Function at 0x403caf
Capabilities:
Acquire debug privileges
Check os version
Create process on windows

Disassembly:
push 0x1c0
mov eax, 0x4288d5
call fcn.00416f86
mov dword [ebp - 4], 1
mov esi, dword [ebp + 8]
mov eax, dword [esi - 0xc]
xor edi, edi
cmp eax, edi
jne 0x403cee
lea ecx, [esi - 0x10]
call fcn.00407a4b
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00407a4b
xor eax, eax
call fcn.00417009
ret 0xc
lea ecx, [ebp - 0x184]
call fcn.00409c1c
push edi
push esi
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 2
call fcn.00409cf5
lea ecx, [ebp - 0x184]
mov ebx, eax
call fcn.00409827
cmp ebx, edi
jne 0x403d2c
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 1
call fcn.00409c42
jmp 0x403cd1
mov esi, 0x114
push esi
lea eax, [ebp - 0x12c]
push edi
push eax
mov dword [ebp - 0x130], edi
call fcn.004149e0
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 6
jne 0x403d9c
cmp dword [ebp + 0x10], edi
je 0x403d9c
mov esi, 0x45d668
mov eax, esi
xor ebx, ebx
call fcn.0040488d
test eax, eax
jle 0x403ddc
push ebx
mov eax, esi
call fcn.004048a5
mov eax, dword [eax + 4]
cmp eax, dword [0x45cc08]
mov eax, esi
je 0x403dcf
inc ebx
call fcn.0040488d
cmp ebx, eax
jl 0x403d7b
jmp 0x403ddc
mov esi, 0x45d678
mov eax, esi
xor ebx, ebx
call fcn.0040488d
test eax, eax
jle 0x403ddc
push ebx
mov eax, esi
call fcn.004048a5
mov eax, dword [eax + 4]
cmp eax, dword [0x45cc08]
mov eax, esi
je 0x403dcf
inc ebx
call fcn.0040488d
cmp ebx, eax
jl 0x403dae
jmp 0x403ddc
push ebx
call fcn.004048a5
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x403e08
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 1
call fcn.00409c42
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00407a4b
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00407a4b
mov eax, edi
jmp 0x403ce6
push eax
push edi
mov esi, 0x2000000
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
je 0x40412c
lea ecx, [ebp - 0x138]
push ecx
push 0x201eb
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403e94
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x130]
call fcn.00407a65
mov byte [ebp - 4], 3
push str._PCFILTER__PCFILTERService_:_OpenProcessToken_Failed
lea eax, [ebp - 0x130]
push eax
call fcn.004082f5
mov esi, dword [ebp - 0x130]
push esi
mov ecx, 0x45d688
call fcn.00401473
mov dword [ebp - 0x130], edi
add esp, 0xc
lea ecx, [esi - 0x10]
call fcn.00407a4b
jmp 0x4040fe
lea eax, [ebp - 0x15c]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x403ec7
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x130]
call fcn.00407a65
mov byte [ebp - 4], 4
push str._PCFILTER__PCFILTERService_:_LookupPrivilegeValue_Failed
jmp 0x403e61
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x134]
push eax
xor ebx, ebx
inc ebx
push ebx
push ebx
push edi
push esi
push dword [ebp - 0x138]
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x160], 2
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x403f2c
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x130]
call fcn.00407a65
mov byte [ebp - 4], 5
push str._PCFILTER__PCFILTERService_:_DuplicateTokenEx_Failed
jmp 0x403e61
push 4
push 0x45cc08
push 0xc
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push edi
push edi
push 0x10
lea eax, [ebp - 0x16c]
push eax
push edi
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x403f7c
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x130]
call fcn.00407a65
mov byte [ebp - 4], 6
push str._PCFILTER__PCFILTERService_:_AdjustTokenPrivileges_Failed
jmp 0x403e61
push 0x44
pop esi
push esi
lea eax, [ebp - 0x1cc]
push edi
push eax
call fcn.004149e0
add esp, 0xc
push 0x10
lea eax, [ebp - 0x154]
push edi
push eax
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1c4], str.winsta0default
call fcn.004149e0
add esp, 0xc
push ebx
push dword [ebp - 0x134]
lea eax, [ebp - 0x140]
push eax
mov dword [ebp - 0x130], 0x30
mov dword [ebp - 0x140], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x403fe6
mov dword [ebp - 0x130], 0x430
jmp 0x403fec
mov dword [ebp - 0x140], edi
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], edi
je 0x404029
lea eax, [ebp - 0x13c]
push 0x450bc4
push eax
lea ecx, [ebp + 0xc]
call fcn.0040482c
pop ecx
pop ecx
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 7
call fcn.00404b66
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x13c]
add ecx, 0xfffffff0
call fcn.00407a4b
push dword [ebp + 8]
call fcn.0041487f
mov esi, eax
cmp esi, edi
pop ecx
jne 0x404057
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x130]
call fcn.00407a65
mov byte [ebp - 4], 8
push 0x450bc8
jmp 0x403e61
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x1cc]
push eax
push edi
push dword [ebp - 0x140]
push dword [ebp - 0x130]
push edi
push edi
push edi
push esi
push edi
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push esi
mov dword [ebp - 0x130], eax
call fcn.00414b6c
cmp dword [ebp - 0x130], edi
pop ecx
jne 0x4040d4
call fcn.0040ac1e
push eax
lea ecx, [ebp - 0x13c]
call fcn.00407a65
lea eax, [ebp - 0x13c]
push str._PCFILTER__PCFILTERService_:_CreateProcessAsUser_Failed
push eax
mov byte [ebp - 4], 9
call fcn.004082f5
mov esi, dword [ebp - 0x13c]
push esi
mov ecx, 0x45d688
call fcn.00401473
jmp 0x403e84
cmp dword [ebp - 0x154], 0xffffffff
je 0x4040e9
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x150], 0xffffffff
je 0x4040fe
push dword [ebp - 0x150]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x144]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 0x138], edi
je 0x40411c
push dword [ebp - 0x138]
call esi
cmp dword [ebp - 0x134], edi
je 0x40412c
push dword [ebp - 0x134]
call esi
mov edi, dword [ebp - 0x130]
jmp 0x403ddc