Function at 0x401000
Capabilities:
Acquire debug privileges
Create process on windows
Create thread
Get system information on windows
Inject dll
Inject thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4d8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x4d4], eax
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
mov edi, eax
movaps xmmword [esp + 0x90], xmm0
lea eax, [esp + 0x90]
movaps xmmword [esp + 0xa0], xmm0
push eax
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x80], xmm0
movlpd qword [esp + 0x88], xmm0
mov dword [esp + 0x4c], 0x44
movaps xmmword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x104
lea eax, [esp + 0x2d4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x2d0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.elementclient.bin
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push 0
push 0xc000004
push 0
push 0
push 0
push 0x4031a8
lea eax, [esp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401469
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov dword [esp + 8], eax
lea eax, [esp + 0xc8]
push 0x104
push eax
push edi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.elementplugin.dll
lea eax, [esp + 0xcc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [esp + 0x28]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4011af
push 0x401790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.Falha_ao_abrir_o_processo_remoto:
push eax
call fcn.00401560
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov edi, dword [esp + 8]
push edi
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x4d4]
xor ecx, esp
call fcn.00401a77
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40120d
push 0x4019e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Falha_ao_obter_o_descritor_do_processo_atual
call fcn.004017c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [esp + 0xc]
call esi
mov edi, dword [esp + 8]
push edi
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x4d4]
xor ecx, esp
call fcn.00401a77
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x1c]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40124e
push 0x4019e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Falha_ao_abrir_o_token_do_processo
call fcn.004017c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x4011e4
lea eax, [esp + 0x30]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40129c
mov edx, str.Falha_ao_buscar_o_valor_da_privilgio
push 0x4019e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004017c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
jmp 0x4011e4
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push 0
push 0
push 0x10
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
push eax
push 0
push dword [esp + 0x30]
mov dword [esp + 0x50], 1
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4012de
mov edx, str.Falha_ao_ajustar_privilgios_do_token
jmp 0x401269
push str.LoadLibraryW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x40132e
push 0x401790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Falha_ao_obter_o_endere
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
push eax
call fcn.00401560
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
jmp 0x4011de
lea ecx, [esp + 0xc8]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401340
sub ecx, edx
sar ecx, 1
push 4
push 0x1000
lea eax, [ecx*2 + 2]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
jne 0x401383
push 0x401790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Falha_ao_alocar_mem
jmp 0x40130d
lea ecx, [esp + 0xc8]
lea eax, [ecx + 2]
mov dword [esp + 0x14], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401391
sub ecx, dword [esp + 0x14]
sar ecx, 1
push 0
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0xd0]
push eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401403
push 0x401790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Falha_ao_escrever_o_caminho_da_DLL_na_mem
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
push eax
call fcn.00401560
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0x8000
push 0
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x4011de
push 0
push 0
push dword [esp + 0x18]
push dword [esp + 0x24]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
jne 0x401430
push 0x401790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Falha_ao_criar_thread_remota:
jmp 0x4013d0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov edx, str.PROCESSO_INICIADO___OK__
jmp 0x40146e
mov edx, str.Falha_ao_criar_o_processo
push 0x4019e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004017c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [esp + 0x4dc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00401a77
mov esp, ebp
pop ebp
ret