Function at 0x408aa0
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x2b0
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
mov dword [esp + 0x24], ebp
mov dword [esp + 0x38], ebp
xor edi, edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x408ada
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea eax, [esp + 0x94]
mov dword [esp + 0x94], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x408b48
mov ebx, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea ecx, [esp + 0xb8]
push 0x420b10
push ecx
call sub.MSVCRT.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x408b2d
mov eax, dword [esp + 0x9c]
lea edx, [esp + 0x48]
push edx
push eax
mov dword [esp + 0x50], ebp
call ebx
test eax, eax
jne 0x408b41
lea ecx, [esp + 0x94]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x408b48
jmp 0x408afd
mov edi, dword [esp + 0x9c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
cmp edi, ebp
jne 0x408b62
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
push edi
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x44], esi
jne 0x408b86
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea edx, [esp + 0x14]
push edx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x408bab
push esi
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
mov eax, dword [esp + 0x14]
cmp eax, ebp
jne 0x408bc0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
lea ecx, [esp + 0x30]
lea edx, [esp + 0x2c]
push ecx
push 4
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x408be3
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
jmp 0x408c0e
lea ecx, [esp + 0x48]
push ecx
push str.SeDebugPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push ebp
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.Userenv.dll
mov dword [esp + 0x1c], ebp
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebp
jne 0x408c32
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
jne 0x408c56
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2b0
ret
mov ecx, dword [esp + 0x10]
push 1
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
test eax, eax
je 0x408c6d
mov ebx, 0x400
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x50]
lea edx, [esp + 0x50]
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push ebp
push eax
mov eax, dword [esp + 0x2d8]
push ebx
lea ecx, [esp + 0x34]
push ebp
lea edx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
mov esi, 1
push ebp
push ecx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x7c], 0x44
mov dword [esp + 0x4c], 0xc
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x408d04
mov eax, dword [esp + 0x2cc]
cmp eax, ebp
jbe 0x408d0a
mov edx, dword [esp + 0x34]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x408d0a
mov dword [esp + 0x1c], esi
jmp 0x408d0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x34]
cmp eax, ebp
je 0x408d1d
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
jmp 0x408d23
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x408d2e
push eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x408d39
push eax
call esi
mov eax, dword [esp + 0x44]
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x408d4b
push eax
call esi
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2b0
ret