Function at 0x10007b29
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b0
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x34c], ecx
mov ecx, dword [ebp + 8]
inc ebx
mov eax, edx
mov dword [ebp - 0x354], ecx
push esi
push edi
mov dword [ebp - 0x350], eax
cmp dword [0x10028514], ebx
jne 0x10007c9f
or dword [eax], 0xffffffff
xor esi, esi
or dword [ecx], 0xffffffff
lea eax, [ebp - 0x324]
push 0x104
push esi
push eax
mov dword [ebp - 0x33c], esi
mov dword [ebp - 0x338], esi
call fcn.1000a7f0
add esp, 0xc
lea edx, [ebp - 0x324]
call fcn.10007a85
mov dword [ebp - 0x344], eax
cmp eax, 0xffffffff
je 0x10007c1b
cmp byte [ebp - 0x324], 0
je 0x10007c1b
push ecx
mov edx, eax
lea ecx, [ebp - 0x324]
call fcn.100072e6
pop ecx
test eax, eax
je 0x10007c9f
push eax
push esi
mov edi, 0x2000000
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10007ea3
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x340], esi
push eax
push 0x201eb
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10007ce4
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x340], esi
push eax
push dword [ebp - 0x344]
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
jmp 0x10007cdc
call fcn.10007a42
mov dword [ebp - 0x344], eax
cmp eax, 0xffffffff
je 0x10007c9f
mov edi, dword [str.kgurpwmg_]
mov dword [ebp - 0x340], ebx
mov ebx, esi
jmp 0x10007c9b
push 0x104
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.1000a7f0
add esp, 0xc
lea ecx, [ebp - 0x114]
mov edx, 0x104
push edi
call fcn.100010e3
lea edx, [ebp - 0x114]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10007c6a
sub edx, ecx
lea ecx, [ebp - 0x114]
call fcn.1000773e
mov edx, dword [ebp - 0x344]
lea ecx, [ebp - 0x114]
call fcn.1000741c
test eax, eax
jne 0x10007cb1
mov edi, dword [ebx*4 + 0x10021be8]
inc ebx
test edi, edi
jne 0x10007c3b
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f85
leave
ret
push eax
push esi
mov edi, 0x2000000
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10007ea3
lea eax, [ebp - 0x33c]
push eax
push 0x201eb
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10007e9c
lea eax, [ebp - 0x338]
push eax
push 1
push 1
push esi
push edi
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x10007e98
push 4
lea eax, [ebp - 0x344]
push eax
push 0xc
push dword [ebp - 0x338]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea eax, [ebp - 0x330]
mov dword [ebp - 0x334], 1
push eax
push str.SeDebugPrivilege
push esi
mov dword [ebp - 0x328], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10007e98
push esi
push esi
push 0x10
lea eax, [ebp - 0x334]
push eax
push esi
push dword [ebp - 0x338]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x10007d6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x104
lea eax, [ebp - 0x21c]
push edi
push esi
push eax
call fcn.1000a7f0
mov eax, dword [ebp - 0x340]
lea ecx, [ebp - 0x21c]
add esp, 0xc
mov edx, edi
push dword [eax*4 + 0x10021bf0]
call fcn.100010e3
lea edx, [ebp - 0x21c]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10007da6
sub edx, ecx
lea ecx, [ebp - 0x21c]
call fcn.1000773e
push esi
push dword [ebp - 0x338]
lea eax, [ebp - 0x348]
mov dword [ebp - 0x340], 0x34
push eax
mov dword [ebp - 0x348], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x10007dee
mov dword [ebp - 0x340], 0x434
jmp 0x10007df4
mov dword [ebp - 0x348], esi
push 0x44
pop edi
push edi
lea eax, [ebp - 0x3ac]
push esi
push eax
call fcn.1000a7f0
mov dword [ebp - 0x3ac], edi
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x3a4], eax
lea edi, [ebp - 0x364]
xor eax, eax
mov dword [ebp - 0x380], 1
mov word [ebp - 0x37c], ax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x3ac]
push eax
push esi
push dword [ebp - 0x348]
push dword [ebp - 0x340]
push esi
push esi
push esi
push dword [ebp - 0x34c]
push esi
push dword [ebp - 0x338]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x10007e98
mov eax, dword [ebp - 0x364]
cmp eax, 0xffffffff
je 0x10007e98
mov ecx, dword [ebp - 0x360]
cmp ecx, 0xffffffff
je 0x10007e98
mov edx, dword [ebp - 0x350]
mov esi, dword [ebp - 0x35c]
mov dword [edx], eax
mov eax, dword [ebp - 0x354]
mov dword [eax], ecx
test ebx, ebx
je 0x10007ea3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x33c], 0
je 0x10007eb8
push dword [ebp - 0x33c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x338], 0
je 0x10007ecd
push dword [ebp - 0x338]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x10007ca2