Function at 0x403c88
Capabilities:
Acquire debug privileges
Check os version
Create process on windows

Disassembly:
push 0x1c0
mov eax, 0x428945
call fcn.00416dfd
mov dword [ebp - 4], 1
mov esi, dword [ebp + 8]
mov eax, dword [esi - 0xc]
xor edi, edi
cmp eax, edi
jne 0x403cc7
lea ecx, [esi - 0x10]
call fcn.0040795b
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040795b
xor eax, eax
call fcn.00416e80
ret 0xc
lea ecx, [ebp - 0x184]
call fcn.0040a8fc
push edi
push esi
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 2
call fcn.0040a98a
lea ecx, [ebp - 0x184]
mov ebx, eax
call fcn.0040a527
cmp ebx, edi
jne 0x403d05
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 1
call fcn.0040a922
jmp 0x403caa
mov esi, 0x114
push esi
lea eax, [ebp - 0x12c]
push edi
push eax
mov dword [ebp - 0x130], edi
call fcn.00416500
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 6
jne 0x403d75
cmp dword [ebp + 0x10], edi
je 0x403d75
mov esi, 0x459668
mov eax, esi
xor ebx, ebx
call fcn.004047a1
test eax, eax
jle 0x403db5
push ebx
mov eax, esi
call fcn.004047b9
mov eax, dword [eax + 4]
cmp eax, dword [0x458c08]
mov eax, esi
je 0x403da8
inc ebx
call fcn.004047a1
cmp ebx, eax
jl 0x403d54
jmp 0x403db5
mov esi, 0x459678
mov eax, esi
xor ebx, ebx
call fcn.004047a1
test eax, eax
jle 0x403db5
push ebx
mov eax, esi
call fcn.004047b9
mov eax, dword [eax + 4]
cmp eax, dword [0x458c08]
mov eax, esi
je 0x403da8
inc ebx
call fcn.004047a1
cmp ebx, eax
jl 0x403d87
jmp 0x403db5
push ebx
call fcn.004047b9
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x403de1
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 1
call fcn.0040a922
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040795b
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040795b
mov eax, edi
jmp 0x403cbf
push eax
push edi
mov esi, 0x2000000
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
je 0x404105
lea ecx, [ebp - 0x138]
push ecx
push 0x201eb
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403e6d
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x130]
call fcn.00407975
mov byte [ebp - 4], 3
push str._PCFILTER__PCFILTERService_:_OpenProcessToken_Failed
lea eax, [ebp - 0x130]
push eax
call fcn.00408205
mov esi, dword [ebp - 0x130]
push esi
mov ecx, 0x459688
call fcn.0040149b
mov dword [ebp - 0x130], edi
add esp, 0xc
lea ecx, [esi - 0x10]
call fcn.0040795b
jmp 0x4040d7
lea eax, [ebp - 0x15c]
push eax
push str.SeDebugPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x403ea0
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x130]
call fcn.00407975
mov byte [ebp - 4], 4
push str._PCFILTER__PCFILTERService_:_LookupPrivilegeValue_Failed
jmp 0x403e3a
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x134]
push eax
xor ebx, ebx
inc ebx
push ebx
push ebx
push edi
push esi
push dword [ebp - 0x138]
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x160], 2
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x403f05
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x130]
call fcn.00407975
mov byte [ebp - 4], 5
push str._PCFILTER__PCFILTERService_:_DuplicateTokenEx_Failed
jmp 0x403e3a
push 4
push 0x458c08
push 0xc
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push edi
push edi
push 0x10
lea eax, [ebp - 0x16c]
push eax
push edi
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x403f55
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x130]
call fcn.00407975
mov byte [ebp - 4], 6
push str._PCFILTER__PCFILTERService_:_AdjustTokenPrivileges_Failed
jmp 0x403e3a
push 0x44
pop esi
push esi
lea eax, [ebp - 0x1cc]
push edi
push eax
call fcn.00416500
add esp, 0xc
push 0x10
lea eax, [ebp - 0x154]
push edi
push eax
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1c4], str.winsta0default
call fcn.00416500
add esp, 0xc
push ebx
push dword [ebp - 0x134]
lea eax, [ebp - 0x140]
push eax
mov dword [ebp - 0x130], 0x30
mov dword [ebp - 0x140], edi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x403fbf
mov dword [ebp - 0x130], 0x430
jmp 0x403fc5
mov dword [ebp - 0x140], edi
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], edi
je 0x404002
lea eax, [ebp - 0x13c]
push 0x44cb6c
push eax
lea ecx, [ebp + 0xc]
call fcn.00404740
pop ecx
pop ecx
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 7
call fcn.00404a7a
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x13c]
add ecx, 0xfffffff0
call fcn.0040795b
push dword [ebp + 8]
call fcn.00416436
mov esi, eax
cmp esi, edi
pop ecx
jne 0x404030
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x130]
call fcn.00407975
mov byte [ebp - 4], 8
push 0x44cb70
jmp 0x403e3a
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x1cc]
push eax
push edi
push dword [ebp - 0x140]
push dword [ebp - 0x130]
push edi
push edi
push edi
push esi
push edi
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push esi
mov dword [ebp - 0x130], eax
call fcn.0041668c
cmp dword [ebp - 0x130], edi
pop ecx
jne 0x4040ad
call fcn.0040a2a2
push eax
lea ecx, [ebp - 0x13c]
call fcn.00407975
lea eax, [ebp - 0x13c]
push str._PCFILTER__PCFILTERService_:_CreateProcessAsUser_Failed
push eax
mov byte [ebp - 4], 9
call fcn.00408205
mov esi, dword [ebp - 0x13c]
push esi
mov ecx, 0x459688
call fcn.0040149b
jmp 0x403e5d
cmp dword [ebp - 0x154], 0xffffffff
je 0x4040c2
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x150], 0xffffffff
je 0x4040d7
push dword [ebp - 0x150]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x144]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 0x138], edi
je 0x4040f5
push dword [ebp - 0x138]
call esi
cmp dword [ebp - 0x134], edi
je 0x404105
push dword [ebp - 0x134]
call esi
mov edi, dword [ebp - 0x130]
jmp 0x403db5