Function at 0x1000d200
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
sub esp, 0x13c
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x150]
push edi
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, al
lea ecx, [esp + 0x24]
shl esi, 0xc
push ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x158], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x150]
je 0x1000d4db
cmp dword [esp + 0x24], ebx
jne 0x1000d4db
push 0xff
lea edx, [esp + 0x45]
push edi
push edx
mov byte [esp + 0x4c], 0
call fcn.1001f410
add esp, 0xc
push ebx
push str.Get_Session__d_token_by_CurrentProcess
push 0x1e5
push str..Cutil_Process.c
push 2
mov ecx, str.cutil_process_get_token_by_session
mov dword [esp + 0x2c], edi
call fcn.1000be40
add esp, 0x14
push ebx
push str.Get_Session__d_token_by_CurrentProcess
push 0x1e5
push str..Cutil_Process.c
push 2
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 0xf01ff
call ebp
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000d337
call esi
push eax
push str.GetCurrentToken_failed__d
push 0x1e9
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.GetCurrentToken_failed__d
push 0x1e9
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
jmp 0x1000d4db
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push 1
push 2
push edi
push 0x2000000
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1000d3a7
call esi
push eax
push 0x1002ede0
push 0x1ef
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push 0x1002ede0
push 0x1ef
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
mov eax, dword [esp + 0x28]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d4db
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push 0x100
lea edx, [esp + 0x48]
push edx
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000d485
mov ecx, dword [esp + 0x40]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov eax, dword [eax]
mov ecx, dword [esp + 0x154]
cmp eax, ecx
jne 0x1000d3f8
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
jmp 0x1000dac1
jbe 0x1000d4c7
add eax, 0xfffff000
cmp eax, 0x2000
ja 0x1000d4c7
lea eax, [esp + 0x34]
mov dword [esp + 0x3c], ecx
mov ecx, eax
mov dword [esp + 0x2c], edi
push ecx
mov byte [esp + 0x38], 1
mov byte [esp + 0x39], 1
mov byte [esp + 0x3a], 0
mov byte [esp + 0x3b], 0
mov byte [esp + 0x3c], 0
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3f], 0x10
mov dword [esp + 0x30], 0x20
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x2c]
push edx
push 0x19
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x1000d4c7
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
jmp 0x1000dac1
call esi
push eax
push str.GetTokenInformation_TokenSessionId_failed___d
push 0x211
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.GetTokenInformation_TokenSessionId_failed___d
push 0x211
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
mov edx, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call edi
push ebx
push str.Get_Session__d_token_by_SystemHandleInformation
push 0x21e
push str..Cutil_Process.c
push 2
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
push ebx
push str.Get_Session__d_token_by_SystemHandleInformation
push 0x21e
push str..Cutil_Process.c
push 2
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
push 8
call ebp
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000d574
call esi
push eax
push str.GetCurrentToken_failed__d
push 0x223
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.GetCurrentToken_failed__d
push 0x223
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
jmp 0x1000d852
push str.SeDebugPrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov eax, 1
call fcn.1000cb10
add esp, 4
cmp dword [esp + 0x30], 6
jae 0x1000d6ed
push 0x10
call fcn.10012370
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000d5fb
call esi
push eax
push str.Get_SystemExtendedHandleInformation_failed__d
push 0x230
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.Get_SystemExtendedHandleInformation_failed__d
push 0x230
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
mov edx, dword [esp + 0x28]
add esp, 0x14
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d852
xor ebp, ebp
cmp dword [edi], ebp
jbe 0x1000d642
lea ebx, [edi + 0xa]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp word [ebx - 6], ax
jne 0x1000d61a
mov ax, word [ebx]
cmp ax, word [esp + 0x14]
je 0x1000d626
add ebp, 1
add ebx, 0x10
cmp ebp, dword [edi]
jb 0x1000d604
jmp 0x1000d63b
shl ebp, 4
movzx cx, byte [edi + ebp + 8]
movzx eax, cx
test ax, ax
mov dword [esp + 0x18], eax
jne 0x1000d69d
mov ebx, dword [esp + 0x150]
call esi
push eax
push str.HandleType__0___d
push 0x240
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.HandleType__0___d
push 0x240
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
push edi
call fcn.100186a9
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d852
xor ebx, ebx
cmp dword [edi], ebx
jbe 0x1000d6e7
lea ebp, [edi + 0xa]
movzx cx, byte [ebp - 2]
cmp cx, ax
jne 0x1000d6dd
mov edx, dword [esp + 0x154]
movzx ecx, word [ebp]
mov eax, dword [esp + 0x150]
push edx
push eax
push ecx
movzx ecx, word [ebp - 6]
call fcn.1000dae0
add esp, 0xc
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x1000d6e7
mov eax, dword [esp + 0x18]
add ebx, 1
add ebp, 0x10
cmp ebx, dword [edi]
jb 0x1000d6a6
push edi
jmp 0x1000d82c
push 0x40
call fcn.10012370
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x1000d74f
call esi
push eax
push str.Get_SystemExtendedHandleInformation_failed__d
push 0x259
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.Get_SystemExtendedHandleInformation_failed__d
push 0x259
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
mov edx, dword [esp + 0x28]
add esp, 0x14
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d852
xor edi, edi
cmp dword [ebp], edi
jbe 0x1000d79e
lea ebx, [ebp + 0x10]
lea esp, [esp]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebx - 4], eax
jne 0x1000d773
mov eax, dword [ebx]
cmp eax, dword [esp + 0x14]
je 0x1000d780
add edi, 1
add ebx, 0x1c
cmp edi, dword [ebp]
jb 0x1000d760
jmp 0x1000d797
lea ecx, [edi*8]
sub ecx, edi
movzx eax, word [ebp + ecx*4 + 0x1a]
test ax, ax
mov dword [esp + 0x18], eax
jne 0x1000d7e6
mov ebx, dword [esp + 0x150]
call esi
push eax
push str.HandleType__0___d
push 0x269
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.HandleType__0___d
push 0x269
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
push ebp
jmp 0x1000d685
xor ebx, ebx
cmp dword [ebp], ebx
jbe 0x1000d82b
lea edi, [ebp + 0x10]
cmp word [edi + 0xa], ax
jne 0x1000d820
mov eax, dword [esp + 0x154]
mov ecx, dword [esp + 0x150]
mov edx, dword [edi]
push eax
push ecx
mov ecx, dword [edi - 4]
push edx
call fcn.1000dae0
add esp, 0xc
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x1000d82b
mov eax, dword [esp + 0x18]
add ebx, 1
add edi, 0x1c
cmp ebx, dword [ebp]
jb 0x1000d7f0
push ebp
call fcn.100186a9
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x1000dac1
mov ebx, dword [esp + 0x150]
push ebx
push str.Get_Session__d_token_by_Explorer_LSASS
push 0x28b
push str..Cutil_Process.c
push 2
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
push ebx
push str.Get_Session__d_token_by_Explorer_LSASS
push 0x28b
push str..Cutil_Process.c
push 2
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
cmp dword [esp + 0x154], 0x4000
jne 0x1000d8a9
mov edi, str.LSASS.exe
call fcn.1000d060
jmp 0x1000d8b7
push ebx
mov edi, str.Explorer.exe
call fcn.1000d120
add esp, 4
mov edi, eax
xor ebp, ebp
cmp edi, ebp
je 0x1000d938
push str.SeRestorePrivilege
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea eax, [ebp + 1]
call fcn.1000cb10
add esp, 4
push edi
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebp
jne 0x1000d9d6
call esi
push eax
push str.OpenProcess_failed__d
push 0x2a0
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.OpenProcess_failed__d
push 0x2a0
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
push ebx
push str.Get_Session__d_token_by_WTSQueryUserToken
push 0x2bf
push str..Cutil_Process.c
push 2
mov ecx, str.cutil_process_get_token_by_session
mov dword [esp + 0x30], ebp
call fcn.1000be40
add esp, 0x14
push ebx
push str.Get_Session__d_token_by_WTSQueryUserToken
push 0x2bf
push str..Cutil_Process.c
push 2
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
lea eax, [esp + 0x1c]
push eax
push ebx
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x1000dabd
call esi
push eax
push str.WTSQueryUserToken_failed__d
push 0x2c3
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.WTSQueryUserToken_failed__d
push 0x2c3
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
xor eax, eax
jmp 0x1000dac1
lea ecx, [esp + 0x18]
push ecx
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000da36
call esi
push eax
push str.Get_Process_Token_failed__d
push 0x2a6
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.Get_Process_Token_failed__d
push 0x2a6
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d938
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 1
push 2
push ebp
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1000daad
call esi
push eax
push 0x1002ede0
push 0x2ad
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000be40
add esp, 0x14
call esi
push eax
push 0x1002ede0
push 0x2ad
push str..Cutil_Process.c
push 1
mov ecx, str.cutil_process_get_token_by_session
call fcn.1000bb50
mov ecx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
push ecx
call ebp
push edi
call ebp
xor ebp, ebp
jmp 0x1000d938
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
push edi
call esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x13c
ret