Function at 0x42a1f0
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1084
call fcn.0049cd50
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1078]
push 0x44
push 0
push eax
mov dword [ebp - 0x1080], edx
mov esi, ecx
mov dword [ebp - 0x101c], 0
call fcn.00443950
add esp, 0xc
lea eax, [ebp - 0x101c]
xorps xmm0, xmm0
movups xmmword [ebp - 0x1030], xmm0
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42a5de
mov ebx, dword [ebp - 0x101c]
test ebx, ebx
je 0x42a5de
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1018], 1
push eax
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x100c], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42a2c7
push 0
push 0
push 0x10
lea eax, [ebp - 0x1018]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x42a2c7
push str.SeDebugPrivilege
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CmAdjustTokenPrivilege__s__succeed
call edi
add esp, 0xc
jmp 0x42a2de
call esi
push eax
push str.SeDebugPrivilege
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CmAdjustTokenPrivilege__s__failed:_d
call edi
add esp, 0x10
mov eax, dword [ebp - 0x101c]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x107c], eax
lea eax, [ebp - 0x1014]
push eax
push str.SeTcbPrivilege
push 0
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x100c], 2
call ebx
test eax, eax
je 0x42a34d
push 0
push 0
push 0x10
lea eax, [ebp - 0x1018]
push eax
push 0
push dword [ebp - 0x107c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x42a34d
push str.SeTcbPrivilege
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CmAdjustTokenPrivilege__s__succeed
call edi
add esp, 0xc
jmp 0x42a364
call esi
push eax
push str.SeTcbPrivilege
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CmAdjustTokenPrivilege__s__failed:_d
call edi
add esp, 0x10
mov eax, dword [ebp - 0x101c]
mov dword [ebp - 0x107c], eax
lea eax, [ebp - 0x1014]
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x100c], 2
call ebx
test eax, eax
je 0x42a3cd
push 0
push 0
push 0x10
lea eax, [ebp - 0x1018]
push eax
push 0
push dword [ebp - 0x107c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x42a3cd
push str.SeAssignPrimaryTokenPrivilege
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CmAdjustTokenPrivilege__s__succeed
call edi
add esp, 0xc
jmp 0x42a3e4
call esi
push eax
push str.SeAssignPrimaryTokenPrivilege
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CmAdjustTokenPrivilege__s__failed:_d
call edi
add esp, 0x10
mov eax, dword [ebp - 0x101c]
mov dword [ebp - 0x107c], eax
lea eax, [ebp - 0x1014]
push eax
push str.SeIncreaseQuotaPrivilege
push 0
mov dword [ebp - 0x1018], 1
mov dword [ebp - 0x100c], 2
call ebx
test eax, eax
je 0x42a44d
push 0
push 0
push 0x10
lea eax, [ebp - 0x1018]
push eax
push 0
push dword [ebp - 0x107c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x42a44d
push str.SeIncreaseQuotaPrivilege
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CmAdjustTokenPrivilege__s__succeed
call edi
add esp, 0xc
jmp 0x42a464
call esi
push eax
push str.SeIncreaseQuotaPrivilege
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CmAdjustTokenPrivilege__s__failed:_d
call edi
add esp, 0x10
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x1020], 0
push eax
push 2
push 2
push 0
push 0x2000000
push dword [ebp - 0x101c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42a5a3
mov eax, 1
mov dword [ebp - 0x1078], 0x44
push 0x1000
mov word [ebp - 0x1048], ax
lea eax, [ebp - 0x1008]
push 0
push eax
mov dword [ebp - 0x1070], str.winsta0default
mov dword [ebp - 0x104c], 1
call fcn.00443950
add esp, 0xc
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x1078]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 0x1080]
push dword [ebp - 0x1020]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x42a556
call esi
test edi, edi
je 0x42a57c
call esi
push eax
push dword [ebp - 0x1080]
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CreateProcessAsUser__s__failed:_d
call edi
add esp, 0x10
push dword [ebp - 0x1020]
call ebx
push dword [ebp - 0x101c]
call ebx
mov eax, dword [ebp - 0x1030]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42a56f
push dword [ebp - 0x1080]
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:CreateProcessAsUser__s__succeed
call edi
add esp, 0xc
mov eax, dword [ebp - 0x102c]
test eax, eax
je 0x42a57c
push eax
call ebx
push dword [ebp - 0x1020]
call ebx
push dword [ebp - 0x101c]
call ebx
mov eax, dword [ebp - 0x1030]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42a5bf
call esi
push eax
push dword [ebp - 0x101c]
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:DuplicateTokenEx_token_08X__failed:_d
call edi
add esp, 0x10
push dword [ebp - 0x101c]
call ebx
mov eax, dword [ebp - 0x1030]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test edi, edi
je 0x42a5fc
call esi
push eax
push str.CJHProcHandler::CmCreateProcessByToken
push str._s:OpenProcessToken___failed:_d
call edi
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1030]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00441dc6
mov esp, ebp
pop ebp
ret