Function at 0x10140130
Capabilities:
Acquire debug privileges
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
push edi
mov edi, ecx
xor ecx, ecx
push str.advapi32.dll
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 7
mov word [edi + 8], cx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
call esi
mov dword [ebp - 0x61c], eax
test eax, eax
je 0x1014041c
push str.Kernel32.dll
call esi
mov dword [ebp - 0x618], eax
test eax, eax
je 0x1014041c
push str.Ntdll.dll
call esi
mov dword [ebp - 0x620], eax
test eax, eax
je 0x1014041c
push str.psapi.dll
call esi
mov dword [ebp - 0x624], eax
test eax, eax
je 0x1014041c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateProcessWithTokenW
push dword [ebp - 0x61c]
call esi
push str.WTSGetActiveConsoleSessionId
push dword [ebp - 0x618]
mov dword [edi + 0x44], eax
call esi
push str.NtQueryInformationProcess
push dword [ebp - 0x620]
mov dword [edi + 0x48], eax
call esi
push str.GetProcessImageFileNameW
push dword [ebp - 0x624]
mov dword [edi + 0x4c], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 1
push str.SeIncreaseQuotaPrivilege
mov dword [edi + 0x50], eax
call esi
push eax
mov ecx, edi
call fcn.101480f0
push 1
push 0x10209338
call esi
push eax
mov ecx, edi
call fcn.101480f0
push 1
push str.SeSecurityPrivilege
call esi
push eax
mov ecx, edi
call fcn.101480f0
push 1
push str.SeShutdownPrivilege
call esi
push eax
mov ecx, edi
call fcn.101480f0
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [edi + 0x48]
test eax, eax
je 0x1014027e
call eax
mov dword [edi + 4], eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x618]
mov dword [ebp - 0x618], 0
push eax
push 5
push dword [edi]
mov dword [ebp - 0x61c], 0
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x101402f8
mov eax, dword [ebp - 0x61c]
shr eax, 1
push eax
push dword [ebp - 0x618]
call fcn.101e7180
mov edx, dword [ebp - 0x618]
add esp, 8
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x101402d4
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [edi + 0x20]
call fcn.100070c0
push dword [ebp - 0x618]
call sub.WTSAPI32.dll_WTSFreeMemory
lea eax, [ebp - 0x618]
mov dword [ebp - 0x618], 0
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1014041c
push 0x200
lea eax, [ebp - 0x40c]
push 0
push eax
call fcn.101f9fcf
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x200
lea eax, [ebp - 0x40c]
push eax
push 1
push dword [ebp - 0x618]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10140410
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.101f9fcf
push 0x208
lea eax, [ebp - 0x614]
mov dword [ebp - 0x620], 0x104
push 0
push eax
call fcn.101f9fcf
add esp, 0x18
mov dword [ebp - 0x624], 0x104
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x40c]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x10140410
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.101e7180
lea edx, [ebp - 0x20c]
add esp, 8
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x101403f1
sub edx, ecx
lea eax, [ebp - 0x20c]
sar edx, 1
lea ecx, [edi + 8]
push edx
push eax
call fcn.100070c0
push dword [ebp - 0x618]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret