Function at 0x401a10
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
sub esp, 0x150
mov eax, dword [0x41713c]
xor eax, esp
mov dword [esp + 0x14c], eax
mov eax, dword [esp + 0x154]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSGetActiveConsoleSessionId
push str.kernel32.dll
mov dword [esp + 0x28], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.WTSQueryUserToken
push str.Wtsapi32.dll
mov esi, eax
call edi
push eax
call ebx
mov ebp, eax
test esi, esi
jne 0x401a6c
xor eax, eax
jmp 0x401d63
test ebp, ebp
je 0x401a65
call esi
mov edi, eax
push edi
mov ebx, str.explorer.exe
call fcn.00401940
xor ecx, ecx
push 0x62
push ecx
lea edx, [esp + 0x9e]
push edx
mov esi, eax
mov word [esp + 0xa0], cx
call fcn.00404110
push esi
lea eax, [esp + 0xa4]
push str.FindSessionPid1:__d
push eax
call fcn.00403a98
add esp, 0x1c
test esi, esi
jne 0x401afa
push edi
mov ebx, str.winlogon.exe
call fcn.00401940
xor ecx, ecx
push 0x62
push ecx
lea edx, [esp + 0x9e]
push edx
mov esi, eax
mov word [esp + 0xa0], cx
call fcn.00404110
push esi
lea eax, [esp + 0xa4]
push str.FindSessionPid1:__d
push eax
call fcn.00403a98
add esp, 0x1c
test esi, esi
je 0x401a65
push 0x44
lea ecx, [esp + 0x4c]
push 0
push ecx
mov ebx, 0x30
call fcn.00404110
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x24]
push edx
push edi
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x58], str.winsta0default
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x34], eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401ba7
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
push 0xf00ff
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401bb3
xor ecx, ecx
push 0xc6
push ecx
lea edx, [esp + 0x9a]
push edx
mov word [esp + 0x9c], cx
call fcn.00404110
add esp, 0xc
call edi
push eax
lea eax, [esp + 0x94]
push str.Process_token_open_Error:__u_n
push eax
call fcn.00403a98
add esp, 0xc
jmp 0x401bb3
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push 0x13
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x401bdd
mov edx, dword [esp + 0x28]
mov dword [esp + 0x18], edx
jmp 0x401c80
lea eax, [esp + 0x40]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x401c2b
xor ecx, ecx
push 0xc6
push ecx
lea edx, [esp + 0x9a]
push edx
mov word [esp + 0x9c], cx
call fcn.00404110
add esp, 0xc
call edi
push eax
lea eax, [esp + 0x94]
push str.Lookup_Privilege_value_Error:__u_n
push eax
call fcn.00403a98
add esp, 0xc
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push 1
push 1
push 0
push 0x2000000
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x401c80
push 0xc6
push eax
lea ecx, [esp + 0x9a]
push ecx
mov word [esp + 0x9c], ax
call fcn.00404110
add esp, 0xc
call edi
push eax
lea edx, [esp + 0x94]
push str.DuplicateTokenEx_Error:__u_n
push edx
call fcn.00403a98
add esp, 0xc
mov eax, dword [esp + 0x18]
push 1
push eax
lea ecx, [esp + 0x1c]
xor esi, esi
push ecx
mov dword [esp + 0x20], esi
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x401ca2
mov ebx, 0x430
jmp 0x401ca6
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x20]
push esi
push ecx
push ebx
push esi
push esi
push esi
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
call edi
cmp ebx, esi
jne 0x401d0f
cmp eax, esi
je 0x401d0f
push 0xc6
lea edx, [esp + 0x96]
xor ecx, ecx
push esi
push edx
mov word [esp + 0x9c], cx
call fcn.00404110
add esp, 0xc
call edi
push eax
lea eax, [esp + 0x94]
push str.CreateProcessAsUser_Error:__u_n
push eax
call fcn.00403a98
add esp, 0xc
mov eax, dword [esp + 0x30]
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401d20
push eax
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x401d2b
push eax
call esi
test ebp, ebp
je 0x401d32
push ebp
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x401d3d
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401d48
push eax
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401d53
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401d61
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, ebx
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040360f
add esp, 0x150
ret