Function at 0x401740
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x724
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x71c], ecx
mov dword [ebp - 0x424], 0
mov word [ebp - 0x420], 0x500
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x690], 0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
push 0
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x4017bf
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4017d6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cd1
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x65c]
push str.winlogon.exe
push eax
call fcn.00406f59
add esp, 8
test eax, eax
jne 0x401821
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x401821
cmp dword [ebp - 0x41c], esi
je 0x4018e1
lea eax, [ebp - 0x680]
push eax
push edi
call ebx
test eax, eax
jne 0x4017e0
xorps xmm0, xmm0
mov dword [ebp - 0x714], 0
push eax
push 0
push 0x2000400
movlpd qword [ebp - 0x70c], xmm0
movlpd qword [ebp - 0x704], xmm0
movlpd qword [ebp - 0x6fc], xmm0
movlpd qword [ebp - 0x6f4], xmm0
movlpd qword [ebp - 0x6ec], xmm0
movlpd qword [ebp - 0x6e4], xmm0
movlpd qword [ebp - 0x6dc], xmm0
mov dword [ebp - 0x718], 0x44
mov dword [ebp - 0x710], str.winsta0default
movups xmmword [ebp - 0x6b0], xmm0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4017b8
lea eax, [ebp - 0x688]
push eax
push 0x201eb
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4018ec
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cd1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x678]
jmp 0x40182f
lea eax, [ebp - 0x42c]
push eax
push str.SeTakeOwnershipPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40192f
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
push dword [ebp - 0x688]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cd1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x428]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x68c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x424]
mov dword [ebp - 0x43c], 1
push eax
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], 2
mov dword [ebp - 0x6a0], 0xc
mov dword [ebp - 0x698], 1
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401904
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x6b4], eax
lea eax, [ebp - 0x690]
push eax
push 0
lea eax, [ebp - 0x6d0]
mov dword [ebp - 0x6d0], 0xf003f
push eax
push 1
mov dword [ebp - 0x6cc], 2
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 2
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
push 1
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push dword [ebp - 0x690]
lea eax, [ebp - 0x450]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x450]
mov dword [ebp - 0x69c], eax
lea eax, [ebp - 0x684]
push eax
push 1
push 1
lea eax, [ebp - 0x6a0]
push eax
push 0x2000000
push dword [ebp - 0x688]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x401a9c
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
push dword [ebp - 0x688]
call esi
mov eax, dword [ebp - 0x68c]
test eax, eax
je 0x401a74
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x401a85
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cd1
mov esp, ebp
pop ebp
ret
push 4
push esi
push 0xc
push dword [ebp - 0x684]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push 0
push 0
push 0x10
lea eax, [ebp - 0x43c]
push eax
push 0
push dword [ebp - 0x684]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x401b21
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
push dword [ebp - 0x688]
call esi
push dword [ebp - 0x684]
call esi
mov eax, dword [ebp - 0x68c]
test eax, eax
je 0x401af9
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x401b0a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cd1
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x684]
lea eax, [ebp - 0x694]
mov dword [ebp - 0x694], 0
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
neg eax
push 0x208
sbb eax, eax
and eax, 0x400
add eax, 0x20
mov dword [ebp - 0x720], eax
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00402be0
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00402be0
add esp, 0x18
mov dword [ebp - 0x41c], 3
lea eax, [ebp - 0x418]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401c49
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x418]
push str.Joyxoff.exe
push eax
call esi
push 0x41bc04
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
push 0x41bc08
lea eax, [ebp - 0x210]
push eax
call esi
push dword [ebp - 0x71c]
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x718]
push eax
push 0
push dword [ebp - 0x694]
lea eax, [ebp - 0x210]
push dword [ebp - 0x720]
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x684]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x41c], eax
jmp 0x401c4b
xor esi, esi
mov ecx, dword [ebp - 0x694]
test ecx, ecx
je 0x401c5c
push ecx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [ebp - 0x68c]
test eax, eax
je 0x401c6d
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x401c7e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401c96
mov eax, dword [ebp - 0x6b0]
cmp eax, 0xffffffff
je 0x401c96
push eax
call esi
mov eax, dword [ebp - 0x6ac]
cmp eax, 0xffffffff
je 0x401ca4
push eax
call esi
push edi
call esi
push ebx
call esi
push dword [ebp - 0x684]
call esi
push dword [ebp - 0x688]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00401cd1
mov esp, ebp
pop ebp
ret