Function at 0x408450
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x2a0
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push 2
mov dword [esp + 0x3c], ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x408486
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea eax, [esp + 0x84]
mov dword [esp + 0x84], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4084f5
mov ebp, dword [sym.imp.MSVCRT.dll__wcsicmp]
lea ecx, [esp + 0xa8]
push str.explorer.exe
push ecx
call ebp
add esp, 8
test eax, eax
jne 0x4084da
mov eax, dword [esp + 0x8c]
lea edx, [esp + 0x38]
push edx
push eax
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x4084ee
lea ecx, [esp + 0x84]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4084f5
jmp 0x4084a9
mov edi, dword [esp + 0x8c]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
cmp edi, ebx
jne 0x40850f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
push edi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x20], esi
jne 0x408533
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea edx, [esp + 0x14]
push edx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408558
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x40856d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push 4
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x408590
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
jmp 0x4085bb
lea ecx, [esp + 0x38]
push ecx
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push ebx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.Userenv.dll
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4085db
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4085ff
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov ecx, dword [esp + 0x10]
push 1
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
test eax, eax
je 0x408616
mov ebx, 0x400
mov edx, dword [esp + 0x18]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x40]
xor esi, esi
push eax
mov eax, dword [esp + 0x2bc]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push edx
push ebx
push esi
push esi
push esi
push eax
push esi
push ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x408680
mov eax, dword [esp + 0x2bc]
cmp eax, esi
jbe 0x408680
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x40868b
push eax
call ebp
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x408696
push eax
call ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4086a1
push eax
call ebp
mov eax, dword [esp + 0x20]
push eax
call ebp
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x4086b3
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2a0
ret