Function at 0x41cb50
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended
Enumerate processes
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd29b
mov eax, dword fs:[0]
push eax
mov eax, 0x24f4
call fcn.004bf7b0
mov eax, dword [0x52c1c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x249c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24a0], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24a4], eax
mov eax, dword [ebp + 0x20]
push 0x503bbc
mov dword [ebp - 0x2490], eax
call fcn.00419510
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 0x2494], 0
push 0
push eax
mov dword [ebp - 0x2480], 0
mov dword [ebp - 0x248c], 0
call fcn.004d8600
mov ecx, dword [ebp + 0xc]
add esp, 0x10
test ecx, ecx
je 0x41cc22
mov edx, ecx
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41cbf0
sub edx, esi
sar edx, 1
je 0x41cc22
lea edx, [ebp - 0x210]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x41cc10
jmp 0x41cc4d
movups xmm0, xmmword [str.explorer.exe]
mov ax, word [0x503bf8]
mov word [ebp - 0x1f8], ax
movups xmmword [ebp - 0x210], xmm0
movq xmm0, qword [0x503bf0]
movq qword [ebp - 0x200], xmm0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push 0
push 2
mov dword [ebp - 0x2484], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41cc8b
lea eax, [ebp - 0x247c]
mov dword [ebp - 0x247c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x41cc92
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41cfe2
mov edi, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
nop dword [eax + eax]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x2458]
push eax
call fcn.004db4ce
add esp, 8
test eax, eax
jne 0x41ccd7
mov dword [ebp - 0x2498], eax
lea eax, [ebp - 0x2498]
push eax
push dword [ebp - 0x2474]
call edi
test eax, eax
jne 0x41cebc
lea eax, [ebp - 0x247c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41cca0
xor edi, edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test edi, edi
je 0x41cc8b
push 0x2000
lea eax, [ebp - 0x2210]
push 0
push eax
call fcn.004d8600
add esp, 0xc
lea ecx, [ebp - 0x2250]
push dword [ebp - 0x249c]
call fcn.00413130
lea eax, [ebp - 0x2250]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x2238]
push eax
call fcn.0041c5e0
add esp, 8
lea ecx, [ebp - 0x2250]
call fcn.004a80a0
cmp dword [ebp - 0x2224], 8
lea ecx, [ebp - 0x2238]
lea edx, [ebp - 0x2210]
cmovae ecx, dword [ebp - 0x2238]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41cd60
lea eax, [ebp - 0x2494]
push eax
push dword [ebp - 0x2484]
call sub.WTSAPI32.dll_WTSQueryUserToken
push 0x44
lea eax, [ebp - 0x2500]
push 0
push eax
call fcn.004d8600
mov eax, dword [ebp + 0x10]
add esp, 0xc
neg eax
mov dword [ebp - 0x2500], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0x24f8], 0
sbb eax, eax
mov dword [ebp - 0x24d4], 1
push edi
push 0
and eax, 5
push 0x2000000
mov word [ebp - 0x24d0], ax
movups xmmword [ebp - 0x24b4], xmm0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x248c]
push eax
push 0x201eb
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x24bc]
push eax
push 0x503bbc
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x24bc]
mov dword [ebp - 0x221c], eax
mov eax, dword [ebp - 0x24b8]
mov dword [ebp - 0x2218], eax
lea eax, [ebp - 0x2480]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x248c]
mov dword [ebp - 0x2220], 1
mov dword [ebp - 0x2214], 2
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 4
push dword [ebp - 0x2484]
push 0xc
push dword [ebp - 0x2480]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push 0
push 0
push 0x10
lea eax, [ebp - 0x2220]
push eax
push 0
push dword [ebp - 0x2480]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push dword [ebp - 0x2480]
lea eax, [ebp - 0x2488]
mov dword [ebp - 0x2488], 0
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x41cec7
mov eax, dword [ebp - 0x2488]
mov ecx, 0x430
jmp 0x41ced2
mov edi, dword [ebp - 0x2474]
jmp 0x41ccea
xor eax, eax
mov dword [ebp - 0x2488], eax
lea ecx, [eax + 0x30]
lea edx, [ebp - 0x24b4]
or ecx, 4
push edx
lea edx, [ebp - 0x2500]
push edx
push dword [ebp - 0x2490]
push eax
push ecx
push 0
push 0
push 0
lea eax, [ebp - 0x2210]
push eax
push 0
push dword [ebp - 0x2480]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x2490], eax
test eax, eax
je 0x41cf83
push dword [ebp - 0x24b0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x24b0]
call esi
cmp dword [ebp + 0x14], 0
je 0x41cf71
push 0xffffffffffffffff
push dword [ebp - 0x24b4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2484]
mov dword [ebp - 0x2484], 0
push eax
push dword [ebp - 0x24b4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x24a0]
test ecx, ecx
je 0x41cf67
mov eax, dword [ebp - 0x2484]
mov dword [ecx], eax
push dword [ebp - 0x24b4]
call esi
jmp 0x41cf83
mov ecx, dword [ebp - 0x24a4]
test ecx, ecx
je 0x41cf83
mov eax, dword [ebp - 0x24b4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x41cf9b
cmp edi, 0xffffffff
je 0x41cf9b
push edi
call esi
mov eax, dword [ebp - 0x2494]
test eax, eax
je 0x41cfad
cmp eax, 0xffffffff
je 0x41cfad
push eax
call esi
mov eax, dword [ebp - 0x2480]
test eax, eax
je 0x41cfbf
cmp eax, 0xffffffff
je 0x41cfbf
push eax
call esi
mov eax, dword [ebp - 0x248c]
test eax, eax
je 0x41cfd1
cmp eax, 0xffffffff
je 0x41cfd1
push eax
call esi
lea ecx, [ebp - 0x2238]
call fcn.004a80a0
mov eax, dword [ebp - 0x2490]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bedf5
mov esp, ebp
pop ebp
ret