Function at 0x401000
Capabilities:
Acquire debug privileges

Disassembly:
push 0x3c
push 0
push 0x405978
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x40597c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x405978], eax
call fcn.00402c20
call fcn.004027f8
call fcn.00402690
call fcn.00402441
mov edx, dword [0x4059bc]
push edx
push edx
call fcn.00402933
pop dword [0x4059bc]
mov dword [0x4059ac], 0
mov dword [0x4059a8], 0
mov edx, dword [0x4059bc]
push edx
push edx
call fcn.00402637
push 0x405984
call fcn.00402ca0
mov edx, dword [0x4059bc]
push edx
push edx
push dword [0x405984]
call fcn.00402120
add dword [0x4059bc], 2
mov edx, 0x405026
pop ecx
mov dword [0x4059bc], ecx
add ecx, dword [0x40543c]
call fcn.00402080
je 0x4010f1
mov edx, dword [0x4059bc]
push edx
push edx
call fcn.00402637
push 0x405984
call fcn.00402ca0
mov dword [0x4059ac], 1
mov dword [0x4059a8], 1
jmp 0x40114f
mov edx, dword [0x4059bc]
push edx
push edx
push dword [0x405984]
call fcn.00402120
add dword [0x4059bc], 2
mov edx, 0x40502c
pop ecx
mov dword [0x4059bc], ecx
add ecx, dword [0x40543c]
call fcn.00402080
je 0x40114f
mov edx, dword [0x4059bc]
push edx
push edx
call fcn.00402637
push 0x405984
call fcn.00402ca0
mov dword [0x4059ac], 2
mov dword [0x4059a8], 1
mov edx, dword [0x405984]
push dword [0x4059bc]
push edx
call fcn.00402d20
push 0x405998
call fcn.00402ca0
push dword [0x405998]
mov edx, 0x405024
pop ecx
call fcn.00402080
je 0x40118e
mov edx, str.cmd.exe
lea ecx, [0x405998]
call fcn.00402008
mov edx, 0x405024
lea ecx, [0x405994]
call fcn.00402008
mov ebx, dword [0x4059a8]
inc ebx
mov dword [0x40598c], ebx
jmp 0x4011ad
call fcn.004025d5
mov ebx, eax
dec ebx
cmp ebx, dword [0x40598c]
jl 0x4012b7
mov edx, dword [0x4059bc]
push edx
push edx
push dword [0x40598c]
call fcn.004025e9
push 0x405984
call fcn.00402ca0
mov eax, 0x40504c
push eax
push dword [0x405984]
call fcn.00402230
mov ebx, eax
and ebx, ebx
jg 0x40120a
push dword [0x405984]
mov edx, 0x405024
pop ecx
call fcn.00402080
jne 0x40120a
jmp 0x401211
mov eax, 1
jmp 0x401213
xor eax, eax
and eax, eax
je 0x401249
push dword [0x4059bc]
mov edx, 0x405050
push edx
call fcn.00402d20
mov edx, dword [0x405984]
push edx
call fcn.00402d20
mov edx, 0x405050
push edx
call fcn.00402d20
push 0x405984
call fcn.00402ca0
push dword [0x405994]
mov edx, 0x405024
pop ecx
call fcn.00402080
jne 0x401283
mov edx, dword [0x405994]
push dword [0x4059bc]
push edx
call fcn.00402d20
mov edx, 0x40504c
push edx
call fcn.00402d20
push 0x405994
call fcn.00402ca0
mov edx, dword [0x405994]
push dword [0x4059bc]
push edx
call fcn.00402d20
mov edx, dword [0x405984]
push edx
call fcn.00402d20
push 0x405994
call fcn.00402ca0
inc dword [0x40598c]
jno 0x4011ad
mov eax, str.SeDebugPrivilege
push eax
call fcn.0040146c
mov eax, str.SeAssignPrimaryTokenPrivilege
push eax
call fcn.0040146c
mov eax, str.SeIncreaseQuotaPrivilege
push eax
call fcn.0040146c
call sub.KERNEL32.dll_WTSGetActiveConsoleSessionId
mov dword [0x4059a4], eax
push dword [0x4059ac]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4013d0
mov edx, dword [0x4059bc]
push edx
push edx
push 0x200
call fcn.00402250
push 0x4059b0
call fcn.00402ca0
push 0x200
mov eax, dword [0x4059b0]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
mov eax, 0x40504c
push eax
push dword [0x405998]
call fcn.00402230
mov ebx, eax
and ebx, ebx
jle 0x40136d
push dword [0x4059bc]
mov edx, 0x405050
push edx
call fcn.00402d20
mov edx, dword [0x405998]
push edx
call fcn.00402d20
mov edx, 0x405050
push edx
call fcn.00402d20
push 0x405998
call fcn.00402ca0
push dword [0x4059bc]
mov edx, str._t__t
push edx
call fcn.00402d20
mov edx, dword [0x405998]
push edx
call fcn.00402d20
mov edx, 0x40504c
push edx
call fcn.00402d20
mov edx, dword [0x405994]
push edx
call fcn.00402d20
push 0x405994
call fcn.00402ca0
push dword [0x4059a4]
mov eax, str.winlogon.exe
push eax
mov eax, str.SystemIntegrityLevel
push eax
push dword [0x405994]
push dword [0x4059b0]
call fcn.00401550
jmp 0x401437
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4013ff
push dword [0x4059a4]
mov eax, str.winlogon.exe
push eax
mov eax, str.SystemIntegrityLevel
push eax
push dword [0x405994]
push dword [0x405998]
call fcn.00401550
jmp 0x401437
mov ebx, 2
cmp ebx, dword [esp]
jne 0x401437
mov eax, str.trustedinstaller
push eax
call fcn.004019fe
push dword [0x4059a4]
mov eax, str.trustedinstaller.exe
push eax
mov eax, str.SystemIntegrityLevel
push eax
push dword [0x405994]
push dword [0x405998]
call fcn.00401550
pop eax
push 0
call 0x401457
call fcn.00402c70
push dword [0x405978]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004027ec
call fcn.00402978
call fcn.00402988
call fcn.00402680
ret