Function at 0x4087ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x690
mov eax, dword [0x431418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push str.CreateProcessWithTokenW
push str.Advapi32.dll
mov dword [ebp - 0x630], esi
mov dword [ebp - 0x638], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov dword [ebp - 0x634], eax
test eax, eax
jne 0x408854
push 1
push ebx
push edi
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
jmp 0x408a23
push ebx
push str.Progman
mov dword [ebp - 0x62c], 1
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x408a1d
lea ecx, [ebp - 0x620]
mov dword [ebp - 0x620], ebx
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x620], ebx
je 0x408a1d
push dword [ebp - 0x620]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x63c], eax
test eax, eax
je 0x408a1d
lea ecx, [ebp - 0x628]
push ecx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x408a11
lea eax, [ebp - 0x624]
xor esi, esi
push eax
inc esi
push esi
push 2
push ebx
push 0xf01ff
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x408a05
test edi, edi
je 0x4088fd
cmp byte [edi], bl
je 0x4088fd
mov cl, 1
jmp 0x4088ff
mov cl, bl
mov edx, 0x426a23
test cl, cl
mov eax, edx
cmovne eax, edi
push eax
mov eax, 0x426b14
cmove eax, edx
push eax
push dword [ebp - 0x630]
lea eax, [ebp - 0x20c]
push str.__s__s_s
push 0x208
push eax
call fcn.00403cb5
add esp, 0x18
lea eax, [ebp - 0x61c]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x40
lea eax, [ebp - 0x68c]
mov dword [ebp - 0x690], 0x44
push ebx
push eax
call fcn.0040ea10
xor eax, eax
lea edi, [ebp - 0x64c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x690]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push dword [ebp - 0x624]
call dword [ebp - 0x634]
test eax, eax
je 0x4089f9
mov edi, dword [ebp - 0x638]
test edi, edi
je 0x4089db
mov dword [edi], 0x103
jmp 0x4089ca
cmp dword [edi], 0x103
jne 0x4089db
call fcn.00405ace
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, esi
je 0x4089b5
push dword [ebp - 0x64c]
mov dword [ebp - 0x62c], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x648]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x624]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x62c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d595
leave
ret