Function at 0x409700
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x2b0
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
mov dword [esp + 0x24], ebp
mov dword [esp + 0x38], ebp
xor edi, edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40973a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea eax, [esp + 0x94]
mov dword [esp + 0x94], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4097a8
mov ebx, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea ecx, [esp + 0xb8]
push 0x420b0c
push ecx
call sub.MSVCRT.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x40978d
mov eax, dword [esp + 0x9c]
lea edx, [esp + 0x48]
push edx
push eax
mov dword [esp + 0x50], ebp
call ebx
test eax, eax
jne 0x4097a1
lea ecx, [esp + 0x94]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4097a8
jmp 0x40975d
mov edi, dword [esp + 0x9c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
cmp edi, ebp
jne 0x4097c2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
push edi
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x44], esi
jne 0x4097e6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea edx, [esp + 0x14]
push edx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40980b
push esi
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
mov eax, dword [esp + 0x14]
cmp eax, ebp
jne 0x409820
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea ecx, [esp + 0x30]
lea edx, [esp + 0x2c]
push ecx
push 4
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x409843
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
jmp 0x40986e
lea ecx, [esp + 0x48]
push ecx
push str.SeDebugPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push ebp
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.Userenv.dll
mov dword [esp + 0x1c], ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebp
jne 0x409892
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
jne 0x4098b6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
mov ecx, dword [esp + 0x10]
push 1
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
test eax, eax
je 0x4098cd
mov ebx, 0x400
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x50]
lea edx, [esp + 0x50]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push ebp
push eax
mov eax, dword [esp + 0x2d8]
push ebx
lea ecx, [esp + 0x34]
push ebp
lea edx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
mov esi, 1
push ebp
push ecx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x7c], 0x44
mov dword [esp + 0x4c], 0xc
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x409964
mov eax, dword [esp + 0x2cc]
cmp eax, ebp
jbe 0x40996a
mov edx, dword [esp + 0x34]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40996a
mov dword [esp + 0x1c], esi
jmp 0x40996a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x34]
cmp eax, ebp
je 0x40997d
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
jmp 0x409983
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x40998e
push eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409999
push eax
call esi
mov eax, dword [esp + 0x44]
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4099ab
push eax
call esi
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b0
ret