Function at 0x40a4f0
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x2a0
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push 2
mov dword [esp + 0x3c], ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a526
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea eax, [esp + 0x84]
mov dword [esp + 0x84], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40a594
mov ebp, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea ecx, [esp + 0xa8]
push 0x42181c
push ecx
call sub.MSVCRT.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x40a579
mov eax, dword [esp + 0x8c]
lea edx, [esp + 0x38]
push edx
push eax
mov dword [esp + 0x40], ebx
call ebp
test eax, eax
jne 0x40a58d
lea ecx, [esp + 0x84]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40a594
jmp 0x40a549
mov edi, dword [esp + 0x8c]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
cmp edi, ebx
jne 0x40a5ae
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
push edi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x20], esi
jne 0x40a5d2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea edx, [esp + 0x14]
push edx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a5f7
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x40a60c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push 4
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40a62f
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
jmp 0x40a65a
lea ecx, [esp + 0x38]
push ecx
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push ebx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.Userenv.dll
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x40a67a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40a69e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov ecx, dword [esp + 0x10]
push 1
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
test eax, eax
je 0x40a6b5
mov ebx, 0x400
mov edx, dword [esp + 0x18]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x40]
xor esi, esi
push eax
mov eax, dword [esp + 0x2bc]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push edx
push ebx
push esi
push esi
push esi
push eax
push esi
push ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40a71f
mov eax, dword [esp + 0x2bc]
cmp eax, esi
jbe 0x40a71f
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x40a72a
push eax
call ebp
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x40a735
push eax
call ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x40a740
push eax
call ebp
mov eax, dword [esp + 0x20]
push eax
call ebp
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40a752
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2a0
ret