Function at 0x42f4a5
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x1c], ebx
call fcn.0042ff34
mov dword [ebp - 0x10], eax
call fcn.0043d6c3
test al, al
je 0x42f4d8
or esi, dword [ebp - 0x71]
sub eax, 0x24bfad40
retf 0x96b8
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.0043d4e0
test al, al
je 0x42f4fe
sal byte [esp + edx + 0x5a], 0x59
pop edx
pop ecx
outsb dx, byte [esi]
ret 0xd351
call fcn.0043d2fd
test al, al
je 0x42f525
dec esp
ljmp 0x5806
call fcn.0043d3cc
test al, al
je 0x42f54d
mov ebx, 0x1a295f3e
jae 0x42f4e7
or al, 0x86
out 0x44, eax
sahf
les edx, [esi]
mov cl, 0x1a
retf 0xbb5e
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call sub.WTSAPI32.dll_WTSQueryUserToken
xor ebx, ebx
mov edi, 0x400
test eax, eax
jne 0x42f598
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42f598
lea eax, [ebp - 4]
push eax
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0043d15f
test al, al
je 0x42f5b6
fimul dword [ebp + edi*4 + 0x6643cb73]
push 0x88c4c303
sub eax, 0xbf2d6195
add byte [eax + eax], al
add byte [ebx + 0xf00fc7d], al
test byte [ecx + eax], bl
add byte [ebp + 0x6a50e445], cl
add al, 0x8d
inc ebp
loopne 0x42f61a
cmp dword [ebp - 4], 0
je 0x42f71c
lea eax, [ebp - 0x1c]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push 0x13
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor esi, esi
inc esi
test eax, eax
jne 0x42f606
lea eax, [ebp - 0x14]
push eax
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 8]
push eax
push esi
push esi
push ebx
push 0x2000000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov eax, dword [ebp - 8]
jmp 0x42f60c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
push esi
push eax
lea eax, [ebp - 0xc]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x42f62c
adc dword [ebx - 0x47ffef83], eax
add al, 4
add byte [eax], al
cmp dword [ebp + 0x10], 0
mov eax, 0x404
cmovne edi, eax
mov dword [ebp - 0x10], edi
jmp 0x42f632
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00446360
push 0x10
push ebx
push dword [ebp + 0xc]
call fcn.00446360
push 5
pop eax
push 0x10
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], ax
call fcn.00446360
add esp, 0x24
call fcn.0043d4e0
test al, al
je 0x42f687
mov ch, 0x12
mov ebx, esi
xlatb
in eax, 0xe2
push ebx
mov esi, 0x9a78a201
mov al, 0x88
adc byte [eax - 0x66], bh
sub eax, 0xdc71e8
add byte [eax + eax*8 - 0x2ae3e18c], al
call fcn.0043d2fd
test al, al
je 0x42f6ae
sbb al, 0xd5
fisubr word [ebx]
mov ds, word [edi + 0xd2eb763]
push esp
out dx, eax
invalid
call fcn.0043d3cc
test al, al
je 0x42f6d6
insb byte es:[edi], dx
rol esi, 0xe7
outsb dx, byte [esi]
adc byte [ebx], ch
jle 0x42f677
dec ecx
imul edx, dword [edx + 0x7c], 0xffffffcc
sub eax, 0xd9f19e8e
pop ebx
out dx, eax
cmp byte [esp + ebx - 0x67f8734f], 0x34
add eax, 0xc75ffaa
push dword [ebp + 0xc]
xor ebx, ebx
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
push 1
pop eax
cmovne ebx, eax
cmp dword [ebp - 8], 0
je 0x42f70d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x42f71c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret