Function at 0x401390
Capabilities:
Enumerate processes
Execute command
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x208
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
push str.Determining_Windows_NT_version_and_architecture..._n
call fcn.00401010
add esp, 4
push str.The_architecture_of_OS_:_32bit_n
call fcn.00401010
add esp, 4
lea eax, [esp + 0x4c]
push 0x90
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x48], 0x94
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je case.default.0x4014b8
cmp dword [esp + 0x58], 2
jne case.default.0x4014b8
mov eax, dword [esp + 0x4c]
add eax, 0xfffffffd
cmp eax, 7
ja case.default.0x4014b8
jmp dword [eax*4 + 0x401784]
mov eax, dword [esp + 0x50]
sub eax, 1
je 0x40144c
sub eax, 4
je 0x40143d
sub eax, 0x2e
jne case.default.0x4014b8
push str.Windows_NT_3.51__1995_
push 0x4033f0
jmp 0x40151b
push str.Windows_NT_3.5__1994_
push 0x4033f0
jmp 0x40151b
push str.Windows_NT_3.1__1993_
push 0x4033f0
jmp 0x40151b
cmp dword [esp + 0x50], 0
jne case.default.0x4014b8
push str.Windows_NT_4.0__1996_
push 0x4033f0
jmp 0x40151b
mov eax, dword [esp + 0x50]
sub eax, 0
je 0x4014a3
sub eax, 1
je 0x401497
sub eax, 1
jne case.default.0x4014b8
push str.Windows_NT_5.2__Windows_Server_2003__Windows_XP_x64___2003_
push 0x4033f0
jmp 0x40151b
push str.Windows_NT_5.1__Windows_XP___2001_
push 0x4033f0
jmp 0x40151b
push str.Windows_NT_5.0__Windows_2000___1997_1999_
push 0x4033f0
jmp 0x40151b
mov eax, dword [esp + 0x50]
cmp eax, 3
ja case.default.0x4014b8
jmp dword [eax*4 + 0x4017a4]
push str.Windows_NT_6.0__Windows_Vista__Windows_Server_2008___2006_
push 0x4033f0
jmp 0x40151b
push str.Windows_NT_6.1__Windows_7__Windows_Server_2008_R2___2009_
push 0x4033f0
jmp 0x40151b
push str.Windows_NT_6.2__Windows_8__Windows_Server_2012___2012_
push 0x4033f0
jmp 0x40151b
push str.Windows_NT_6.3__Windows_8.1__Windows_Server_2012_R2___2013_
push 0x4033f0
jmp 0x40151b
cmp dword [esp + 0x50], 0
jne case.default.0x4014b8
push str.Windows_NT_10.0__Windows_10__Windows_Server_2016___2015_
push 0x4033f0
jmp 0x40151b
push str.Failed_to_get_Windows_NT_version_n
call fcn.00401010
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LastError:_0x_x_n
call fcn.00401010
add esp, 8
push str.escalating_Privileges..._n
call fcn.00401010
add esp, 4
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [esp + 0xc]
push eax
push 0
push 0x28
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push eax
call edi
test eax, eax
jne 0x40159c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x40158b
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
je 0x40158b
lea eax, [esp + 0xc]
push eax
push 0
push 0x28
call esi
push eax
call edi
test eax, eax
jne 0x40159c
mov ecx, 0x403350
call fcn.00401320
push 0xd
push str.Result_of_Privilege_Escalation_:__d_n
call fcn.00401010
add esp, 8
jmp 0x4015ec
mov ecx, dword [esp + 0xc]
push 1
call fcn.00401250
add esp, 4
test al, al
jne 0x4015d3
mov ecx, str.Set_Privilege
call fcn.00401320
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xd
push str.Result_of_Privilege_Escalation_:__d_n
call fcn.00401010
add esp, 8
jmp 0x4015ec
push 0
push str.Result_of_Privilege_Escalation_:__d_n
call fcn.00401010
push str.Successfully_Escalated_privileges_to_SYSTEM_level..._n
call fcn.00401010
add esp, 0xc
movups xmm0, xmmword [str.plutonium_bootstrapper_win32.exe]
mov al, byte [0x403714]
push 0x124
movups xmmword [esp + 0x14], xmm0
mov byte [esp + 0x34], al
lea eax, [esp + 0xe8]
movups xmm0, xmmword [0x403704]
push 0
push eax
movups xmmword [esp + 0x2c], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xe0], 0x128
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401682
push str.CreateToolhelp32Snapshot_failed_
call fcn.00401010
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LastError_:_0x_x_n
call fcn.00401010
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [esp + 0x218]
add esp, 0xc
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.004017b4
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xe0]
xor edi, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4016f5
nop word [eax + eax]
lea ecx, [esp + 0x104]
lea eax, [esp + 0x10]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4016d0
test dl, dl
je 0x4016cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4016d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4016b0
xor eax, eax
jmp 0x4016d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4016ee
lea eax, [esp + 0xe0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4016a0
jmp 0x4016f5
mov edi, dword [esp + 0xe8]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push str.Target_Program_PID:__d_n_n
call fcn.00401010
add esp, 8
push edi
push 0
push 0x42a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40173d
push edi
push str.Could_not_open_Process_for_PID__d_n
call fcn.00401010
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LastError_:_0X_x_n
jmp 0x401659
mov ecx, dword [0x405380]
push 0
call fcn.00401250
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push dword [0x405380]
call edi
mov edx, esi
call fcn.00401050
push esi
call edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40177c
mov ecx, 0x403790
call fcn.00401320
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop ss
adc al, 64
add byte [ebx + 0x14], bl
inc eax
add byte [ebp + 0x14], dh
inc eax
add byte [edi + 0x2004014], ch
adc eax, 0x15020040
inc eax
add byte [edx], al
adc eax, 0x14ef0040
inc eax
add byte [edi - 0x34ffbfec], bh
adc al, 0x40
add bh, dl
adc al, 0x40
add bl, ah
adc al, 0x40
add byte [ebx], bh
cmp ecx, dword [0x405004]
jne 0x4017bd
ret
jmp fcn.00401a3b