Function at 0x40aa70
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x2a0
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push 2
mov dword [esp + 0x3c], ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40aaa6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea eax, [esp + 0x84]
mov dword [esp + 0x84], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40ab14
mov ebp, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea ecx, [esp + 0xa8]
push 0x4189a4
push ecx
call sub.MSVCRT.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x40aaf9
mov eax, dword [esp + 0x8c]
lea edx, [esp + 0x38]
push edx
push eax
mov dword [esp + 0x40], ebx
call ebp
test eax, eax
jne 0x40ab0d
lea ecx, [esp + 0x84]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40ab14
jmp 0x40aac9
mov edi, dword [esp + 0x8c]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
cmp edi, ebx
jne 0x40ab2e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
push edi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x20], esi
jne 0x40ab52
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea edx, [esp + 0x14]
push edx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40ab77
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x40ab8c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push 4
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40abaf
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
jmp 0x40abda
lea ecx, [esp + 0x38]
push ecx
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push ebx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.Userenv.dll
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x40abfa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40ac1e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov ecx, dword [esp + 0x10]
push 1
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
test eax, eax
je 0x40ac35
mov ebx, 0x400
mov edx, dword [esp + 0x18]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x40]
xor esi, esi
push eax
mov eax, dword [esp + 0x2bc]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push edx
push ebx
push esi
push esi
push esi
push eax
push esi
push ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40ac9f
mov eax, dword [esp + 0x2bc]
cmp eax, esi
jbe 0x40ac9f
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x40acaa
push eax
call ebp
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x40acb5
push eax
call ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x40acc0
push eax
call ebp
mov eax, dword [esp + 0x20]
push eax
call ebp
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40acd2
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2a0
ret