Function at 0x408b70
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x2a0
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push 2
mov dword [esp + 0x3c], ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x408ba6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea eax, [esp + 0x84]
mov dword [esp + 0x84], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x408c14
mov ebp, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea ecx, [esp + 0xa8]
push str.explorer.exe
push ecx
call sub.MSVCRT.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x408bf9
mov eax, dword [esp + 0x8c]
lea edx, [esp + 0x38]
push edx
push eax
mov dword [esp + 0x40], ebx
call ebp
test eax, eax
jne 0x408c0d
lea ecx, [esp + 0x84]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x408c14
jmp 0x408bc9
mov edi, dword [esp + 0x8c]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
cmp edi, ebx
jne 0x408c2e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
push edi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x20], esi
jne 0x408c52
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea edx, [esp + 0x14]
push edx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408c77
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x408c8c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push 4
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x408caf
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
jmp 0x408cda
lea ecx, [esp + 0x38]
push ecx
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push ebx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.Userenv.dll
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x408cfa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x408d1e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov ecx, dword [esp + 0x10]
push 1
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
test eax, eax
je 0x408d35
mov ebx, 0x400
mov edx, dword [esp + 0x18]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x40]
xor esi, esi
push eax
mov eax, dword [esp + 0x2bc]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push edx
push ebx
push esi
push esi
push esi
push eax
push esi
push ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x408d9f
mov eax, dword [esp + 0x2bc]
cmp eax, esi
jbe 0x408d9f
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x408daa
push eax
call ebp
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x408db5
push eax
call ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x408dc0
push eax
call ebp
mov eax, dword [esp + 0x20]
push eax
call ebp
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x408dd2
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2a0
ret