Function at 0x4012a1
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x45a6d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0xa0], esi
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ebx, eax
push ebx
push str.explorer.exe
call fcn.004011a2
pop ecx
pop ecx
mov dword [ebp - 0xa4], eax
cmp eax, esi
jne 0x401328
push ebx
push str.winlogon.exe
call fcn.004011a2
pop ecx
pop ecx
mov dword [ebp - 0xa4], eax
cmp eax, esi
jne 0x401328
push str.Cant_Find_Explorer_n
call sym.jsService.exe_public:_static_class_FileLogger____cdecl_FileLogger::getInstance_void_
mov ecx, eax
call sym.jsService.exe_public:_void___thiscall_FileLogger::addLog_char_const__
xor eax, eax
jmp 0x4015ab
push 0x44
pop edi
push edi
lea eax, [ebp - 0x10c]
push esi
push eax
mov dword [ebp - 0xa8], 0x30
call fcn.00426cd0
mov dword [ebp - 0x10c], edi
xor eax, eax
lea edi, [ebp - 0xbc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x9c]
push eax
push ebx
mov dword [ebp - 0x104], str.winsta0default
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4013ee
push dword [ebp - 0xa4]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x90]
push ecx
push 0xf00ff
push eax
mov dword [ebp - 0xa0], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4013d3
call edi
push eax
lea eax, [ebp - 0x8c]
push str.Process_token_open_Error:__u_n
push eax
call fcn.0041b6ac
lea eax, [ebp - 0x8c]
add esp, 0xc
push eax
call sym.jsService.exe_public:_static_class_FileLogger____cdecl_FileLogger::getInstance_void_
mov ecx, eax
call sym.jsService.exe_public:_void___thiscall_FileLogger::addLog_char_const__
cmp dword [ebp - 0x90], esi
jne 0x4013fa
push str.Process_tokenError:__n
call sym.jsService.exe_public:_static_class_FileLogger____cdecl_FileLogger::getInstance_void_
mov ecx, eax
call sym.jsService.exe_public:_void___thiscall_FileLogger::addLog_char_const__
jmp 0x4013fa
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xc4]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40143b
call edi
push eax
lea eax, [ebp - 0x8c]
push str.Lookup_Privilege_value_Error:__u_n
push eax
call fcn.0041b6ac
lea eax, [ebp - 0x8c]
add esp, 0xc
push eax
call sym.jsService.exe_public:_static_class_FileLogger____cdecl_FileLogger::getInstance_void_
mov ecx, eax
call sym.jsService.exe_public:_void___thiscall_FileLogger::addLog_char_const__
lea eax, [ebp - 0x98]
push eax
push 1
push 1
push esi
push 0x2000000
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x401486
call edi
push eax
lea eax, [ebp - 0x8c]
push str.DuplicateTokenEx_Error:__u_n
push eax
call fcn.0041b6ac
lea eax, [ebp - 0x8c]
add esp, 0xc
push eax
call sym.jsService.exe_public:_static_class_FileLogger____cdecl_FileLogger::getInstance_void_
mov ecx, eax
call sym.jsService.exe_public:_void___thiscall_FileLogger::addLog_char_const__
push 1
push dword [ebp - 0x98]
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x4014b1
mov dword [ebp - 0xa8], 0x430
jmp 0x4014c8
push str.CreateEnvironmentBlock_Failed_n
call sym.jsService.exe_public:_static_class_FileLogger____cdecl_FileLogger::getInstance_void_
mov ecx, eax
call sym.jsService.exe_public:_void___thiscall_FileLogger::addLog_char_const__
mov dword [ebp - 0x94], esi
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push dword [ebp - 0x94]
push dword [ebp - 0xa8]
push esi
push esi
push esi
push dword [ebp - 0xac]
push esi
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov ebx, eax
call edi
cmp ebx, esi
jne 0x40152f
cmp eax, esi
je 0x40152f
call edi
push eax
lea eax, [ebp - 0x8c]
push str.CreateProcessAsUser_Error:__u_n
push eax
call fcn.0041b6ac
lea eax, [ebp - 0x8c]
add esp, 0xc
push eax
call sym.jsService.exe_public:_static_class_FileLogger____cdecl_FileLogger::getInstance_void_
mov ecx, eax
call sym.jsService.exe_public:_void___thiscall_FileLogger::addLog_char_const__
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xbc], esi
je 0x401545
push dword [ebp - 0xbc]
call edi
cmp dword [ebp - 0xb8], esi
je 0x401555
push dword [ebp - 0xb8]
call edi
cmp dword [ebp - 0xa0], esi
je 0x401565
push dword [ebp - 0xa0]
call edi
cmp dword [ebp - 0x9c], esi
je 0x401575
push dword [ebp - 0x9c]
call edi
cmp dword [ebp - 0x98], esi
je 0x401585
push dword [ebp - 0x98]
call edi
cmp dword [ebp - 0x90], esi
je 0x401595
push dword [ebp - 0x90]
call edi
cmp dword [ebp - 0x94], esi
je 0x4015a9
push dword [ebp - 0x94]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b4d6
leave
ret