Function at 0x405c90
Capabilities:
Acquire debug privileges
Create process on windows
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x416008]
xor eax, esp
mov dword [esp + 0xf8], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0x20]
push edx
mov dword [esp + 0x78], ecx
mov ecx, dword [ebp + 0x1c]
push ecx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x18]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x28]
push edi
push esi
push ebx
push edx
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x94]
push ecx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x6c]
push str.UserModeType:__d_r_nPrivilegesModeType:__d_r_nMandatoryLabelType:__d_r_nProcessPriorityClassType:__d_r_nShowWindowModeType:__d_r_nWaitInterval:__d_r_nCreateNewConsole:__d_r_nCommandLine:__s_r_nCurrentDirectory:__s
push eax
mov dword [esp + 0x11c], ebx
call fcn.00409380
add esp, 0x2c
cmp dword [eax + 0x14], 8
jb 0x405d12
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x405d55
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405d4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071c1
push edx
push ecx
call fcn.00409afe
add esp, 8
cmp ebx, 6
ja case.default.0x405d5e
jmp dword [ebx*4 + 0x407250]
mov dword [esp + 0xc], 0
jmp 0x405da9
mov dword [esp + 0xc], 0x1000
jmp 0x405da9
mov dword [esp + 0xc], 0x2000
jmp 0x405da9
mov dword [esp + 0xc], 0x2100
jmp 0x405da9
mov dword [esp + 0xc], 0x3000
jmp 0x405da9
mov dword [esp + 0xc], 0x4000
jmp 0x405da9
mov dword [esp + 0xc], 0x5000
cmp esi, 5
ja case.default.0x405db2
jmp dword [esi*4 + 0x40726c]
mov dword [esp + 0x10], 0x40
jmp 0x405df3
mov dword [esp + 0x10], 0x4000
jmp 0x405df3
mov dword [esp + 0x10], 0x20
jmp 0x405df3
mov dword [esp + 0x10], 0x8000
jmp 0x405df3
mov dword [esp + 0x10], 0x80
jmp 0x405df3
mov dword [esp + 0x10], 0x100
cmp edi, 4
ja case.default.0x405dfc
jmp dword [edi*4 + 0x407284]
mov dword [esp + 0x14], 0xa
jmp 0x405e33
mov dword [esp + 0x14], 5
jmp 0x405e33
mov dword [esp + 0x14], 0
jmp 0x405e33
mov dword [esp + 0x14], 3
jmp 0x405e33
mov dword [esp + 0x14], 6
lea eax, [esp + 0x90]
mov dword [esp + 0x80], 0xffffffff
push eax
push 0x2000000
mov dword [esp + 0x98], 0xffffffff
mov dword [esp + 0x8c], 0xffffffff
mov dword [esp + 0x9c], 0xffffffff
mov dword [esp + 0x90], 0xffffffff
mov dword [esp + 0x74], 0xffffffff
mov dword [esp + 0x78], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x405f20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x405eb3
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x405eba
mov edi, 0x8007065b
push edi
push str.Open_the_current_process_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x405eda
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071c6
jmp 0x406ff9
lea eax, [esp + 0x84]
push eax
push 2
push 2
push 0
push 0x2000000
push dword [esp + 0xa4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x405fcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x405f5f
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x405f66
mov edi, 0x8007065b
push edi
push str.Duplicate_the_current_process_token_as_context_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x405f86
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071cb
jmp 0x406ff9
lea eax, [esp + 0xf8]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40606d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x406000
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x406007
mov edi, 0x8007065b
push edi
push str.Get_the_LUID_of_SeDebugPrivilege
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406027
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071d0
jmp 0x406ff9
mov edi, dword [esp + 0x84]
push 0x10
push 8
mov dword [esp + 0x108], 2
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x406f9b
push 0
push 0
mov dword [esi], 1
mov ecx, dword [esp + 0x100]
push 0x10
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x108]
push esi
mov dword [esi + 8], ecx
mov eax, dword [esp + 0x110]
push 0
push edi
mov dword [esi + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, eax
test edi, edi
jle 0x4060e5
movzx edi, di
or edi, 0x80070000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
jne 0x406fa0
push dword [esp + 0x84]
push edi
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x406193
call ebx
mov edi, eax
test edi, edi
jle 0x406126
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x40612d
mov edi, 0x8007065b
push edi
push str.Set_the_context_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x40614d
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071d5
jmp 0x406ff9
call fcn.00408580
mov dword [esp + 0x80], eax
cmp eax, 0xffffffff
jne 0x406210
push str.Get_the_session_ID
lea eax, [esp + 0x4c]
push str._s_failed.
push eax
call fcn.00409380
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4061c3
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x406206
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4061fc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071da
push edx
push ecx
call fcn.00409afe
add esp, 8
mov edi, 0x800703f0
jmp 0x407003
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x7c]
call fcn.00408420
mov esi, eax
add esp, 4
cmp dword [esi + 4], 0
jne 0x4062bb
call ebx
mov edi, eax
test edi, edi
jle 0x406241
movzx edi, di
or edi, 0x80070000
cmp byte [esi], 0
je 0x406251
test edi, edi
jne 0x406255
mov edi, 0x8007065b
jmp 0x406255
test edi, edi
je 0x4062bb
push edi
push str.Create_the_system_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406275
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071df
jmp 0x406ff9
mov esi, dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
lea eax, [esp + 0x88]
push eax
push 2
push 2
push 0
push 0x2000000
push dword [esp + 0xa8]
call esi
test eax, eax
jne 0x406365
call ebx
mov edi, eax
test edi, edi
jle 0x4062f8
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x4062ff
mov edi, 0x8007065b
push edi
push str.Duplicate_the_system_token_as_context_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x40631f
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071e4
jmp 0x406ff9
mov edx, dword [esp + 0x88]
lea ecx, [esp + 0x78]
push 2
call fcn.00408af0
add esp, 4
mov edi, dword [eax]
test edi, edi
je 0x4063e6
push edi
push str.Enable_all_privileges_for_the_system_context_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x4063a0
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071e9
jmp 0x406ff9
push dword [esp + 0x88]
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x40647d
call ebx
mov edi, eax
test edi, edi
jle 0x406410
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x406417
mov edi, 0x8007065b
push edi
push str.Set_the_system_context_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406437
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071ee
jmp 0x406ff9
mov eax, dword [esp + 0x74]
cmp eax, 1
jne 0x40655d
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x78]
call fcn.00408140
mov edi, dword [esp + 0x78]
add esp, 4
test edi, edi
jne 0x4064f7
push dword [esp + 0x64]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4064dd
lea eax, [esp + 0x70]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0x2000000
push edi
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
test esi, esi
jne 0x406990
call ebx
mov edi, eax
test edi, edi
jle 0x4064f0
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x4064f7
mov edi, 0x8007065b
push edi
push str.Get_the_TrustedInstaller_service_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406517
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071f3
jmp 0x406ff9
cmp eax, 2
jne 0x406612
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x7c]
call fcn.00408420
mov esi, eax
add esp, 4
cmp dword [esi + 4], 0
jne 0x406990
call ebx
mov edi, eax
test edi, edi
jle 0x406594
movzx edi, di
or edi, 0x80070000
cmp byte [esi], 0
je 0x4065a4
test edi, edi
jne 0x4065ac
mov edi, 0x8007065b
jmp 0x4065ac
test edi, edi
je 0x406990
push edi
push str.Get_the_system_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x4065cc
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071f8
jmp 0x406ff9
cmp eax, 3
jne 0x4066b5
lea eax, [esp + 0x70]
push eax
push dword [esp + 0x84]
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x406990
call ebx
mov edi, eax
test edi, edi
jle 0x406648
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x40664f
mov edi, 0x8007065b
push edi
push str.Get_the_current_session_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x40666f
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4071fd
jmp 0x406ff9
cmp eax, 4
jne 0x40675f
lea eax, [esp + 0x70]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x2000000
call eax
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call eax
test eax, eax
jne 0x406990
call ebx
mov edi, eax
test edi, edi
jle 0x4066f2
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x4066f9
mov edi, 0x8007065b
push edi
push str.Get_the_current_process_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406719
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407202
jmp 0x406ff9
cmp eax, 5
jne 0x406839
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x2000000
call eax
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call eax
test eax, eax
jne 0x4067a9
call ebx
mov edi, eax
test edi, edi
jle 0x4067a0
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x4067d3
mov edi, 0x8007065b
jmp 0x4067d3
mov edx, dword [esp + 0x44]
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x7c]
call fcn.00408610
add esp, 4
mov edi, dword [eax]
push dword [esp + 0x44]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
test edi, edi
je 0x406990
push edi
push str.Create_the_current_process_LUA_acccess_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x4067f3
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407207
jmp 0x406ff9
cmp eax, 6
jne 0x406f94
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
push dword [esp + 0x84]
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x406883
call ebx
mov edi, eax
test edi, edi
jle 0x406873
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x40692a
mov edi, 0x8007065b
jmp 0x40692a
lea eax, [esp + 0x78]
mov dword [esp + 0x74], 0
push eax
push 4
lea eax, [esp + 0x7c]
mov dword [esp + 0x80], 0
push eax
push 0x13
push dword [esp + 0x54]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4068d9
call ebx
mov edi, eax
test edi, edi
jle 0x4068c5
movzx edi, di
or edi, 0x80070000
test edi, edi
push dword [esp + 0x44]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4068d5
mov edi, 0x8007065b
call eax
jmp 0x40692a
lea eax, [esp + 0x70]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [esp + 0x88]
call esi
test eax, eax
je 0x4068fa
xor edi, edi
jmp 0x406914
call ebx
mov edi, eax
test edi, edi
jle 0x40690d
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x406914
mov edi, 0x8007065b
push dword [esp + 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x44]
call esi
test edi, edi
je 0x406990
push edi
push str.Get_the_elevated_current_session_acccess_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x40694a
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40720c
jmp 0x406ff9
lea eax, [esp + 0x6c]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [esp + 0x84]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x406a35
call ebx
mov edi, eax
test edi, edi
jle 0x4069c8
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x4069cf
mov edi, 0x8007065b
push edi
push str.Duplicate_the_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x4069ef
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407211
jmp 0x406ff9
mov esi, dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea eax, [esp + 0x80]
push 4
push eax
push 0xc
push dword [esp + 0x78]
call esi
test eax, eax
jne 0x406ad5
call ebx
mov edi, eax
test edi, edi
jle 0x406a68
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x406a6f
mov edi, 0x8007065b
push edi
push str.Set_the_session_ID_for_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406a8f
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407216
jmp 0x406ff9
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x406b6c
sub eax, 1
jne 0x406bea
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x78]
push eax
call fcn.00408af0
add esp, 4
mov edi, dword [eax]
test edi, edi
je 0x406bea
push edi
push str.Disable_all_privileges_for_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406b26
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40721b
jmp 0x406ff9
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x78]
push 2
call fcn.00408af0
add esp, 4
mov edi, dword [eax]
test edi, edi
je 0x406bea
push edi
push str.Enable_all_privileges_for_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406ba4
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407220
jmp 0x406ff9
cmp dword [esp + 0xf0], 0
je 0x406ce7
mov edi, dword [esp + 0x6c]
lea eax, [esp + 0x78]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x2c]
lea eax, [esp + 0x114]
mov dword [esp + 0x114], 0
push 1
push eax
mov word [esp + 0x120], 0x1000
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x406c67
push 8
lea eax, [esp + 0x7c]
mov dword [esp + 0x80], 0x20
push eax
push 0x19
push edi
call esi
push dword [esp + 0x78]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test esi, esi
jne 0x406ce7
call ebx
mov edi, eax
test edi, edi
jle 0x406c7a
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x406c81
mov edi, 0x8007065b
push edi
push str.Set_mandatory_label_for_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406ca1
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407225
jmp 0x406ff9
mov esi, dword [esp + 0x20]
lea eax, [esp + 0xa8]
neg esi
push 0x44
sbb esi, esi
push 0
and esi, 0x10
push eax
add esi, 0x404
call sub.msvcrt.dll_memset
or dword [esp + 0xe0], 1
add esp, 0xc
xor eax, eax
mov dword [esp + 0xa8], 0x44
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x14]
push 1
push dword [esp + 0x70]
mov word [esp + 0xe0], ax
lea eax, [esp + 0x94]
push eax
mov dword [esp + 0xbc], str.WinSta0Default
mov dword [esp + 0x98], 0
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x406d9a
call ebx
mov edi, eax
test edi, edi
jle 0x406d8a
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x406f23
mov edi, 0x8007065b
jmp 0x406f23
mov edi, dword [esp + 0x24]
mov ecx, edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 7
lea edx, [ecx + 2]
jmp 0x406dc0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406dc0
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [esp + 0x34]
call fcn.00404540
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x48]
call fcn.00408fc0
mov edx, dword [esp + 0x40]
cmp edx, 8
jb 0x406e23
mov ecx, dword [esp + 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406e19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40722a
push edx
push ecx
call fcn.00409afe
add esp, 8
cmp dword [esp + 0x5c], 8
lea eax, [esp + 0x48]
jb 0x406e32
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x98]
push ecx
lea ecx, [esp + 0xac]
push ecx
push dword [esp + 0x30]
push dword [esp + 0x98]
push esi
push 0
push 0
push 0
push eax
push 0
push dword [esp + 0x94]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x406eb6
push dword [esp + 0x10]
xor esi, esi
xor edi, edi
push dword [esp + 0x9c]
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [esp + 0x9c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
push dword [esp + 0x20]
push dword [esp + 0xa0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push dword [esp + 0x98]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esp + 0x9c]
call ebx
jmp 0x406ed6
call ebx
mov edi, eax
test edi, edi
jle 0x406ec9
movzx edi, di
or edi, 0x80070000
test edi, edi
jne 0x406ed4
mov esi, 0x8007065b
mov edi, esi
jmp 0x406ed6
mov esi, edi
push dword [esp + 0x8c]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x406f1f
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406f15
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40722f
push edx
push ecx
call fcn.00409afe
add esp, 8
test esi, esi
je 0x406f86
push edi
push str.Create_process
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406f43
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407234
jmp 0x406ff9
mov edx, str.Everything_seems_to_be_OK
call fcn.00405ba0
xor edi, edi
jmp 0x407003
mov edi, 0x80070057
jmp 0x407003
mov edi, 0x80070008
push edi
push str.Enable_the_SeDebugPrivilege_for_the_context_access_token
lea eax, [esp + 0x50]
push str._s_failed__returns__d.
push eax
call fcn.00409380
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x406fc0
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x407003
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406ff9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407239
push edx
push ecx
call fcn.00409afe
add esp, 8
mov eax, dword [esp + 0x90]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x407018
push eax
call ebx
mov eax, dword [esp + 0x84]
cmp eax, 0xffffffff
je 0x407027
push eax
call ebx
mov eax, dword [esp + 0x94]
cmp eax, 0xffffffff
je 0x407036
push eax
call ebx
mov eax, dword [esp + 0x88]
cmp eax, 0xffffffff
je 0x407045
push eax
call ebx
mov eax, dword [esp + 0x6c]
cmp eax, 0xffffffff
je 0x407051
push eax
call ebx
mov eax, dword [esp + 0x70]
cmp eax, 0xffffffff
je 0x40705d
push eax
call ebx
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.0040975a
mov esp, ebp
pop ebp
ret 0x1c
push str.ShowWindowModeType
lea eax, [esp + 0x4c]
push str.Invalid_Parameter:__s
push eax
call fcn.00409380
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x40709f
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x4071a5
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40719b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40723e
jmp 0x40719b
push str.ProcessPriorityClassType
lea eax, [esp + 0x4c]
push str.Invalid_Parameter:__s
push eax
call fcn.00409380
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x407104
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x4071a5
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40719b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407243
jmp 0x40719b
push str.MandatoryLabelType
lea eax, [esp + 0x4c]
push str.Invalid_Parameter:__s
push eax
call fcn.00409380
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x407162
mov eax, dword [eax]
mov edx, eax
call fcn.00405ba0
mov edx, dword [esp + 0x5c]
cmp edx, 8
jb 0x4071a5
mov ecx, dword [esp + 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40719b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407248
push edx
push ecx
call fcn.00409afe
add esp, 8
mov ecx, dword [esp + 0x104]
mov eax, 0x80070057
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040975a
mov esp, ebp
pop ebp
ret 0x1c
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
call fcn.0040a5e0
lea ecx, [ecx]
pop ebp
inc eax
add byte [edi + 0x5d], ch
inc eax
add byte [ecx + 0x5d], bh
inc eax
add byte [ebx - 0x72ffbfa3], al
pop ebp
inc eax
add byte [edi - 0x5effbfa3], dl
pop ebp
inc eax
add byte [ecx - 0x3cffbfa3], bh
pop ebp
inc eax
add ch, cl
pop ebp
inc eax
add bh, dl
pop ebp
inc eax
add cl, ah
pop ebp
inc eax
add bl, ch
pop ebp
inc eax
add byte [ebx], al
pop esi
inc eax
add byte [0x1700405e], cl
pop esi
inc eax
add byte [ecx], ah
pop esi
inc eax
add byte [ebx], ch
pop esi
inc eax
add ah, cl
int3