Function at 0x402140
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push 0xffffffffffffffff
push 0x41e340
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4251ac]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x1c]
xor ebx, ebx
push eax
push 0x20
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402203
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebx
je 0x4021a5
add esi, 8
jmp 0x4021a7
xor esi, esi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
call fcn.00401fa0
add esp, 4
push eax
push ecx
push str.OpenProcessToken_failed:
push esi
mov dword [esp + 0x9c], ebx
call fcn.00405240
add esp, 0xc
push eax
call fcn.004054a0
add esp, 8
cmp dword [esp + 0x44], 8
jb 0x4021ea
mov edx, dword [esp + 0x30]
push edx
call fcn.0040ad4f
add esp, 4
xor al, al
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
lea eax, [esp + 0x30]
push eax
push str.SeIncreaseQuotaPrivilege
push ebx
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
push ecx
push ebx
push edx
mov dword [esp + 0x50], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov edi, eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x4022bc
cmp esi, ebx
je 0x402258
lea ebx, [esi + 8]
lea ecx, [esp + 0x48]
push ecx
mov ecx, edi
call fcn.00401fa0
add esp, 4
push eax
push ecx
push str.AdjustTokenPrivileges_failed:
push ebx
mov dword [esp + 0x9c], 1
call fcn.00405240
add esp, 0xc
push eax
call fcn.004054a0
add esp, 8
cmp dword [esp + 0x60], 8
jb 0x4021ea
mov edx, dword [esp + 0x4c]
push edx
call fcn.0040ad4f
add esp, 4
xor al, al
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, ebx
jne 0x4022f4
cmp esi, ebx
je 0x4022cd
lea ebx, [esi + 8]
push str.No_desktop_shell_is_present
push ebx
call fcn.00405240
add esp, 8
xor al, al
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x28]
cmp eax, ebx
jne 0x402336
cmp esi, ebx
je 0x40230f
lea ebx, [esi + 8]
push str.Unable_to_get_PID_of_desktop_shell.
push ebx
call fcn.00405240
add esp, 8
xor al, al
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
jne 0x4023a7
call ebp
cmp esi, ebx
je 0x402352
lea ebx, [esi + 8]
lea edx, [esp + 0x48]
push edx
mov ecx, eax
call fcn.00401fa0
add esp, 4
push eax
push ecx
push str.Cant_open_desktop_shell_process:
push ebx
mov dword [esp + 0x9c], 2
call fcn.00405240
add esp, 0xc
push eax
call fcn.004054a0
add esp, 8
lea esi, [esp + 0x48]
call fcn.004026a0
xor al, al
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
lea eax, [esp + 0x20]
push eax
push 2
push edi
mov byte [esp + 0x27], bl
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, ebx
jne 0x40240b
call ebp
cmp esi, ebx
je 0x4023c8
add esi, 8
jmp 0x4023ca
xor esi, esi
lea ecx, [esp + 0x48]
push ecx
mov ecx, eax
call fcn.00401fa0
add esp, 4
push eax
push ecx
mov dword [esp + 0x94], 3
push str.Cant_get_process_token_of_desktop_shell:
push esi
call fcn.00405240
add esp, 0xc
push eax
call fcn.004054a0
lea esi, [esp + 0x50]
add esp, 8
call fcn.004026a0
jmp 0x4024d5
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
push 1
push 2
push ebx
push 0x18b
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp eax, ebx
jne 0x402459
call ebp
cmp esi, ebx
je 0x402434
add esi, 8
jmp 0x402436
xor esi, esi
lea ecx, [esp + 0x48]
push ecx
mov ecx, eax
call fcn.00401fa0
add esp, 4
push eax
push ecx
mov dword [esp + 0x94], 4
push str.Cant_get_primary_token:
jmp 0x4023eb
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x94]
push edx
mov edx, dword [esp + 0x28]
push eax
push ebx
push ebx
push ebx
push ecx
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
cmp eax, ebx
jne 0x4024d0
call ebp
cmp esi, ebx
je 0x402490
add esi, 8
jmp 0x402492
xor esi, esi
lea ecx, [esp + 0x64]
push ecx
mov ecx, eax
call fcn.00401fa0
add esp, 4
push eax
push ecx
push str.CreateProcessWithTokenW_failed:
push esi
mov dword [esp + 0x9c], 5
call fcn.00405240
add esp, 0xc
push eax
call fcn.004054a0
lea esi, [esp + 0x6c]
add esp, 8
call fcn.004026a0
jmp 0x4024d5
mov byte [esp + 0x1b], 1
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x24]
push eax
call esi
push edi
call esi
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret