Function at 0x413310
Capabilities:
Acquire debug privileges
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x5d7ce0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push 0x44
lea ecx, [ebp - 0x280]
push edi
push ecx
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], edi
call fcn.00550f40
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
xor eax, eax
push str.SeDebugPrivilege
push edi
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x20c], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x224]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, dword [ebp - 0x224]
push edi
push edi
push 0x10
lea ecx, [ebp - 0x218]
push ecx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
push ecx
push edx
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x4133fc
push str.CreateProcessInSession_failed_to_get_a_valid_user_token_
jmp 0x41350d
mov esi, dword [ebp - 0x21c]
cmp esi, edi
je 0x413508
cmp esi, 0xffffffff
je 0x413508
push 0x1fe
lea ecx, [ebp - 0x206]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x208], ax
call fcn.00550f40
lea edx, [ebp - 0x208]
add esp, 0xc
push edx
mov ecx, esi
call fcn.0044b550
add esp, 4
test eax, eax
jne 0x413450
push str.CreateProcessInSession_failed__GetTokenUserName_Error.
jmp 0x41350d
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x413460
sub eax, edx
sar eax, 1
cmp eax, edi
je 0x413501
mov edx, str.system
lea ecx, [ebp - 0x208]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4134a8
cmp ax, di
je 0x4134a4
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4134a8
add ecx, 4
add edx, 4
cmp ax, di
jne 0x413482
xor eax, eax
jmp 0x4134ad
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x413501
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x280]
push ecx
push edi
push edi
push 0x30
push edi
push edi
push edi
push edx
push ebx
push eax
mov dword [ebp - 0x280], 0x44
mov dword [ebp - 0x278], str.WinSta0Default
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x413513
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x220], ecx
jmp 0x413513
push str.CreateProcessInSession_failed__Wrong_user_name.
jmp 0x41350d
push str.CreateProcessInSession_failed_to_get_a_valid_token_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x234]
cmp eax, edi
je 0x413524
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x21c]
cmp eax, edi
je 0x413535
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
pop edi
xor ecx, ebp
pop esi
call fcn.0054bd91
mov esp, ebp
pop ebp
ret 8