Function at 0x10002580
Capabilities:
Acquire debug privileges
Get session information
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x10028034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x134], 0
push eax
push 0x28
mov dword [ebp - 0x10c], 0
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000261b
lea eax, [ebp - 0x124]
mov dword [ebp - 0x128], 1
push eax
push str.SeDebugPrivilege
push edi
mov dword [ebp - 0x11c], 2
call esi
push edi
push edi
push 0x10
lea eax, [ebp - 0x128]
push eax
push edi
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x12c]
call ebx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x134]
push eax
push 1
push 0
push 0
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsA]
test eax, eax
je 0x1000277a
mov edx, dword [ebp - 0x10c]
xor eax, eax
test edx, edx
je 0x10002767
mov esi, dword [ebp - 0x134]
lea ecx, [esi + 8]
cmp dword [ecx], edi
je 0x10002667
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x10002656
jmp 0x1000276d
lea eax, [eax + eax*2]
mov eax, dword [esi + eax*4]
cmp eax, 0xffffffff
je 0x1000276d
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], edi
push ecx
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x12c], edi
push ecx
push 5
push eax
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x10002767
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0x100
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x130], edi
push eax
lea eax, [ebp - 0x130]
push eax
push dword [0x1002a95c]
push dword [ebp - 0x12c]
push 0
call esi
push dword [ebp - 0x130]
call fcn.1000bea4
add esp, 4
mov dword [0x1002a95c], eax
test eax, eax
je 0x1000275b
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x130]
push ecx
push eax
push dword [ebp - 0x12c]
push 0
call esi
test eax, eax
je 0x10002747
push dword [ebp - 0x114]
push dword [ebp - 0x12c]
push 0x1002a960
call fcn.100064b0
add esp, 0xc
mov edi, 1
jmp 0x1000275b
push dword [0x1002a95c]
call fcn.1000bd02
add esp, 4
mov dword [0x1002a95c], edi
push dword [ebp - 0x12c]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov esi, dword [ebp - 0x134]
push esi
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [ebp - 0x130]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100027e1
lea eax, [ebp - 0x124]
mov dword [ebp - 0x128], 1
push eax
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x11c], 0
call esi
push 0
push 0
push 0x10
lea eax, [ebp - 0x128]
push eax
push 0
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x130]
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004b9a
mov esp, ebp
pop ebp
ret