Function at 0x40204b
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x42a080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x240]
xor esi, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x244], esi
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x402182
push esi
push 2
xor edi, edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x248], eax
jne 0x4020bd
xor eax, eax
jmp 0x4022d9
lea ecx, [ebp - 0x238]
push ecx
push eax
mov dword [ebp - 0x238], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x402127
lea eax, [ebp - 0x214]
push str.explorer.exe
push eax
call fcn.0040a5e2
test eax, eax
pop ecx
pop ecx
jne 0x402115
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x230]
mov dword [ebp - 0x23c], esi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x402115
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x23c], eax
je 0x40212d
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4020d6
jmp 0x402133
mov edi, dword [ebp - 0x230]
push dword [ebp - 0x248]
call ebx
cmp edi, esi
je 0x4020b6
push edi
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp - 0x23c], eax
je 0x4020b6
lea ecx, [ebp - 0x240]
push ecx
push 0xf00ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402182
push dword [ebp - 0x23c]
call ebx
jmp 0x4020b6
cmp dword [ebp - 0x240], esi
je 0x402175
lea eax, [ebp - 0x254]
push eax
push 4
lea eax, [ebp - 0x258]
push eax
push 0x13
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
mov edi, 0x2000000
jne 0x4021df
lea eax, [ebp - 0x24c]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x244]
push eax
push 1
push 1
push esi
push edi
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x4021eb
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x244], eax
push 1
push dword [ebp - 0x244]
lea eax, [ebp - 0x250]
push eax
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x248], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x40221a
mov dword [ebp - 0x248], 0x2000400
push 0x44
pop edi
push edi
lea eax, [ebp - 0x2b8]
push esi
push eax
call fcn.0040a2d0
push 0x10
lea eax, [ebp - 0x26c]
push esi
push eax
mov dword [ebp - 0x2b8], edi
mov word [ebp - 0x288], si
mov dword [ebp - 0x28c], 0x81
call fcn.0040a2d0
add esp, 0x18
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2b8]
push eax
push esi
push dword [ebp - 0x250]
push dword [ebp - 0x248]
push esi
push esi
push esi
push dword [ebp - 0x25c]
push esi
push dword [ebp - 0x244]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x26c], esi
mov edi, eax
je 0x402297
push dword [ebp - 0x26c]
call ebx
cmp dword [ebp - 0x268], esi
je 0x4022a7
push dword [ebp - 0x268]
call ebx
cmp dword [ebp - 0x244], esi
je 0x4022b7
push dword [ebp - 0x244]
call ebx
cmp dword [ebp - 0x23c], esi
je 0x4022c7
push dword [ebp - 0x23c]
call ebx
cmp dword [ebp - 0x240], esi
je 0x4022d7
push dword [ebp - 0x240]
call ebx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004092a8
leave
ret