Function at 0x401b40
Capabilities:
Create process on windows
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
mov eax, dword [0x465014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x550], 0x103
push 0
push eax
call fcn.004086d0
push 0x103
lea eax, [ebp - 0x54c]
mov ecx, 0x42
lea esi, [ebp - 0x550]
lea edi, [ebp - 0x868]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x550], 0x103
call fcn.004086d0
push 0x103
lea eax, [ebp - 0x54c]
mov ecx, 0x42
lea esi, [ebp - 0x550]
lea edi, [ebp - 0x760]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x550], 0x103
call fcn.004086d0
push 0x103
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x150], 0x103
mov ecx, 0x42
lea esi, [ebp - 0x550]
lea edi, [ebp - 0x658]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.004086d0
add esp, 0x30
lea esi, [ebp - 0x150]
mov ecx, 0x42
lea edi, [ebp - 0x550]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x874], 0
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x878]
mov dword [ebp - 0x878], 0x44
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x874]
lea eax, [ebp - 0x448]
push str.IsAdmin:__d
push eax
call fcn.00401eb0
add esp, 0xc
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
pop edi
pop esi
test eax, eax
js 0x401dc3
lea eax, [ebp - 0x760]
push 0x467228
push eax
call fcn.00404550
lea eax, [ebp - 0x760]
push str.correioshell.exe
push eax
call fcn.00404570
lea eax, [ebp - 0x658]
push 0x467694
push eax
call fcn.00404550
lea eax, [ebp - 0x658]
push str.programsCutekCorreio_2.lnk
push eax
call fcn.00404530
push 0
push 0x45437c
push 0x46722c
push 1
push 0x45437c
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x75c]
push 0x45437c
push eax
call fcn.004018f0
add esp, 0x40
test eax, eax
js 0x401dc3
lea eax, [ebp - 0x550]
push 0x467228
push eax
call fcn.00404550
lea eax, [ebp - 0x550]
push str.Correio2.linkinfo.txt
push eax
call fcn.00404530
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x54c]
push 3
push eax
call fcn.00403840
add esp, 0x20
cmp dword [ebp - 0x86c], 0
jne 0x401dc3
lea eax, [ebp - 0x654]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401d63
lea ecx, [ebp - 0x86c]
sub eax, edx
push ecx
lea ecx, [ebp - 0x87c]
push ecx
push eax
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0x870]
call fcn.00403aa0
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x87c]
push eax
push 2
push 0x4543cc
push dword [ebp - 0x870]
call fcn.00403aa0
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x870]
push eax
call fcn.00402a60
add esp, 0x30
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [ebp - 0x868]
push 0x467228
push eax
call fcn.00404550
lea eax, [ebp - 0x868]
push str.CorreioShell.exe
push eax
call fcn.00404530
add esp, 0x10
lea eax, [ebp - 0x864]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0040775e
mov esp, ebp
pop ebp
ret