Function at 0x42f6e3
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push 0x318
mov eax, 0x452841
call fcn.0044fbb5
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x294], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x298], eax
call fcn.004138dc
push 4
mov ecx, eax
call fcn.0043a060
xor edi, edi
test eax, eax
je 0x42f741
call fcn.004138dc
push str.StartTAVProcess_1
push str.CTrayElevator::StartTAVProcess
push 0x28c
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push edi
push 4
push edi
push eax
call fcn.0043a200
add esp, 0x20
push edi
push 2
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x42f903
call fcn.004138dc
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42f78f
call fcn.004138dc
push str.StartTAVProcess_2
push str.CTrayElevator::StartTAVProcess
push 0x295
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push edi
push 4
push edi
push eax
call fcn.0043a200
add esp, 0x20
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42f805
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x250]
push str.explorer.exe
push eax
call dword [0x455644]
pop ecx
pop ecx
test eax, eax
jne 0x42f7eb
and dword [ebp - 0x280], ebx
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x42f7eb
cmp dword [ebp - 0x280], edi
je 0x42f7ff
lea eax, [ebp - 0x274]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42f7ae
jmp 0x42f805
mov ebx, dword [ebp - 0x26c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
call fcn.004138dc
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42f84a
call fcn.004138dc
push str.StartTAVProcess_3
push str.CTrayElevator::StartTAVProcess
push 0x2a4
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
xor esi, esi
push esi
push 4
push esi
push eax
call fcn.0043a200
add esp, 0x20
jmp 0x42f84c
xor esi, esi
test ebx, ebx
je 0x42f903
call fcn.004138dc
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42f88c
call fcn.004138dc
push str.StartTAVProcess_4
push str.CTrayElevator::StartTAVProcess
push 0x2a9
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push esi
push 4
push esi
push eax
call fcn.0043a200
add esp, 0x20
push ebx
push esi
push 0x400
mov dword [ebp - 0x28c], esi
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x278], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x42f903
call fcn.004138dc
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42f8e9
call fcn.004138dc
push str.StartTAVProcess_5
push str.CTrayElevator::StartTAVProcess
push 0x2b4
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push esi
push 4
push esi
push eax
call fcn.0043a200
add esp, 0x20
lea eax, [ebp - 0x27c]
push eax
push 0xf00ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42f90b
push ebx
call edi
xor eax, eax
call fcn.0044fb73
ret
call fcn.004138dc
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42f943
call fcn.004138dc
push str.StartTAVProcess_6
push str.CTrayElevator::StartTAVProcess
push 0x2b9
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push esi
push 4
push esi
push eax
call fcn.0043a200
add esp, 0x20
lea eax, [ebp - 0x28c]
push eax
push 4
lea eax, [ebp - 0x278]
push eax
push 0x13
push dword [ebp - 0x27c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x278]
mov esi, 0x2000000
test eax, eax
jne 0x42f9a4
lea eax, [ebp - 0x284]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x278]
push eax
push 1
push 1
push 0
push esi
push dword [ebp - 0x27c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov eax, dword [ebp - 0x278]
and dword [ebp - 0x288], 0
push 1
push eax
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov edx, dword [ebp - 0x290]
test eax, eax
mov ecx, 0x2000400
cmovne esi, ecx
mov ecx, str._null_
mov eax, ecx
mov dword [ebp - 0x280], esi
test edx, edx
push 7
cmovne eax, edx
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x294]
test eax, eax
pop esi
cmovne ecx, eax
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x2cc], ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c4], esi
call fcn.00412dfa
and dword [ebp - 4], 0
mov dword [ebp - 0x2d4], esi
cmp dword [eax + 0x14], 8
jb 0x42fa1d
mov eax, dword [eax]
sub esp, 0x18
mov dword [ebp - 0x2dc], eax
lea eax, [ebp - 0x2bc]
mov edx, str._01__2
lea ecx, [ebp - 0x2c]
push 0x47fd18
push eax
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x2dc]
push eax
call fcn.0044a880
add esp, 0x28
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004023ee
mov eax, dword [ebp - 0x298]
test eax, eax
je 0x42fa6f
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ee9d
mov esi, dword [0x4554f0]
lea eax, [ebp - 0x324]
push 0x44
push 0
push eax
call esi
add esp, 0xc
mov dword [ebp - 0x324], 0x44
xor eax, eax
mov dword [ebp - 0x2f8], 0x81
mov word [ebp - 0x2f4], ax
push 0x10
push eax
lea eax, [ebp - 0x2a8]
push eax
call esi
add esp, 0xc
call fcn.004138dc
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42faed
call fcn.004138dc
push str.StartTAVProcess_7
push str.CTrayElevator::StartTAVProcess
push 0x2dc
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
xor esi, esi
push esi
push 4
push esi
push eax
call fcn.0043a200
add esp, 0x20
jmp 0x42faef
xor esi, esi
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2a8]
push ecx
lea ecx, [ebp - 0x324]
push ecx
push esi
push dword [ebp - 0x288]
lea eax, [ebp - 0x2c]
push dword [ebp - 0x280]
cmovae eax, dword [ebp - 0x2c]
push esi
push esi
push esi
push eax
push esi
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov dword [ebp - 0x280], esi
call fcn.004138dc
push 4
mov ecx, eax
call fcn.0043a060
test eax, eax
je 0x42fb7d
call fcn.004138dc
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x280]
push str.StartTAVProcess_bResult_d__GetLastError_u
push str.CTrayElevator::StartTAVProcess
push 0x2e9
push str.D:qci_workspace_root_workspaces__qci_pipeline_10989745_2FTHardwareQMPublicExeQMServiceTrayElevator.cpp
push 0
push 4
push 0
push esi
call fcn.0043a200
mov esi, dword [ebp - 0x280]
add esp, 0x28
cmp dword [ebp - 0x278], 0
je 0x42fb8e
push dword [ebp - 0x278]
call edi
push ebx
call edi
cmp dword [ebp - 0x27c], 0
je 0x42fba2
push dword [ebp - 0x27c]
call edi
cmp dword [ebp - 0x2a8], 0
je 0x42fbb3
push dword [ebp - 0x2a8]
call edi
cmp dword [ebp - 0x2a4], 0
je 0x42fbc4
push dword [ebp - 0x2a4]
call edi
lea ecx, [ebp - 0x2c]
call fcn.004023ee
mov eax, esi
jmp 0x42f905