Function at 0x100150e0
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Create process on windows

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x1016b2e8]
xor eax, esp
mov dword [esp + 0x19c], eax
mov eax, dword [esp + 0x1ac]
push ebx
push ebp
mov ebp, dword [esp + 0x1b0]
push esi
push edi
xor ebx, ebx
push str.WTSGetActiveConsoleSessionId
push str.Kernel32.dll
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x10015142
xor al, al
jmp 0x1001545d
call eax
push 0x44
lea edx, [esp + 0x64]
mov esi, eax
push ebx
push edx
mov dword [esp + 0x30], esi
mov edi, 0x30
call fcn.10068c80
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
xor eax, eax
push esi
mov dword [esp + 0x68], 0x44
mov dword [esp + 0x70], str.winsta0default
mov dword [esp + 0x94], 1
mov word [esp + 0x98], ax
mov dword [esp + 0x4c], ebx
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x10015248
push 0xff
lea edx, [esp + 0xad]
push ebx
push edx
mov byte [esp + 0xb4], bl
call fcn.10068c80
add esp, 0xc
push 4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xb0]
push 4
push ecx
mov dword [esp + 0x28], 0x4c505845
call fcn.100618da
push 4
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0xc4]
push 4
push eax
mov dword [esp + 0x38], 0x5245524f
call fcn.100618da
push 4
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0xd8]
push 4
push edx
mov dword [esp + 0x48], 0x4558452e
call fcn.100618da
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0xdc]
push ecx
call fcn.10014fb0
add esp, 0x38
mov dword [esp + 0x1c], eax
cmp eax, ebx
jne 0x1001524c
push str.get_process_token__Failed.
call fcn.100079c0
mov ecx, eax
call fcn.100170d0
add esp, 4
jmp 0x1001542c
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x44]
push edx
push 4
lea ecx, [esp + 0x30]
push ecx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10015297
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
push 1
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x10015393
mov edi, 0x430
jmp 0x10015397
lea eax, [esp + 0x48]
push eax
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x100152c5
push str.LookupPrivilegeValue_Failed.
call fcn.100079c0
mov ecx, eax
call fcn.100170d0
add esp, 4
jmp 0x1001542c
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x14]
push eax
push 1
push 1
push ebx
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x2c]
push 0x2000000
push ecx
mov dword [esp + 0x68], 1
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], 2
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x10015323
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DuplicateTokenEx_Failed._u
call fcn.100079c0
mov ecx, eax
call fcn.100170d0
add esp, 8
jmp 0x1001542c
mov eax, dword [esp + 0x14]
push 4
lea edx, [esp + 0x28]
push edx
push 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1001535d
call esi
cmp eax, 0x522
je 0x1001535d
push str._SetTokenInformation___1314.
call fcn.100079c0
mov ecx, eax
call fcn.100170d0
add esp, 4
jmp 0x1001542c
mov edx, dword [esp + 0x14]
push ebx
push ebx
push 0x10
lea ecx, [esp + 0x5c]
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10015273
push str.AdjustTokenPrivileges_Failed.
call fcn.100079c0
mov ecx, eax
call fcn.100170d0
add esp, 4
jmp 0x1001542c
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x20]
xor eax, eax
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x64]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x3c]
push edi
push ebx
push ebx
push ebx
call fcn.100079b0
push eax
mov ecx, ebp
call fcn.100079b0
mov edx, dword [esp + 0x38]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x100153f7
call esi
push eax
push str.CreateProcessAsUser_Failed._u
call fcn.100079c0
mov ecx, eax
call fcn.100170d0
add esp, 8
jmp 0x1001542c
mov eax, dword [esp + 0x30]
mov byte [esp + 0x13], 1
cmp eax, ebx
je 0x10015418
push 0x10
lea ecx, [esp + 0x38]
push ecx
push 0x10
push eax
call fcn.100618da
add esp, 0x10
jmp 0x1001542c
mov edx, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x38]
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1001543b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x1001544a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x10015459
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x1ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10061731
add esp, 0x1a4
ret