Function at 0x4692a0
Capabilities:
Acquire debug privileges
Compare security identifiers
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c234d
mov eax, dword fs:[0]
push eax
sub esp, 0x540
mov eax, dword [0x4f9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp + 0x18]
push 0x11
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp + 0x20]
push str.WTSQueryUserToken
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0xf
mov byte [ebp - 0x254], 0
call fcn.004094a0
push str.wtsapi32.dll
lea ecx, [ebp - 0x28c]
mov dword [ebp - 4], 0
call sym.XNewLook.exe_public:_void___thiscall_LString::constructor_char_const__
xor esi, esi
lea eax, [ebp - 0x288]
cmp dword [ebp - 0x274], 8
mov dword [ebp - 0x4e8], esi
cmovae eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov dword [ebp - 0x4e4], ecx
test ecx, ecx
je 0x46937f
cmp dword [ebp - 0x240], 0x10
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x4e8], esi
lea ecx, [ebp - 0x28c]
call sym.XNewLook.exe_public_virtual:_void___thiscall_LString::destructor_void_
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x240]
cmp edx, 0x10
jb 0x4693c8
mov ecx, dword [ebp - 0x254]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4693be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x469abf
push edx
push ecx
call fcn.00475891
add esp, 8
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0xf
mov byte [ebp - 0x254], 0
test esi, esi
je 0x469608
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4694d9
push 0x1c
push str.WTSGetActiveConsoleSessionId
lea ecx, [ebp - 0x238]
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], 0
call fcn.004094a0
push str.Kernel32.dll
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 3
call sym.XNewLook.exe_public:_void___thiscall_LString::constructor_char_const__
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x220]
call sym.XNewLook.exe_public:_void___thiscall_LDynamicFnBase::constructor_class_LString_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
lea ecx, [ebp - 0x270]
call sym.XNewLook.exe_public_virtual:_void___thiscall_LString::destructor_void_
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x224]
cmp edx, 0x10
jb 0x469498
mov ecx, dword [ebp - 0x238]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46948e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x469ac4
push edx
push ecx
call fcn.00475891
add esp, 8
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], 0
test eax, eax
je 0x4694c4
call eax
mov esi, eax
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4694d9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x4c0]
mov dword [ebp - 0x4ec], 0
xor edi, edi
push eax
push esi
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x4c0], edi
mov dword [ebp - 0x4c4], edi
call dword [ebp - 0x4e8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4695f7
mov eax, dword [ebp - 0x4c0]
test eax, eax
je 0x469526
push eax
call esi
mov dword [ebp - 0x4c0], edi
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x4c8], eax
cmp eax, 0xffffffff
je 0x469608
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4695ba
mov edi, dword [ebp + 0xc]
nop
lea eax, [ebp - 0x494]
push str.explorer.exe
push eax
call fcn.0047cdb1
add esp, 8
test eax, eax
jne 0x4695a1
mov dword [ebp - 0x4cc], eax
lea eax, [ebp - 0x4cc]
push eax
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4695a1
cmp dword [ebp - 0x4cc], edi
je 0x469641
lea eax, [ebp - 0x4b8]
push eax
push dword [ebp - 0x4c8]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x469560
xor edi, edi
push dword [ebp - 0x4c8]
call esi
test edi, edi
je 0x469608
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x4cc], edi
test edi, edi
je 0x469608
lea eax, [ebp - 0x4c0]
push eax
push 0xf00ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x469605
mov eax, dword [ebp - 0x4c0]
test eax, eax
jne 0x46964c
test edi, edi
je 0x469608
push edi
call esi
mov byte [ebp - 0x4b9], 0
mov eax, dword [ebp - 0x4e4]
test eax, eax
je 0x469620
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [ebp - 0x4b9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475880
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x4b0]
jmp 0x4695ba
lea ecx, [ebp - 0x4ec]
push ecx
push 4
lea ecx, [ebp - 0x4f0]
push ecx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4696ea
mov dword [ebp - method.LString.virtual_0], vtable.LString.0
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
push 0x10
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x238]
inc dword [sym.XNewLook.exe_unsigned_int_LString::_ui_instance_count]
push str.SeDebugPrivilege
call fcn.00409940
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 2
push 1
push eax
call sym.XNewLook.exe_bool___cdecl_LEnvironment::enable_priv_class_LString_const___bool_
add esp, 8
lea ecx, [ebp - 0x23c]
call sym.XNewLook.exe_public_virtual:_void___thiscall_LString::destructor_void_
lea eax, [ebp - 0x4c4]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x4696f6
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x4c4], eax
cmp byte [ebp + 0x10], 0
je 0x469824
push 0x1000
call fcn.004759b9
add esp, 4
mov dword [ebp - 0x4d0], 0
mov edi, eax
lea eax, [ebp - 0x508]
mov dword [ebp - 0x4d4], edi
push eax
push 0x1000
push edi
push 2
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4697e4
lea eax, [ebp - 0x4c8]
mov dword [ebp - 0x220], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x220]
mov word [ebp - 0x21c], 0x500
push eax
mov dword [ebp - 0x4c8], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4697e4
xor esi, esi
cmp dword [edi], esi
jbe 0x4697d2
add edi, 4
nop word [eax + eax]
push dword [edi]
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4697c2
mov eax, dword [ebp - 0x4d4]
inc esi
add edi, 8
cmp esi, dword [eax]
jb 0x4697a0
jmp 0x4697cc
mov dword [ebp - 0x4d0], 1
mov edi, dword [ebp - 0x4d4]
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.004759e5
add esp, 4
cmp dword [ebp - 0x4d0], 0
jne 0x469824
mov eax, dword [ebp - 0x4cc]
test eax, eax
je 0x469803
push eax
call esi
mov eax, dword [ebp - 0x4c4]
test eax, eax
je 0x469810
push eax
call esi
mov eax, dword [ebp - 0x4c0]
test eax, eax
je 0x469608
push eax
jmp 0x469606
push 1
push dword [ebp - 0x4c4]
lea eax, [ebp - 0x4d8]
mov dword [ebp - 0x4d8], 0
push eax
mov edi, 0x30
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
mov ecx, 0x430
push 0x44
lea eax, [ebp - 0x54c]
cmovne edi, ecx
push 0
push eax
mov dword [ebp - 0x4d0], edi
call fcn.004773d0
mov ax, word [ebp + 0x1c]
push 0x208
mov word [ebp - 0x51c], ax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x54c], 0x44
mov dword [ebp - 0x520], 1
call fcn.004773d0
xor eax, eax
mov dword [ebp - method.LString.virtual_0], vtable.LString.0
add esp, 0x18
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
push 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x238]
inc dword [sym.XNewLook.exe_unsigned_int_LString::_ui_instance_count]
push str.WinSta0_
call fcn.00409940
push dword [ebp - 0x4f4]
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x270]
push eax
call sym.XNewLook.exe_class_LString___cdecl_operator_class_LString_const___class_LString_const__
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call sym.XNewLook.exe_public_virtual:_void___thiscall_LString::destructor_void_
cmp dword [ebp - 0x258], 8
lea ecx, [ebp - 0x26c]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x26c]
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x469930
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x544], eax
call sym.XNewLook.exe_public_virtual:_void___thiscall_LString::destructor_void_
mov eax, dword [ebp - 0x4e0]
xor ecx, ecx
mov edx, 2
xorps xmm0, xmm0
movups xmmword [ebp - 0x504], xmm0
mov eax, dword [eax + 0x14]
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004759b9
mov ecx, dword [ebp - 0x4e0]
add esp, 4
add ecx, 4
mov edi, eax
cmp dword [ecx + 0x14], 8
jb 0x469997
mov ecx, dword [ecx]
mov edx, edi
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4699a0
mov eax, dword [ebp - 0x4dc]
cmp dword [eax + 0x14], 0
jne 0x4699c0
xor eax, eax
jmp 0x4699cb
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x4699cb
mov eax, dword [eax]
lea ecx, [ebp - 0x504]
push ecx
lea ecx, [ebp - 0x54c]
push ecx
push eax
push dword [ebp - 0x4d8]
push dword [ebp - 0x4d0]
push 0
push 0
push 0
push edi
push 0
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push edi
mov dword [ebp - 0x4dc], eax
call fcn.004759e5
mov ecx, dword [ebp + 0x14]
add esp, 4
test ecx, ecx
js 0x469a5a
jne 0x469a23
push 0xffffffffffffffff
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x469a3d
imul eax, ecx, 0x3e8
push eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x469a5a
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x4d0], 0
push eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x504]
test eax, eax
je 0x469a67
push eax
call esi
mov eax, dword [ebp - 0x500]
test eax, eax
je 0x469a74
push eax
call esi
mov eax, dword [ebp - 0x4c4]
test eax, eax
je 0x469a81
push eax
call esi
mov eax, dword [ebp - 0x4cc]
test eax, eax
je 0x469a8e
push eax
call esi
mov eax, dword [ebp - 0x4c0]
test eax, eax
je 0x469a9b
push eax
call esi
mov eax, dword [ebp - 0x4d8]
test eax, eax
je 0x469aac
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp dword [ebp - 0x4dc], 0
setne byte [ebp - 0x4b9]
jmp 0x46960f
call fcn.0047cd61
call fcn.0047cd61
int3