Function at 0x10059f50
Capabilities:
Acquire debug privileges
Compare security identifiers
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d731d
mov eax, dword fs:[0]
push eax
sub esp, 0x540
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp + 0x18]
push 0x11
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp + 0x20]
push str.WTSQueryUserToken
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0xf
mov byte [ebp - 0x254], 0
call fcn.10011e40
push str.wtsapi32.dll
lea ecx, [ebp - 0x28c]
mov dword [ebp - 4], 0
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_char_const__
xor esi, esi
lea eax, [ebp - 0x288]
cmp dword [ebp - 0x274], 8
mov dword [ebp - 0x4e8], esi
cmovae eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov dword [ebp - 0x4e4], ecx
test ecx, ecx
je 0x1005a02f
cmp dword [ebp - 0x240], 0x10
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x4e8], esi
lea ecx, [ebp - 0x28c]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x240]
cmp edx, 0x10
jb 0x1005a078
mov ecx, dword [ebp - 0x254]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1005a06e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005a76f
push edx
push ecx
call fcn.1008bfe4
add esp, 8
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0xf
mov byte [ebp - 0x254], 0
test esi, esi
je 0x1005a2b7
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x1005a189
push 0x1c
push str.WTSGetActiveConsoleSessionId
lea ecx, [ebp - 0x238]
mov dword [ebp + 0xc], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], 0
call fcn.10011e40
push str.Kernel32.dll
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 3
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_char_const__
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x220]
call sym.XNewLookSch.dll_public:_void___thiscall_LDynamicFnBase::constructor_class_LString_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
lea ecx, [ebp - 0x270]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x224]
cmp edx, 0x10
jb 0x1005a148
mov ecx, dword [ebp - 0x238]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1005a13e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005a774
push edx
push ecx
call fcn.1008bfe4
add esp, 8
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], 0
test eax, eax
je 0x1005a174
call eax
mov esi, eax
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x1005a189
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x4c0]
mov dword [ebp - 0x4ec], 0
xor edi, edi
push eax
push esi
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x4c0], edi
mov dword [ebp - 0x4c4], edi
call dword [ebp - 0x4e8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1005a2a6
mov eax, dword [ebp - 0x4c0]
test eax, eax
je 0x1005a1d6
push eax
call esi
mov dword [ebp - 0x4c0], edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x4c8], eax
cmp eax, 0xffffffff
je 0x1005a2b7
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1005a269
mov edi, dword [ebp + 0xc]
nop dword [eax]
lea eax, [ebp - 0x494]
push str.explorer.exe
push eax
call fcn.10092559
add esp, 8
test eax, eax
jne 0x1005a251
mov dword [ebp - 0x4cc], eax
lea eax, [ebp - 0x4cc]
push eax
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1005a251
cmp dword [ebp - 0x4cc], edi
je 0x1005a2f0
lea eax, [ebp - 0x4b8]
push eax
push dword [ebp - 0x4c8]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1005a210
xor edi, edi
push dword [ebp - 0x4c8]
call esi
test edi, edi
je 0x1005a2b7
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x4cc], edi
test edi, edi
je 0x1005a2b7
lea eax, [ebp - 0x4c0]
push eax
push 0xf00ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1005a2b4
mov eax, dword [ebp - 0x4c0]
test eax, eax
jne 0x1005a2fb
test edi, edi
je 0x1005a2b7
push edi
call esi
mov byte [ebp - 0x4b9], 0
mov eax, dword [ebp - 0x4e4]
test eax, eax
je 0x1005a2cf
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [ebp - 0x4b9]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x4b0]
jmp 0x1005a269
lea ecx, [ebp - 0x4ec]
push ecx
push 4
lea ecx, [ebp - 0x4f0]
push ecx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1005a399
mov dword [ebp - method.LString.virtual_0], vtable.LString.0
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
push 0x10
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x238]
inc dword [sym.XNewLookSch.dll_unsigned_int_LString::_ui_instance_count]
push str.SeDebugPrivilege
call fcn.10002b70
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 2
push 1
push eax
call sym.XNewLookSch.dll_bool___cdecl_LEnvironment::enable_priv_class_LString_const___bool_
add esp, 8
lea ecx, [ebp - 0x23c]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
lea eax, [ebp - 0x4c4]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x1005a3a5
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x4c4], eax
cmp byte [ebp + 0x10], 0
je 0x1005a4d4
push 0x1000
call fcn.1008bff2
add esp, 4
mov dword [ebp - 0x4d0], 0
mov edi, eax
lea eax, [ebp - 0x508]
mov dword [ebp - 0x4d4], edi
push eax
push 0x1000
push edi
push 2
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1005a494
lea eax, [ebp - 0x4c8]
mov dword [ebp - 0x220], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x220]
mov word [ebp - 0x21c], 0x500
push eax
mov dword [ebp - 0x4c8], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1005a494
xor esi, esi
cmp dword [edi], esi
jbe 0x1005a482
add edi, 4
nop dword [eax]
nop dword [eax + eax]
push dword [edi]
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1005a472
mov eax, dword [ebp - 0x4d4]
inc esi
add edi, 8
cmp esi, dword [eax]
jb 0x1005a450
jmp 0x1005a47c
mov dword [ebp - 0x4d0], 1
mov edi, dword [ebp - 0x4d4]
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.1008c032
add esp, 4
cmp dword [ebp - 0x4d0], 0
jne 0x1005a4d4
mov eax, dword [ebp - 0x4cc]
test eax, eax
je 0x1005a4b3
push eax
call esi
mov eax, dword [ebp - 0x4c4]
test eax, eax
je 0x1005a4c0
push eax
call esi
mov eax, dword [ebp - 0x4c0]
test eax, eax
je 0x1005a2b7
push eax
jmp 0x1005a2b5
push 1
push dword [ebp - 0x4c4]
lea eax, [ebp - 0x4d8]
mov dword [ebp - 0x4d8], 0
push eax
mov edi, 0x30
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
mov ecx, 0x430
push 0x44
lea eax, [ebp - 0x54c]
cmovne edi, ecx
push 0
push eax
mov dword [ebp - 0x4d0], edi
call fcn.1008da10
mov ax, word [ebp + 0x1c]
push 0x208
mov word [ebp - 0x51c], ax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x54c], 0x44
mov dword [ebp - 0x520], 1
call fcn.1008da10
xor eax, eax
mov dword [ebp - method.LString.virtual_0], vtable.LString.0
add esp, 0x18
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
push 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x238]
inc dword [sym.XNewLookSch.dll_unsigned_int_LString::_ui_instance_count]
push str.WinSta0_
call fcn.10002b70
push dword [ebp - 0x4f4]
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x270]
push eax
call sym.XNewLookSch.dll_class_LString___cdecl_operator_class_LString_const___class_LString_const__
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
cmp dword [ebp - 0x258], 8
lea ecx, [ebp - 0x26c]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x26c]
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1005a5e0
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x544], eax
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov eax, dword [ebp - 0x4e0]
xor ecx, ecx
mov edx, 2
xorps xmm0, xmm0
movups xmmword [ebp - 0x504], xmm0
mov eax, dword [eax + 0x14]
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1008bff2
mov ecx, dword [ebp - 0x4e0]
add esp, 4
add ecx, 4
mov edi, eax
cmp dword [ecx + 0x14], 8
jb 0x1005a647
mov ecx, dword [ecx]
mov edx, edi
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x1005a650
mov eax, dword [ebp - 0x4dc]
cmp dword [eax + 0x14], 0
jne 0x1005a670
xor eax, eax
jmp 0x1005a67b
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x1005a67b
mov eax, dword [eax]
lea ecx, [ebp - 0x504]
push ecx
lea ecx, [ebp - 0x54c]
push ecx
push eax
push dword [ebp - 0x4d8]
push dword [ebp - 0x4d0]
push 0
push 0
push 0
push edi
push 0
push dword [ebp - 0x4c4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push edi
mov dword [ebp - 0x4dc], eax
call fcn.1008c032
mov ecx, dword [ebp + 0x14]
add esp, 4
test ecx, ecx
js 0x1005a70a
jne 0x1005a6d3
push 0xffffffffffffffff
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1005a6ed
imul eax, ecx, 0x3e8
push eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1005a70a
lea eax, [ebp - 0x4d0]
mov dword [ebp - 0x4d0], 0
push eax
push dword [ebp - 0x504]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x504]
test eax, eax
je 0x1005a717
push eax
call esi
mov eax, dword [ebp - 0x500]
test eax, eax
je 0x1005a724
push eax
call esi
mov eax, dword [ebp - 0x4c4]
test eax, eax
je 0x1005a731
push eax
call esi
mov eax, dword [ebp - 0x4cc]
test eax, eax
je 0x1005a73e
push eax
call esi
mov eax, dword [ebp - 0x4c0]
test eax, eax
je 0x1005a74b
push eax
call esi
mov eax, dword [ebp - 0x4d8]
test eax, eax
je 0x1005a75c
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp dword [ebp - 0x4dc], 0
setne byte [ebp - 0x4b9]
jmp 0x1005a2be
call fcn.10092486
call fcn.10092486
int3