Function at 0x40d820
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x48a1d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
push str.WTSGetActiveConsoleSessionId
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x40d883
call dword [ebp - 0x94]
mov dword [ebp - 8], eax
jmp 0x40d88e
mov eax, dword [ebp - 0x8c]
jmp 0x40dabd
mov dword [ebp - 0x90], 0x30
push 0x44
push 0
lea eax, [ebp - 0x68]
push eax
call fcn.004369a0
add esp, 0xc
mov dword [ebp - 0x68], 0x44
xor ecx, ecx
mov word [ebp - 0x38], cx
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x40d8f6
lea ecx, [ebp - 8]
push ecx
push str.EXPLORER.EXE
call fcn.0040e120
add esp, 8
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x40d8ec
jmp 0x40da89
mov dword [ebp - 0x8c], 0
lea edx, [ebp - 0xc]
push edx
push 4
lea eax, [ebp - 0x78]
push eax
push 0x13
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40d91b
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x6c], edx
jmp 0x40d9e0
lea eax, [ebp - 0x14]
push eax
push 0x46f078
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40d935
jmp 0x40da89
mov dword [ebp - 0x24], 1
mov ecx, 0xc
imul edx, ecx, 0
mov eax, dword [ebp - 0x14]
mov dword [ebp + edx - 0x20], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp + edx - 0x1c], ecx
mov edx, 0xc
imul eax, edx, 0
mov dword [ebp + eax - 0x18], 2
lea ecx, [ebp - 0x6c]
push ecx
push 1
push 1
push 0
push 0x2000000
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x40d984
jmp 0x40da89
push 4
lea eax, [ebp - 8]
push eax
push 0xc
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x40d9c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x522
je 0x40d9b7
jmp 0x40da89
mov dword [ebp - 0x8c], 0
push 0
push 0
push 0x10
lea edx, [ebp - 0x24]
push edx
push 0
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40d9e0
jmp 0x40da89
push 1
mov ecx, dword [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x70]
push edx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x40da06
mov eax, dword [ebp - 0x90]
or eax, 0x400
mov dword [ebp - 0x90], eax
jmp 0x40da0d
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x90]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x40da5a
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x40da58
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40da6b
cmp dword [ebp - 0x70], 0
je 0x40da69
mov ecx, dword [ebp - 0x70]
push ecx
call sub.USERENV.dll_DestroyEnvironmentBlock
jmp 0x40da89
cmp dword [ebp - 0x88], 0
je 0x40da81
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jne 0x40d88e
cmp dword [ebp - 0x6c], 0
je 0x40da99
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x74], 0
je 0x40daa9
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x70], 0
je 0x40dab8
mov eax, dword [ebp - 0x70]
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043715b
mov esp, ebp
pop ebp
ret