Function at 0x408b30
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x2b0
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
mov dword [esp + 0x24], ebp
mov dword [esp + 0x38], ebp
xor edi, edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x408b6a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea eax, [esp + 0x94]
mov dword [esp + 0x94], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x408bd8
mov ebx, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea ecx, [esp + 0xb8]
push 0x420b00
push ecx
call sub.MSVCRT.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x408bbd
mov eax, dword [esp + 0x9c]
lea edx, [esp + 0x48]
push edx
push eax
mov dword [esp + 0x50], ebp
call ebx
test eax, eax
jne 0x408bd1
lea ecx, [esp + 0x94]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x408bd8
jmp 0x408b8d
mov edi, dword [esp + 0x9c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
cmp edi, ebp
jne 0x408bf2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
push edi
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x44], esi
jne 0x408c16
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea edx, [esp + 0x14]
push edx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408c3b
push esi
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
mov eax, dword [esp + 0x14]
cmp eax, ebp
jne 0x408c50
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea ecx, [esp + 0x30]
lea edx, [esp + 0x2c]
push ecx
push 4
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x408c73
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
jmp 0x408c9e
lea ecx, [esp + 0x48]
push ecx
push str.SeDebugPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push ebp
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.Userenv.dll
mov dword [esp + 0x1c], ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebp
jne 0x408cc2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
jne 0x408ce6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
mov ecx, dword [esp + 0x10]
push 1
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
test eax, eax
je 0x408cfd
mov ebx, 0x400
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x50]
lea edx, [esp + 0x50]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push ebp
push eax
mov eax, dword [esp + 0x2d8]
push ebx
lea ecx, [esp + 0x34]
push ebp
lea edx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
mov esi, 1
push ebp
push ecx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x7c], 0x44
mov dword [esp + 0x4c], 0xc
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x408d94
mov eax, dword [esp + 0x2cc]
cmp eax, ebp
jbe 0x408d9a
mov edx, dword [esp + 0x34]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x408d9a
mov dword [esp + 0x1c], esi
jmp 0x408d9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x34]
cmp eax, ebp
je 0x408dad
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
jmp 0x408db3
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x408dbe
push eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x408dc9
push eax
call esi
mov eax, dword [esp + 0x44]
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x408ddb
push eax
call esi
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b0
ret