Function at 0x10fd30
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x2046
push 0
push 0
dec ecx
jne 0x10fd39
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x110ba4
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x80], eax
mov esi, 0xa
lea eax, [ebp - 0x7c]
mov dword [eax], 0xffffffff
add eax, 4
dec esi
jne 0x10fd6e
lea eax, [ebp - 0x24]
mov edx, 0x110bc0
call fcn.00014350
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x10
call fcn.00012b94
lea eax, [ebp - 0xd4]
xor ecx, ecx
mov edx, 0x44
call fcn.00012b94
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0xd4], 0x44
mov word [ebp - 0xa4], 1
mov eax, dword [ebp - 0x24]
call fcn.00014538
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
call fcn.00014314
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x11095c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x34], 0xffffffff
je 0x110926
xor eax, eax
push ebp
push 0x110917
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0x201eb
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x10fe86
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x7c], eax
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x18]
push eax
push 1
push 1
push 0
push 0x2000000
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_DuplicateTokenEx
call sub.kernel32.dll_GetLastError_1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x78], eax
push 4
lea eax, [ebp - 0x34]
push eax
push 0xc
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_SetTokenInformation
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x74], eax
jmp 0x10ff42
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0x100e4]
mov eax, 0x110be0
call fcn.00031d88
push dword [ebp - 0x100e4]
lea edx, [ebp - 0x100e8]
mov eax, dword [ebp - 0x34]
call fcn.0002d1ec
push dword [ebp - 0x100e8]
lea edx, [ebp - 0x100ec]
mov eax, 0x110be8
call fcn.00031d88
push dword [ebp - 0x100ec]
lea eax, [ebp - 0x100e0]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x100e0]
lea eax, [ebp - 0x100dc]
call fcn.000144c4
push dword [ebp - 0x100dc]
push dword [ebp - 4]
push 0x110bf0
push dword [ebp - 8]
lea eax, [ebp - 0x100d8]
mov edx, 4
call fcn.00014618
mov eax, dword [ebp - 0x100d8]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f3bc
lea edx, [ebp - 0x100f0]
mov eax, ebx
call fcn.0002b100
mov eax, dword [ebp - 0x100f0]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f678
cmp dword [ebp - 0x18], 0
setne al
and al, byte [ebp + 0xc]
je 0x110212
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x8c]
push eax
push 0x110c04
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x11014e
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x84], 2
mov ebx, 0x10
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x90]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x11008d
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0x10100]
mov eax, 0x110c18
call fcn.00031d88
push dword [ebp - 0x10100]
lea edx, [ebp - 0x10104]
mov eax, dword [ebp - 0x34]
call fcn.0002d1ec
push dword [ebp - 0x10104]
lea edx, [ebp - 0x10108]
mov eax, 0x110be8
call fcn.00031d88
push dword [ebp - 0x10108]
lea eax, [ebp - 0x100fc]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x100fc]
lea eax, [ebp - 0x100f8]
call fcn.000144c4
push dword [ebp - 0x100f8]
push dword [ebp - 4]
push 0x110bf0
push dword [ebp - 8]
lea eax, [ebp - 0x100f4]
mov edx, 4
call fcn.00014618
mov eax, dword [ebp - 0x100f4]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f2e0
test ebx, ebx
je 0x11020a
lea edx, [ebp - 0x1010c]
mov eax, ebx
call fcn.0002b100
mov eax, dword [ebp - 0x1010c]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f678
jmp 0x11020a
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0x1011c]
mov eax, 0x110c20
call fcn.00031d88
push dword [ebp - 0x1011c]
lea edx, [ebp - 0x10120]
mov eax, dword [ebp - 0x34]
call fcn.0002d1ec
push dword [ebp - 0x10120]
lea edx, [ebp - 0x10124]
mov eax, 0x110be8
call fcn.00031d88
push dword [ebp - 0x10124]
lea eax, [ebp - 0x10118]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x10118]
lea eax, [ebp - 0x10114]
call fcn.000144c4
push dword [ebp - 0x10114]
push dword [ebp - 4]
push 0x110bf0
push dword [ebp - 8]
lea eax, [ebp - 0x10110]
mov edx, 4
call fcn.00014618
mov eax, dword [ebp - 0x10110]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f3bc
lea edx, [ebp - 0x10128]
mov eax, ebx
call fcn.0002b100
mov eax, dword [ebp - 0x10128]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f678
jmp 0x11020a
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0x10138]
mov eax, 0x110c28
call fcn.00031d88
push dword [ebp - 0x10138]
lea edx, [ebp - 0x1013c]
mov eax, dword [ebp - 0x34]
call fcn.0002d1ec
push dword [ebp - 0x1013c]
lea edx, [ebp - 0x10140]
mov eax, 0x110be8
call fcn.00031d88
push dword [ebp - 0x10140]
lea eax, [ebp - 0x10134]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x10134]
lea eax, [ebp - 0x10130]
call fcn.000144c4
push dword [ebp - 0x10130]
push dword [ebp - 4]
push 0x110bf0
push dword [ebp - 8]
lea eax, [ebp - 0x1012c]
mov edx, 4
call fcn.00014618
mov eax, dword [ebp - 0x1012c]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f3bc
lea edx, [ebp - 0x10144]
mov eax, ebx
call fcn.0002b100
mov eax, dword [ebp - 0x10144]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f678
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x18], 0
je 0x1107ec
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x1107d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
call sub.userenv_CreateEnvironmentBlock
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x30], 0
jne 0x11029d
lea edx, [ebp - 0x10148]
mov eax, 0x110c30
call fcn.00031d88
lea eax, [ebp - 0x10148]
push eax
lea edx, [ebp - 0x1014c]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x1014c]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x10148]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f678
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x100d4]
xor ecx, ecx
mov edx, 0x10000
call fcn.00012b94
mov eax, dword [ebp + 0x14]
call fcn.00014548
mov esi, eax
cmp esi, 0x8000
jl 0x1102cd
mov esi, 0x7ff8
mov eax, dword [ebp + 0x14]
call fcn.00014538
mov ecx, esi
add ecx, ecx
lea edx, [ebp - 0x100d4]
call fcn.00012840
mov eax, dword [ebp - 0xc]
call fcn.00014548
test eax, eax
jle 0x1102fd
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
call fcn.00014350
jmp 0x110308
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 4]
call fcn.00014350
xor eax, eax
push ebp
push 0x110679
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xd4]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00014538
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0x400
push 0
push 0
push 0
lea eax, [ebp - 0x100d4]
push eax
push dword [ebp - 4]
push 0x110bf0
push dword [ebp - 8]
lea eax, [ebp - 0x10150]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0x10150]
call fcn.00014538
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
test eax, eax
je 0x11050e
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0x10160]
mov eax, 0x110c34
call fcn.00031d88
push dword [ebp - 0x10160]
lea edx, [ebp - 0x10164]
mov eax, dword [ebp - 0x4c]
call fcn.0002d44c
push dword [ebp - 0x10164]
lea edx, [ebp - 0x10168]
mov eax, 0x110c3c
call fcn.00031d88
push dword [ebp - 0x10168]
lea edx, [ebp - 0x1016c]
mov eax, dword [ebp - 0x34]
call fcn.0002d1ec
push dword [ebp - 0x1016c]
lea edx, [ebp - 0x10170]
mov eax, 0x110be8
call fcn.00031d88
push dword [ebp - 0x10170]
lea eax, [ebp - 0x1015c]
mov edx, 5
call fcn.00013f8c
mov edx, dword [ebp - 0x1015c]
lea eax, [ebp - 0x10158]
call fcn.000144c4
push dword [ebp - 0x10158]
push dword [ebp - 4]
push 0x110bf0
push dword [ebp - 8]
lea edx, [ebp - 0x1017c]
mov eax, 0x110c40
call fcn.00031d88
push dword [ebp - 0x1017c]
lea eax, [ebp - 0x10184]
mov edx, dword [ebp + 0x14]
call fcn.00013e94
mov eax, dword [ebp - 0x10184]
lea edx, [ebp - 0x10180]
call fcn.0001d03c
push dword [ebp - 0x10180]
lea edx, [ebp - 0x10188]
mov eax, 0x110c44
call fcn.00031d88
push dword [ebp - 0x10188]
lea eax, [ebp - 0x10178]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x10178]
lea eax, [ebp - 0x10174]
call fcn.000144c4
push dword [ebp - 0x10174]
lea eax, [ebp - 0x10154]
mov edx, 5
call fcn.00014618
mov eax, dword [ebp - 0x10154]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f2e0
cmp dword [ebp - 0x54], 0
je 0x1104e1
lea edx, [ebp - 0x1018c]
mov eax, 0x110c48
call fcn.00031d88
mov eax, dword [ebp - 0x1018c]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f498
jmp 0x110505
test ebx, ebx
je 0x110505
lea edx, [ebp - 0x10190]
mov eax, ebx
call fcn.0002b100
mov eax, dword [ebp - 0x10190]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f588
mov byte [ebp - 0xd], 1
jmp 0x11066c
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0x101a0]
mov eax, 0x110c4c
call fcn.00031d88
push dword [ebp - 0x101a0]
lea edx, [ebp - 0x101a4]
mov eax, dword [ebp - 0x4c]
call fcn.0002d44c
push dword [ebp - 0x101a4]
lea edx, [ebp - 0x101a8]
mov eax, 0x110c3c
call fcn.00031d88
push dword [ebp - 0x101a8]
lea edx, [ebp - 0x101ac]
mov eax, dword [ebp - 0x34]
call fcn.0002d1ec
push dword [ebp - 0x101ac]
lea edx, [ebp - 0x101b0]
mov eax, 0x110be8
call fcn.00031d88
push dword [ebp - 0x101b0]
lea eax, [ebp - 0x1019c]
mov edx, 5
call fcn.00013f8c
mov edx, dword [ebp - 0x1019c]
lea eax, [ebp - 0x10198]
call fcn.000144c4
push dword [ebp - 0x10198]
push dword [ebp - 4]
push 0x110bf0
push dword [ebp - 8]
lea edx, [ebp - 0x101bc]
mov eax, 0x110c40
call fcn.00031d88
push dword [ebp - 0x101bc]
lea eax, [ebp - 0x101c4]
mov edx, dword [ebp + 0x14]
call fcn.00013e94
mov eax, dword [ebp - 0x101c4]
lea edx, [ebp - 0x101c0]
call fcn.0001d03c
push dword [ebp - 0x101c0]
lea edx, [ebp - 0x101c8]
mov eax, 0x110c44
call fcn.00031d88
push dword [ebp - 0x101c8]
lea eax, [ebp - 0x101b8]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x101b8]
lea eax, [ebp - 0x101b4]
call fcn.000144c4
push dword [ebp - 0x101b4]
lea eax, [ebp - 0x10194]
mov edx, 5
call fcn.00014618
mov eax, dword [ebp - 0x10194]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f3bc
lea edx, [ebp - 0x101cc]
mov eax, ebx
call fcn.0002b100
mov eax, dword [ebp - 0x101cc]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f678
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1107ae
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x64], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1107df
cmp dword [ebp - 0x30], 0
je 0x1107d2
mov eax, dword [ebp - 0x30]
push eax
call sub.userenv_DestroyEnvironmentBlock
xor eax, eax
mov dword [ebp - 0x30], eax
ret
lea edx, [ebp - 0x1020c]
mov eax, 0x110c54
call fcn.00031d88
push dword [ebp - 0x1020c]
lea edx, [ebp - 0x10210]
mov eax, dword [ebp - 0x34]
call fcn.0002d1ec
push dword [ebp - 0x10210]
lea edx, [ebp - 0x10214]
mov eax, 0x110be8
call fcn.00031d88
push dword [ebp - 0x10214]
lea eax, [ebp - 0x10208]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x10208]
lea eax, [ebp - 0x10204]
call fcn.000144c4
push dword [ebp - 0x10204]
push dword [ebp - 4]
push 0x110bf0
push dword [ebp - 8]
lea edx, [ebp - 0x10220]
mov eax, 0x110c40
call fcn.00031d88
push dword [ebp - 0x10220]
lea eax, [ebp - 0x10228]
mov edx, dword [ebp + 0x14]
call fcn.00013e94
mov eax, dword [ebp - 0x10228]
lea edx, [ebp - 0x10224]
call fcn.0001d03c
push dword [ebp - 0x10224]
lea edx, [ebp - 0x1022c]
mov eax, 0x110c44
call fcn.00031d88
push dword [ebp - 0x1022c]
lea eax, [ebp - 0x1021c]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x1021c]
lea eax, [ebp - 0x10218]
call fcn.000144c4
push dword [ebp - 0x10218]
lea eax, [ebp - 0x10200]
mov edx, 5
call fcn.00014618
mov eax, dword [ebp - 0x10200]
mov ecx, dword [ebp + 8]
mov edx, 0x110bfc
call fcn.0010f3bc
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x11091e
lea eax, [ebp - 0x54]
call fcn.00031d5c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x110963
cmp dword [ebp - 0x14], 0
je 0x110942
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 0
je 0x110956
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x18], eax
ret