Function at 0x40a610
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
sub esp, 0x2a0
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push 2
mov dword [esp + 0x3c], ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a646
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea eax, [esp + 0x84]
mov dword [esp + 0x84], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40a6b4
mov ebp, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea ecx, [esp + 0xa8]
push str.explorer.exe
push ecx
call sub.MSVCRT.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x40a699
mov eax, dword [esp + 0x8c]
lea edx, [esp + 0x38]
push edx
push eax
mov dword [esp + 0x40], ebx
call ebp
test eax, eax
jne 0x40a6ad
lea ecx, [esp + 0x84]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x40a6b4
jmp 0x40a669
mov edi, dword [esp + 0x8c]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
cmp edi, ebx
jne 0x40a6ce
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
push edi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x20], esi
jne 0x40a6f2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea edx, [esp + 0x14]
push edx
push 0xf00ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a717
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x40a72c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push 4
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x40a74f
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
jmp 0x40a77a
lea ecx, [esp + 0x38]
push ecx
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 1
push 1
push ebx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push str.Userenv.dll
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x40a79a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40a7be
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a0
ret
mov ecx, dword [esp + 0x10]
push 1
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
test eax, eax
je 0x40a7d5
mov ebx, 0x400
mov edx, dword [esp + 0x18]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x40]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x40]
xor esi, esi
push eax
mov eax, dword [esp + 0x2bc]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push edx
push ebx
push esi
push esi
push esi
push eax
push esi
push ecx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40a83f
mov eax, dword [esp + 0x2bc]
cmp eax, esi
jbe 0x40a83f
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x40a84a
push eax
call ebp
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x40a855
push eax
call ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x40a860
push eax
call ebp
mov eax, dword [esp + 0x20]
push eax
call ebp
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40a872
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2a0
ret