Function at 0x4021f0
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x431e84]
xor eax, ebp
mov dword [ebp - 8], eax
push str.WTSGetActiveConsoleSessionId
push 0x43084c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x402259
push str.WTSGetActiveConsoleSessionId_failed
push 0x430884
push 0x430890
push 0x43089c
push 0x4308b0
push 0x1c
mov eax, dword [0x427264]
push eax
call fcn.004037c0
add esp, 0x1c
xor al, al
jmp 0x4027f9
push str.ProcessIdToSessionId
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jne 0x4022b0
push str.ProcessIdToSessionId_failed
push 0x430918
push 0x430924
push 0x430930
push 0x430944
push 0x23
mov ecx, dword [0x427264]
push ecx
call fcn.004037c0
add esp, 0x1c
xor al, al
jmp 0x4027f9
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x4022fb
push str.can_not_find_wtsapi32.dll
push 0x43099c
push 0x4309a8
push 0x4309b4
push 0x4309c8
push 0x29
mov edx, dword [0x427264]
push edx
call fcn.004037c0
add esp, 0x1c
xor al, al
jmp 0x4027f9
push str.WTSQueryUserToken
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jne 0x40235a
push str.WTSQueryUserToken_failed
push 0x430a18
push 0x430a24
push 0x430a30
push 0x430a44
push 0x30
mov ecx, dword [0x427264]
push ecx
call fcn.004037c0
add esp, 0x1c
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x4027f9
call dword [ebp - 0x260]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x402392
push str.no_session
push 0x430a70
push 0x430a7c
push 0x430a88
push 0x430a9c
push 0x39
mov eax, dword [0x427264]
push eax
call fcn.004037c0
add esp, 0x1c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4023d4
push 0x430abc
push 0x430adc
push 0x430ae8
push 0x430af4
push 0x430b08
push 0x40
mov ecx, dword [0x427264]
push ecx
call fcn.004037c0
add esp, 0x1c
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x238], 0x22c
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x25c]
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
je 0x40247b
lea ecx, [ebp - 0x214]
push ecx
push str.winlogon.exe
call fcn.00401d80
test eax, eax
jne 0x402460
mov dword [ebp - 0x268], 0
lea edx, [ebp - 0x268]
push edx
mov eax, dword [ebp - 0x230]
push eax
call dword [ebp - 0x248]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x268]
jne 0x402460
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x2d8], edx
mov dword [ebp - 0x264], 1
jmp 0x40247b
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x2bc], eax
jmp 0x402401
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x264], 0
jne 0x4024ba
push str.can_not_find_users_winlogon.exe
push 0x430b68
push 0x430b74
push 0x430b80
push 0x430b94
push 0x5b
mov eax, dword [0x427264]
push eax
call fcn.004037c0
add esp, 0x1c
lea ecx, [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [ebp - 0x270]
test eax, eax
jne 0x4024f8
push str.WTSQueryUserToken_Error
push 0x430bcc
push 0x430bd8
push 0x430be4
push 0x430bf8
push 0x61
mov eax, dword [0x427264]
push eax
call fcn.004037c0
add esp, 0x1c
mov ecx, dword [ebp - 0x2d8]
push ecx
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x26c], eax
lea edx, [ebp - 0x244]
push edx
push 0xf01ff
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402559
push str.OpenProcessToken_Error
push 0x430c30
push 0x430c3c
push 0x430c48
push 0x430c5c
push 0x68
mov ecx, dword [0x427264]
push ecx
call fcn.004037c0
add esp, 0x1c
lea edx, [ebp - 0x2c4]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40259a
push str.Lookup_Privilege_value_Error
push 0x430cc0
push 0x430ccc
push 0x430cd8
push 0x430cec
push 0x6e
mov eax, dword [0x427264]
push eax
call fcn.004037c0
add esp, 0x1c
mov dword [ebp - 0x2d4], 1
mov ecx, dword [ebp - 0x2c4]
mov dword [ebp - 0x2d0], ecx
mov edx, dword [ebp - 0x2c0]
mov dword [ebp - 0x2cc], edx
mov dword [ebp - 0x2c8], 2
lea eax, [ebp - 0x2dc]
push eax
push 1
push 1
push 0
push 0x2000000
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x402613
push str.DuplicateTokenEx_Error
push 0x430d24
push 0x430d30
push 0x430d3c
push 0x430d50
push 0x79
mov edx, dword [0x427264]
push edx
call fcn.004037c0
add esp, 0x1c
push 4
lea eax, [ebp - 4]
push eax
push 0xc
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x402659
push str.SetTokenInformation_Error
push 0x430d8c
push 0x430d98
push 0x430da4
push 0x430db8
push 0x81
mov edx, dword [0x427264]
push edx
call fcn.004037c0
add esp, 0x1c
push 0
push 0
push 0x10
lea eax, [ebp - 0x2d4]
push eax
push 0
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4026a6
push str.Adjust_Privilege_Error
push 0x430df0
push 0x430dfc
push 0x430e08
push 0x430e1c
push 0x88
mov edx, dword [0x427264]
push edx
call fcn.004037c0
add esp, 0x1c
push 0x10
push 0
lea eax, [ebp - 0x258]
push eax
call fcn.00407330
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.00407330
add esp, 0xc
mov dword [ebp - 0x2b8], 0x44
mov dword [ebp - 0x2b0], str.winsta0default
mov dword [ebp - 0x28c], 1
mov word [ebp - 0x288], 0
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x40275d
push str.CreateProcessAsUser_Error
push 0x430e78
push 0x430e84
push 0x430e90
push str.undine_ExtFunc_RunProcessAsUser
push 0xa3
mov eax, dword [0x427268]
push eax
call fcn.004037c0
add esp, 0x1c
jmp 0x40278e
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x40278e
push 0xffffffffffffffff
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x26c], 0xffffffff
je 0x4027a4
mov edx, dword [ebp - 0x26c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x23c], 0xffffffff
je 0x4027ba
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2dc], 0xffffffff
je 0x4027d0
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x244], 0xffffffff
je 0x4027e6
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [ebp - 0x264]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00403c30
mov esp, ebp
pop ebp
ret 8