword [ebp - 0x84c]
push edx
push str.m3B_9lk_f
mov eax, dword [ebp - 0x844]
push eax
call fcn.0040cf40
add esp, 0xc
push 0x4166d4
mov ecx, dword [ebp - 0x84c]
push ecx
mov edx, dword [ebp - 0x844]
push edx
call fcn.004086b0
add esp, 0xc
mov eax, dword [ebp - 0x844]
push eax
call fcn.0040ceb0
add esp, 4
push eax
mov ecx, dword [ebp - 0x844]
push ecx
lea ecx, [ebp - 0x6c4]
call fcn.00402080
mov edx, dword [ebp - 0x844]
mov dword [ebp - 0x86c], edx
mov eax, dword [ebp - 0x86c]
push eax
call fcn.0040cd29
add esp, 4
cmp dword [ebp - 0x6ac], 0x10
jb 0x403929
mov ecx, dword [ebp - 0x6c0]
mov dword [ebp - 0x924], ecx
jmp 0x403935
lea edx, [ebp - 0x6c0]
mov dword [ebp - 0x924], edx
mov eax, dword [ebp - 0x924]
push eax
lea ecx, [ebp - 0x840]
push ecx
call fcn.00409830
add esp, 8
test eax, eax
jne 0x4039b6
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401ba0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401ba0
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401ba0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401ba0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401ba0
jmp 0x403a5b
lea edx, [ebp - 0x558]
push edx
lea eax, [ebp - 0x714]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x544]
push ecx
push 0
mov edx, dword [ebp - 0x840]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x140]
call fcn.00401ba0
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x730]
call fcn.00401ba0
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x574]
call fcn.00401ba0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x590]
call fcn.00401ba0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x6c4]
call fcn.00401ba0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret