Function at 0x411d90
Capabilities:
Acquire debug privileges
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a494d
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.RECSLP202302151625mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x7c], esi
call ebx
cmp eax, 0xb7
jne 0x411e03
test esi, esi
je 0x411de9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push eax
push str.RunEntryByLoginService
push str._s:CreateMutex___alreadly_run:_d
call fcn.00401760
add esp, 0xc
jmp 0x412633
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
sub esp, 8
call esi
mov edx, str.SeDebugPrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x411e3a
push str.SeDebugPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call fcn.00401760
add esp, 0xc
jmp 0x411e54
call ebx
push eax
push str.SeDebugPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call fcn.00401760
add esp, 0x10
sub esp, 8
call esi
mov edx, str.SeTcbPrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x411e85
push str.SeTcbPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call fcn.00401760
add esp, 0xc
jmp 0x411e9f
call ebx
push eax
push str.SeTcbPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call fcn.00401760
add esp, 0x10
sub esp, 8
call esi
mov edx, str.SeAssignPrimaryTokenPrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x411ed0
push str.SeAssignPrimaryTokenPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call fcn.00401760
add esp, 0xc
jmp 0x411eea
call ebx
push eax
push str.SeAssignPrimaryTokenPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call fcn.00401760
add esp, 0x10
sub esp, 8
call esi
mov edx, str.SeIncreaseQuotaPrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x411f1b
push str.SeIncreaseQuotaPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call fcn.00401760
add esp, 0xc
jmp 0x411f35
call ebx
push eax
push str.SeIncreaseQuotaPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call fcn.00401760
add esp, 0x10
sub esp, 8
call esi
mov edx, str.SeImpersonatePrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x411f66
push str.SeImpersonatePrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call fcn.00401760
add esp, 0xc
jmp 0x411f80
call ebx
push eax
push str.SeImpersonatePrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call fcn.00401760
add esp, 0x10
call fcn.00412670
push str.RunEntryByLoginService
push str._s:svc_start
call fcn.00401760
xor eax, eax
mov dword [ebp - 0x28], 0
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], eax
call fcn.00417710
push eax
lea ecx, [ebp - 0x28]
call fcn.00406f00
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x412000
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411ff6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412651
push edx
push ecx
call fcn.0044235d
add esp, 8
xor edi, edi
xor esi, esi
mov dword [ebp - 0x78], esi
nop word [eax + eax]
push 0x1fffff
xorps xmm0, xmm0
lea ecx, [ebp - 0x30]
push 1
push 1
mov edx, str.explorer.exe
movlpd qword [ebp - 0x30], xmm0
call fcn.0042a060
add esp, 0xc
cmp dword [ebp - 0x2c], 0
jbe 0x412103
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
jne 0x412103
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x70], eax
call fcn.00406cb0
cmp dword [ebp - 0x70], 0
je 0x41210b
push str.explorer.exe
push str.RunEntryByLoginService
push str._s:CmFindProcess__s__success_start_1
call fcn.00401760
add esp, 0xc
mov edi, fcn.00401760
push 0x10000000
push 0
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov dword [ebp - 0x6c], eax
test eax, eax
je 0x4121d0
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x4121c1
push 0x10000000
push 0
push 0
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov esi, eax
test esi, esi
je 0x4121a1
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
test eax, eax
jne 0x4120ee
call ebx
push eax
push str.RunEntryByLoginService::_lambda_0c14a522c3fe78356010fb30b4e7ef2e_::operator___
push str._s:SetThreadDesktop___failed:_d
call fcn.00401760
add esp, 0xc
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
push dword [ebp - 0x6c]
call dword [sym.imp.USER32.dll_CloseWindowStation]
jmp 0x4121e5
lea ecx, [ebp - 0x30]
call fcn.00406cb0
push esi
push edi
push str.explorer.exe
push str.RunEntryByLoginService
push str._s:CmFindProcess__s_spendms_d_retryindex_d__failed
call fcn.00401760
add esp, 0x14
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
add edi, 0x7d0
cmp esi, 0x3e8
jb 0x412010
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.RunEntryByLoginService
push str._s:svc_exit
call fcn.00401760
mov eax, dword [ebp - 0x7c]
add esp, 8
test eax, eax
je 0x412164
push eax
call esi
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x412633
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412629
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412656
jmp 0x412629
call ebx
push eax
push str.RunEntryByLoginService::_lambda_0c14a522c3fe78356010fb30b4e7ef2e_::operator___
push str._s:OpenDesktop_default__failed:_d
call fcn.00401760
add esp, 0xc
push dword [ebp - 0x6c]
call dword [sym.imp.USER32.dll_CloseWindowStation]
jmp 0x4121e5
call ebx
push eax
push str.RunEntryByLoginService::_lambda_0c14a522c3fe78356010fb30b4e7ef2e_::operator___
push str._s:SetProcessWindowStation_winsta0__failed:_d
jmp 0x4121dd
call ebx
push eax
push str.RunEntryByLoginService::_lambda_0c14a522c3fe78356010fb30b4e7ef2e_::operator___
push str._s:OpenWindowStation_winsta0__failed:_d
call fcn.00401760
add esp, 0xc
call fcn.00412670
mov esi, dword [ebp - 0x70]
lea eax, [ebp - 0x64]
push eax
push 0xf01ff
push esi
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x64], 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x412440
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0
push eax
push 2
push 2
push 0
push 0x2000000
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x412278
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x412255
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x412290
call ebx
push eax
push dword [ebp - 0x68]
push str.CJHProcHandler::CmImpersinateLoginUserViaHandle
push str._s:ImpersonateLoggedOnUser_newtoken_08X__failed:_d
call fcn.00401760
add esp, 0x10
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x412290
call ebx
push eax
push dword [ebp - 0x64]
push str.CJHProcHandler::CmImpersinateLoginUserViaHandle
push str._s:DuplicateTokenEx_token_08X__failed:_d
call fcn.00401760
add esp, 0x10
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x6c], 0
je 0x412455
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x6c], fcn.00401620
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.004046b0
cmp dword [eax + 0x14], 8
jb 0x4122d9
mov eax, dword [eax]
push eax
push str.RunEntryByLoginService
push str._s:CmImpersinateLoginUser__s__succeed
call fcn.00401620
xor eax, eax
mov dword [ebp - 0x48], 0
add esp, 0xc
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x60]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00407400
push 0
push 0
sub esp, 0x18
lea eax, [ebp - 0x60]
mov ecx, esp
lea esi, [ebp - 0x48]
push eax
call fcn.00406fe0
xor edx, edx
mov ecx, esi
call fcn.004174f0
add esp, 0x20
mov eax, esi
cmp dword [ebp - 0x34], 8
cmovae eax, dword [ebp - 0x48]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x34], 8
lea edi, [ebp - 0x48]
mov esi, eax
cmovae edi, dword [ebp - 0x48]
call ebx
push eax
push esi
push edi
push str.RunEntryByLoginService
push str._s:ShellExecute__s_nRet_d__result:_d
call fcn.00401620
mov byte [ebp - 4], 1
add esp, 0x14
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x4123ca
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4123c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41265b
push edx
push ecx
call fcn.0044235d
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x4c]
cmp edx, 8
jb 0x412408
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4123fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412660
push edx
push ecx
call fcn.0044235d
add esp, 8
mov esi, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, str.SeDebugPrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x41246c
push str.SeDebugPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call edi
add esp, 0xc
jmp 0x412483
call ebx
push eax
push str.CJHProcHandler::CmImpersinateLoginUserViaHandle
push str._s:OpenProcessToken___failed:_d
call fcn.00401760
add esp, 0xc
call ebx
push eax
push str.RunEntryByLoginService
push str._s:CmImpersinateLoginUser___failed:_d
call fcn.00401760
add esp, 0xc
jmp 0x41240e
call ebx
push eax
push str.SeDebugPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call edi
add esp, 0x10
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, str.SeTcbPrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x4124b5
push str.SeTcbPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call edi
add esp, 0xc
jmp 0x4124cc
call ebx
push eax
push str.SeTcbPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call edi
add esp, 0x10
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, str.SeAssignPrimaryTokenPrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x4124fe
push str.SeAssignPrimaryTokenPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call edi
add esp, 0xc
jmp 0x412515
call ebx
push eax
push str.SeAssignPrimaryTokenPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call edi
add esp, 0x10
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, str.SeIncreaseQuotaPrivilege
mov ecx, eax
call fcn.00429fb0
add esp, 8
test eax, eax
je 0x412547
push str.SeIncreaseQuotaPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__succeed
call edi
add esp, 0xc
jmp 0x41255e
call ebx
push eax
push str.SeIncreaseQuotaPrivilege
push str.RunEntryByLoginService
push str._s:CmAdjustProcessPrivilege__s__failed:_d
call edi
add esp, 0x10
push esi
push dword [ebp - 0x74]
push str.explorer.exe
push str.RunEntryByLoginService
push str._s:CmFindProcess__s_pid_d_hProcessUser_08X__success_start_2
call edi
add esp, 0x14
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae edx, dword [ebp - 0x28]
push edi
push ecx
mov ecx, esi
call fcn.0042a1f0
add esp, 8
mov dword [ebp - 0x74], eax
test eax, eax
je 0x4125ba
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push str.RunEntryByLoginService
push str._s:CmCreateProcessByToken__s__success
call edi
add esp, 0xc
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4125db
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
call ebx
push eax
push esi
push str.RunEntryByLoginService
push str._s:CmCreateProcessByToken__s__failed:_d
call edi
mov esi, dword [ebp - 0x70]
add esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 0x78], 0
je 0x412148
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x412612
call ebx
push eax
push str.RunEntryByLoginService
push str._s:RevertToSelf___failed:_d
call fcn.00401760
add esp, 0xc
jmp 0x412148
push str.RunEntryByLoginService
push str._s:RevertToSelf___succeed
call fcn.00401760
add esp, 8
jmp 0x412148
push edx
push ecx
call fcn.0044235d
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
call fcn.004452a7
call fcn.004452a7
call fcn.004452a7
call fcn.004452a7
int3