Function at 0x40b5a0
Capabilities:
Create thread
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a34b
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x44d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x44ed4c], 0
push 0x308
setne bl
call fcn.00420ec2
add esp, 4
mov dword [ebp - 0x29c], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00413610
mov dword [ebp - 4], 0xffffffff
mov esi, eax
mov dword [0x44edec], esi
mov byte [esi + 0x21], bl
movzx ecx, byte [0x44ed64]
mov byte [esi + 0x22], cl
movzx ecx, byte [0x44ed67]
mov byte [esi + 0x23], cl
movzx ecx, byte [0x44ed68]
mov byte [esi + 0x24], cl
mov al, byte [0x44ed66]
mov byte [esi + 0x25], al
test bl, bl
je 0x40b707
mov edi, dword [0x44ed4c]
lea eax, [esi + 0x4c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
push eax
mov dword [ebp - 0x18], eax
call fcn.00420bc1
add esp, 4
mov byte [ebp - 0x14], 1
mov dword [ebp - 4], 1
lea ecx, [esi + 0x44]
mov eax, dword [ecx]
xor esi, esi
mov dword [ebp - 0x2a0], eax
mov edx, eax
mov dword [ebp - 0x29c], ecx
mov ebx, dword [eax + 4]
mov eax, ebx
cmp byte [ebx + 0xd], 0
jne 0x40b69a
mov ebx, eax
cmp dword [eax + 0x10], edi
jae 0x40b68d
mov eax, dword [eax + 8]
jmp 0x40b691
mov edx, eax
mov eax, dword [eax]
sbb esi, esi
inc esi
cmp byte [eax + 0xd], 0
je 0x40b681
cmp byte [edx + 0xd], 0
jne 0x40b6a5
cmp edi, dword [edx + 0x10]
jae 0x40b6f5
cmp dword [ecx + 4], 0xccccccc
je 0x40bb5f
mov dword [ebp - 0x2ac], ecx
mov byte [ebp - 4], 2
push 0x14
mov dword [ebp - 0x2a8], 0
call fcn.00420ec2
mov edx, dword [ebp - 0x2a0]
add esp, 4
mov ecx, dword [ebp - 0x29c]
mov dword [eax + 0x10], edi
push eax
mov dword [eax], edx
mov dword [eax + 4], edx
push esi
mov dword [eax + 8], edx
push ebx
mov word [eax + 0xc], 0
call fcn.0040f280
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
call fcn.00420bdd
add esp, 4
cmp byte [0x44ed69], 0
je 0x40b817
push 0x80
call fcn.00420ec2
mov edi, eax
add esp, 4
mov dword [ebp - 0x29c], edi
mov dword [ebp - 4], 3
mov ecx, edi
mov bl, byte [0x44ed64]
call fcn.0040b420
lea ecx, [edi + 0x24]
mov byte [edi + 0x20], bl
push 2
push ecx
call fcn.00420b66
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov byte [ebp - 4], 6
lea esi, [edi + 0x60]
mov dword [ebp - 0x2a0], esi
push 0x20
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00420ec2
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 7
lea esi, [edi + 0x68]
mov dword [ebp - 0x2a0], esi
push 0x1c
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00420ec2
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x70]
mov dword [ebp - 0x2a0], esi
push 0x1c
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00420ec2
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [0x44edf0], edi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
push dword [0x44ed48]
xor eax, eax
mov ecx, 0x44da88
cmp byte [0x44ed6e], al
push dword [0x44ed44]
setne al
sub esp, 8
inc eax
mov dword [0x44daa0], eax
call fcn.00410f90
mov esi, eax
cmp esi, 0xb7
jne 0x40b8e3
cmp byte [0x44ed78], 0
push dword [0x44ed48]
je 0x40b915
push str.warning:_a_trace_session_named___s__is_already_running_and_it_will_be_stopped._n_________Use__session_name_with_a_different_name_to_start_a_new_session._n
call fcn.00403a90
push 0x6c
lea eax, [ebp - 0x294]
push 0
push eax
call fcn.00422ca0
add esp, 0x14
lea eax, [ebp - 0x224]
push 0x20c
push 0
push eax
call fcn.00422ca0
add esp, 0xc
mov dword [ebp - 0x298], 0x280
lea eax, [ebp - 0x298]
mov dword [ebp - 0x228], 0x78
push 1
push eax
push dword [0x44ed48]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlTraceW]
mov esi, eax
test esi, esi
jne 0x40b8eb
push dword [0x44ed48]
mov ecx, 0x44da88
push dword [0x44ed44]
sub esp, 8
call fcn.00410f90
mov esi, eax
test esi, esi
je 0x40ba61
push str.error:_failed_to_start_trace_session:
call fcn.00403ab0
add esp, 4
cmp esi, 5
ja 0x40b940
je 0x40b931
mov eax, esi
sub eax, 2
je 0x40b927
sub eax, 1
jne 0x40b958
push str.path_not_found._n
jmp 0x40ba07
push str.error:_a_trace_session_named___s__is_already_running._Use__stop_existing_session_n_______to_stop_the_existing_session__or_use__session_name_with_a_different_name_to_n_______start_a_new_session._n
call fcn.00403ab0
add esp, 8
jmp 0x40ba0f
push str.file_not_found._n
jmp 0x40ba07
push str.access_denied._n
call fcn.00403ab0
add esp, 4
jmp 0x40b96f
cmp esi, 0xa1
je 0x40ba02
cmp esi, 0x570
je 0x40b9fb
push esi
push str.error_code__lu._n
call fcn.00403ab0
add esp, 8
cmp esi, 5
jne 0x40ba0f
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x22f
push 0x20
push 2
lea eax, [ebp - 0x18]
mov word [ebp - 0x14], 0x500
push eax
mov dword [ebp - 0x29c], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40b9f4
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x2a0], 0
push eax
push dword [ebp - 0x29c]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x29c]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2a0], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x2a0], 0
jne 0x40ba0f
push str._______PresentMon_requires_either_administrative_privileges_or_to_be_run_by_a_user_in_the_n________Performance_Log_Users__user_group.__View_the_readme_for_more_details._n
jmp 0x40ba07
push str.invalid___etl_file._n
jmp 0x40ba07
push str.invalid___session_name._n
call fcn.00403ab0
add esp, 4
mov ecx, dword [0x44edec]
test ecx, ecx
je 0x40ba1f
push ecx
call fcn.0040bb80
mov ecx, dword [0x44edf0]
test ecx, ecx
je 0x40ba2f
push ecx
call fcn.0040bcc0
mov dword [0x44edec], 0
xor al, al
mov dword [0x44edf0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
mov esi, dword [0x44dab8]
mov edi, dword [0x44dabc]
push 0x10
call fcn.00420ec2
add esp, 4
mov dword [ebp - 0x29c], eax
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], 0x403ad0
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 4], 9
push ecx
push 0
push eax
push 0x403b30
push 0
push 0
call fcn.0042987d
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x2a4], ecx
test ecx, ecx
je 0x40bb4e
mov dword [ebp - 4], 0xffffffff
cmp dword [0x44ed80], 0
jne 0x40bb64
mov eax, dword [ebp - 0x2a0]
push 0x44edd4
mov dword [0x44ed7c], ecx
mov dword [0x44ed80], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 4
mov byte [0x44ed9a], 0
call fcn.00420ec2
add esp, 4
mov dword [ebp - 0x29c], eax
mov dword [eax], 0x408320
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xa
push ecx
push 0
push eax
push 0x40aae0
push 0
push 0
call fcn.0042987d
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x40bb6e
cmp dword [0x44ed88], 0
jne 0x40bb69
mov eax, dword [ebp - 0x14]
mov dword [0x44ed88], eax
mov al, 1
mov dword [0x44ed84], ecx
jmp 0x40ba45
push 6
mov dword [ebp - 0x2a0], 0
call fcn.0042070f
call fcn.0040ce50
call fcn.0042990e
call fcn.0042990e
push 6
mov dword [ebp - 0x14], 0
call fcn.0042070f
int3