Function at 0x4023e0
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x198
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
push edi
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov edi, eax
mov ecx, str.winlogon.exe
mov edx, edi
call fcn.004020a0
mov esi, eax
test esi, esi
jne 0x402452
mov edx, edi
mov ecx, str.explorer.exe
call fcn.004020a0
mov esi, eax
test esi, esi
jne 0x402452
sub esp, 8
mov ecx, str._PL1_Cant_Find_Explorer
call fcn.004010d0
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004027a3
mov esp, ebp
pop ebp
ret
push 0x44
lea eax, [esp + 0x4c]
mov dword [esp + 0x18], 0x30
push 0
push eax
call fcn.00403580
add esp, 0xc
mov dword [esp + 0x48], 0x44
xorps xmm0, xmm0
mov dword [esp + 0x50], str.winsta0default
movaps xmmword [esp + 0x30], xmm0
push esi
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], eax
push ecx
push 0x201eb
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4024f0
push 0xf2
lea eax, [esp + 0xa4]
push 0
push eax
call fcn.00403580
add esp, 0xc
call esi
push eax
push str._PL2_Process_token_open_Error:__u
lea eax, [esp + 0xa8]
push 0x79
push eax
call fcn.00402770
add esp, 8
lea ecx, [esp + 0xa8]
call fcn.004010d0
add esp, 8
lea eax, [esp + 0x28]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x402545
push 0xf2
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.00403580
add esp, 0xc
call esi
push eax
push str._PL3_Lookup_Privilege_value_Error:__u
lea eax, [esp + 0xa8]
push 0x79
push eax
call fcn.00402770
add esp, 8
lea ecx, [esp + 0xa8]
call fcn.004010d0
add esp, 8
mov eax, dword [esp + 0x28]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x98], eax
lea eax, [esp + 0x24]
push eax
push edi
mov dword [esp + 0x98], 1
mov dword [esp + 0xa4], 2
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
lea eax, [esp + 0xc]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4025da
push 0xf2
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.00403580
add esp, 0xc
call esi
push eax
push str._PL4_DuplicateTokenEx_Error:__u
lea eax, [esp + 0xa8]
push 0x79
push eax
call fcn.00402770
add esp, 8
lea ecx, [esp + 0xa8]
call fcn.004010d0
add esp, 8
push 0
push 0
push 0x10
lea eax, [esp + 0x9c]
push eax
push 0
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x402637
push 0xf2
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.00403580
add esp, 0xc
call esi
push eax
push str._PL5_Adjust_Privilege_value_Error:__u
lea eax, [esp + 0xa8]
push 0x79
push eax
call fcn.00402770
add esp, 8
lea ecx, [esp + 0xa8]
call fcn.004010d0
add esp, 8
call esi
cmp eax, 0x514
jne 0x402650
sub esp, 8
mov ecx, str._PL6_Token_does_not_have_the_provilege
call fcn.004010d0
add esp, 8
push 1
push dword [esp + 0x10]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x40267b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0x430
jmp 0x402691
sub esp, 8
mov ecx, str._PL7_CreateEnvironmentBlock_Failed
call fcn.004010d0
add esp, 8
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x4c]
push ecx
push 0
push eax
push dword [esp + 0x24]
push 0
push 0
push 0
push dword [esp + 0x3c]
push 0
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
call esi
mov esi, eax
test edi, edi
jne 0x402703
test esi, esi
je 0x402703
push 0xf2
lea eax, [esp + 0xa4]
push edi
push eax
call fcn.00403580
add esp, 0xc
lea eax, [esp + 0xa0]
push esi
push str._PL8_CreateProcessAsUser_Error:__d
push 0x79
push eax
call fcn.00402770
add esp, 8
lea ecx, [esp + 0xa8]
call fcn.004010d0
add esp, 8
mov eax, dword [esp + 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x402714
push eax
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40271f
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40272a
push eax
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x402735
push eax
call esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402740
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40274b
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40275a
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, dword [esp + 0x19c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004027a3
mov esp, ebp
pop ebp
ret