Function at 0x401120
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended
Query service status
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xb8
mov eax, dword [0x41e024]
xor eax, esp
mov dword [esp + 0xb4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 8]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401538
mov esi, dword [esp + 8]
lea eax, [esp + 0x44]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4011a9
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
push 0
push 0
push 0
mov dword [esp + 0x60], eax
lea eax, [esp + 0x5c]
push eax
push 0
push esi
mov dword [esp + 0x68], 1
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
sete al
test al, al
je 0x401538
push str.___enabled_debug_privilege_n
call fcn.00401090
add esp, 4
cmp dword [ebp + 8], 2
jne 0x4011de
push dword [edi + 4]
call fcn.00407a9e
add esp, 4
jmp 0x4011e8
mov ecx, str.winlogon.exe
call fcn.00401800
test eax, eax
je 0x401545
mov edx, 2
mov ecx, eax
call fcn.00401560
mov edi, eax
mov dword [esp + 8], edi
cmp edi, 0xffffffff
je 0x401531
push str.___process_token_duplicated_n
call fcn.00401090
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x401257
call esi
mov edx, eax
mov ecx, str.SetThreadToken__
call fcn.00401680
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00401b45
mov esp, ebp
pop ebp
ret
push str.___successfully_impersonated_n
call fcn.00401090
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push dword [esp + 0xc]
call edi
push dword [esp + 8]
call edi
push 0x2000000
push str.trustedinstaller
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esp + 0x44], eax
test eax, eax
jne 0x4012c3
call esi
mov edx, eax
mov ecx, str.OpenServiceW__
call fcn.00401680
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00401b45
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x4c]
mov dword [esp + 0x30], 0
push ecx
push 0x24
lea ecx, [esp + 0x18]
xorps xmm0, xmm0
push ecx
push 0
push eax
movaps xmmword [esp + 0x24], xmm0
movaps xmmword [esp + 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x401316
call esi
mov edx, eax
mov ecx, str.QueryServiceStatusEx__
call fcn.00401680
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00401b45
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x14], 4
jne 0x40132c
push str.___trustedinstaller_service_already_running_n
call fcn.00401090
add esp, 4
jmp 0x401390
push 0
push 0
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x401363
call esi
mov edx, eax
mov ecx, str.StartServiceW__
call fcn.00401680
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00401b45
mov esp, ebp
pop ebp
ret
push str.___started_trustedinstaller_service_n
call fcn.00401090
add esp, 4
lea eax, [esp + 0x4c]
push eax
push 0x24
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x54]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4012f1
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [esp + 0x2c]
push str.___pid_of_trustedinstaller_service:__d_n
call fcn.00401090
mov ecx, dword [esp + 0x34]
add esp, 8
mov edx, 1
call fcn.00401560
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x401531
push str.___process_token_duplicated_n
call fcn.00401090
mov eax, dword [esp + 0x30]
add esp, 4
test eax, eax
je 0x401438
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x44], eax
cmp eax, 0xffffffff
jne 0x401402
call esi
mov edx, eax
mov ecx, str.OpenProcess__
call fcn.00401680
jmp 0x401438
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x401425
call esi
mov edx, eax
mov ecx, str.TerminateProcess__
call fcn.00401680
push dword [esp + 0x44]
call edi
jmp 0x401438
push dword [esp + 0x44]
call edi
push str.___stopped_trustedinstaller_service_n
call fcn.00401090
add esp, 4
mov ecx, str.TrustedInstaller.exe
call fcn.00401800
test eax, eax
je 0x4014a3
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x44], eax
cmp eax, 0xffffffff
jne 0x40146d
call esi
mov edx, eax
mov ecx, str.OpenProcess__
call fcn.00401680
jmp 0x4014a3
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x401490
call esi
mov edx, eax
mov ecx, str.TerminateProcess__
call fcn.00401680
push dword [esp + 0x44]
call edi
jmp 0x4014a3
push dword [esp + 0x44]
call edi
push str.___killed_trustedinstaller_process_n
call fcn.00401090
add esp, 4
push 0x44
lea eax, [esp + 0x74]
push 0
push eax
call fcn.00403000
add esp, 0xc
lea eax, [esp + 0x60]
xorps xmm0, xmm0
movaps xmmword [esp + 0x60], xmm0
push eax
lea eax, [esp + 0x74]
push eax
push 0
push 0
push 0x10
push 0
push str.C:WindowsSystem32cmd.exe
push 2
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x401508
call esi
mov edx, eax
mov ecx, str.CreateProcessWithTokenW__
call fcn.00401680
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00401b45
mov esp, ebp
pop ebp
ret
push str.___created_cmd_process_with_trustedinstaller_token_n
call fcn.00401090
add esp, 4
push dword [esp + 8]
call edi
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00401b45
mov esp, ebp
pop ebp
ret
push str.____failed_to_duplicate_token_n
jmp 0x40153d
push str.____could_not_enable_debug_privilege._please_run_as_a_local_administrator.
call fcn.00401090
add esp, 4
mov ecx, dword [esp + 0xbc]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.00401b45
mov esp, ebp
pop ebp
ret