Function at 0x405cf0
Capabilities:
Acquire debug privileges
Allocate thread local storage
Enumerate processes
Get common file path
Query environment variable
Set environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x53a760], 0
jne 0x4061c6
push esi
push str.Wow64EnableWow64FsRedirection
push 1
push str.Kernel32.dll
mov byte [0x53a760], 1
call fcn.0042f970
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 8
push eax
call esi
push str.Wow64DisableWow64FsRedirection
push 1
push str.Kernel32.dll
mov dword [0x539fdc], eax
call fcn.0042f970
add esp, 8
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push 1
push str.Kernel32.dll
mov dword [0x53a3f0], eax
call fcn.0042f970
add esp, 8
push eax
call esi
push str.RegDeleteKeyExW
push 1
push str.advapi32.dll
mov dword [0x53a3f4], eax
call fcn.0042f970
add esp, 8
push eax
call esi
mov dword [0x539fb0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
push 0
mov dword [0x539fd0], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x104
push 0x539720
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ecx, ecx
movzx eax, word [ecx + 0x539720]
lea ecx, [ecx + 2]
mov word [ecx + 0x539fde], ax
test ax, ax
jne 0x405db4
mov ecx, 0x539fe0
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x405dd2
mov eax, dword [str.System32]
mov dword [ecx], eax
mov eax, dword [0x4fa28c]
mov dword [ecx + 4], eax
mov eax, dword [0x4fa290]
mov dword [ecx + 8], eax
mov eax, dword [0x4fa294]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4fa298]
push 0x104
push 0x53a1e8
mov dword [ecx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x405e36
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ecx + 0x539fe0]
lea ecx, [ecx + 2]
mov word [ecx + 0x53a1e6], ax
test ax, ax
jne 0x405e20
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
push 0x539928
push str._ProgramW6432_
call esi
mov ecx, 0x539928
mov eax, str._ProgramW6432_
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405e7d
test dx, dx
je 0x405e79
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405e7d
add eax, 4
add ecx, 4
test dx, dx
jne 0x405e57
xor eax, eax
jmp 0x405e82
sbb eax, eax
or eax, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x405eaa
push 0x104
push 0x539928
push str._ProgramFiles_
call esi
push 0x539928
push str.ProgramW6432
call edi
push 0x104
push 0x539b30
push str._PROGRAMFILES_X86__
call esi
push str.__x86_
push 0x539928
call fcn.004c580a
add esp, 8
test eax, eax
je 0x405ef4
push str.__x86_
push 0x539928
call fcn.004c580a
add esp, 8
xor ecx, ecx
mov word [eax], cx
push 0x539928
push str.PROGRAMFILES_X86_
call edi
push 0x104
push 0x539d38
push str._programdata_
call esi
test eax, eax
jne 0x405f3d
push 0x104
push 0x539d38
push str._allusersprofile_
call esi
test eax, eax
jne 0x405f3d
movzx eax, word [0x539720]
push eax
push str._c:programdata_
push 0x104
push 0x539d38
call fcn.00404780
add esp, 0x10
push ebx
push 0xffffffffffffffff
push str.MicrosoftWindows_Defender_
push 0x104
push 0x539d38
call fcn.004c9286
lea eax, [ebp - 0x234]
push str._PATH_
push eax
call fcn.00414b20
mov esi, dword [0x53a400]
mov edi, 0x4f9d20
mov ecx, dword [eax]
test ecx, ecx
mov eax, edi
cmovne eax, ecx
push eax
call fcn.004c8d00
push esi
mov dword [0x53a400], eax
call fcn.004c8d5f
push dword [ebp - 0x234]
call fcn.004c8d5f
mov eax, dword [0x53a400]
test eax, eax
mov esi, dword [0x53a404]
cmovne edi, eax
push edi
call fcn.004c8d00
push esi
mov dword [0x53a404], eax
call fcn.004c8d5f
mov edi, dword [0x53a404]
add esp, 0x2c
cmp word [edi], 0
je 0x40604e
mov ebx, 0x3b
nop
push 0x3b
push edi
call fcn.004c56b8
mov esi, eax
add esp, 8
test esi, esi
je 0x405fe6
xor eax, eax
mov word [esi], ax
mov ecx, 0x539fe0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405ff0
sub ecx, edx
sar ecx, 1
push ecx
push 0x539fe0
push edi
call fcn.004c95b0
add esp, 0xc
test eax, eax
jne 0x40603e
mov ecx, 0x53a1e8
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406020
sub ecx, edx
sar ecx, 1
push ecx
push 0x53a1e8
push edi
call fcn.004c93a4
add esp, 0xc
test esi, esi
je 0x40604e
lea edi, [esi + 2]
mov word [esi], bx
cmp word [edi], 0
jne 0x405fd0
push 0x539fb4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push str.SeDebugPrivilege
call fcn.004061e0
add esp, 4
test eax, eax
je 0x4061c3
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x4061c3
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4061c0
lea esi, [ebp - 0x20c]
mov eax, esi
push 0x5c
push eax
call fcn.004c5767
add esp, 8
test eax, eax
je 0x4060d1
mov eax, esi
push 0x5c
push eax
call fcn.004c5767
mov esi, eax
add esp, 8
add esi, 2
je 0x4060e3
push str.winlogon.exe
push esi
call fcn.004c9460
add esp, 8
test eax, eax
je 0x406108
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4060a6
push edi
call ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x228]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4061c0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0
push eax
push 0xa
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4061bd
lea eax, [ebp - 0x234]
push eax
push 2
push 2
push 0
push 0xf01ff
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4061b5
push str.SeImpersonatePrivilege
call fcn.004061e0
add esp, 4
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4061ad
push str.SeSecurityPrivilege
call fcn.004061e0
push str.SeDebugPrivilege
call fcn.004061e0
push str.SeBackupPrivilege
call fcn.004061e0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x234]
call ebx
push dword [ebp - 0x238]
call ebx
push esi
call ebx
push edi
call ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret