Function at 0x406a80
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x43000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, ecx
push str.WTSGetActiveConsoleSessionId
push str.kernel32.dll
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.WTSQueryUserToken
push str.Wtsapi32.dll
mov dword [ebp - 0x244], eax
call edi
push eax
call esi
mov esi, eax
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x406cd7
test esi, esi
je 0x406cd7
call eax
mov edi, eax
mov dword [ebx + 4], 0x20
lea eax, [ebp - 0x240]
mov dword [ebp - 0x24c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x250], 0
push edi
movlpd qword [ebp - 0x258], xmm0
call esi
test eax, eax
jne 0x406c05
push eax
push 2
mov dword [ebp - 0x244], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406b4d
xor eax, eax
jmp 0x406bda
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x406bcd
nop dword [eax]
lea eax, [ebp - 0x214]
push str.explorer.exe
push eax
call fcn.00410833
add esp, 8
test eax, eax
jne 0x406bad
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x406bad
cmp dword [ebp - 0x248], edi
je 0x406bc1
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x406b70
jmp 0x406bcd
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x244], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x244]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x23c]
push eax
push 0xf00ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 0x23c]
jmp 0x406c1d
mov eax, dword [ebp - 0x240]
xor edi, edi
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x250]
push ecx
push 4
lea ecx, [ebp - 0x24c]
push ecx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x406c44
mov eax, dword [ebp - 0x24c]
mov dword [ebx], eax
jmp 0x406c70
lea eax, [ebp - 0x258]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebx
push 1
push 1
push 0
push 0x2000000
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov eax, dword [ebx]
lea esi, [ebx + 8]
test eax, eax
je 0x406c95
push 1
push eax
push esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x406c95
or dword [ebx + 4], 0x400
mov esi, 1
jmp 0x406c9d
mov dword [esi], 0
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x406caa
push edi
call ebx
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x406cb7
push eax
call ebx
mov ecx, dword [ebp - 0x23c]
test ecx, ecx
je 0x406cc4
push ecx
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ce5c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ce5c
mov esp, ebp
pop ebp
ret