Function at 0x403c1d
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510afa
mov eax, dword fs:[0]
push eax
mov eax, 0x1080
call fcn.004d9200
mov eax, dword [0x577014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x1060], edi
mov ebx, ecx
mov dword [ebp - 0x1068], ebx
mov dword [ebp - 0x1048], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1048], ebx
mov dword [ebp - 0x1064], esi
mov edx, dword [esi]
call fcn.00404e3c
mov eax, dword [esi]
push 0x2c
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 4], eax
xor eax, eax
push eax
mov dword [esi + 4], eax
mov dword [ebp - 0x1040], eax
lea eax, [ebp - 0x103c]
push eax
call fcn.004d9f30
add esp, 0xc
lea eax, [ebp - 0x1040]
push 0
push 0x30
push eax
push 2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
call edi
test eax, eax
jne 0x403d17
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x41c
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x105c]
call fcn.00406620
and dword [ebp - 4], 0
lea eax, [ebp - 0x105c]
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x1054]
add ecx, 0xfffffff0
call fcn.00407189
jmp 0x404032
test byte [ebp - 0x1030], 8
push 0
pop eax
cmovne eax, dword [ebp - 0x1024]
push 0
push 0x1000
mov dword [esi + 8], eax
lea eax, [ebp - 0x1010]
push eax
push 3
push dword [ebp - 0x1060]
call edi
test eax, eax
jne 0x403da1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x425
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x105c]
call fcn.00406620
lea eax, [ebp - 0x105c]
mov dword [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x1054]
lea ecx, [ecx - 0x10]
jmp 0x403d0d
and dword [ebp - 0x1050], 0
and dword [ebp - 0x104c], 0
push 0xc
call fcn.004d8429
mov esi, eax
pop ecx
mov dword [esi], esi
mov dword [esi + 4], esi
mov dword [ebp - 0x1050], esi
xor edi, edi
mov dword [ebp - 4], 2
cmp dword [ebp - 0x100c], edi
jbe 0x403e47
cmp dword [ebp - 0x104c], 0x15555555
mov eax, dword [ebp + edi*4 - 0x1008]
mov dword [ebp - 0x1044], eax
je 0x4040c6
lea eax, [ebp - 0x1050]
mov dword [ebp - 0x1058], eax
mov byte [ebp - 4], 3
and dword [ebp - 0x1054], 0
push 0xc
call fcn.004d8429
pop ecx
mov ecx, dword [ebp - 0x1044]
mov byte [ebp - 4], 2
and dword [ebp - 0x1054], 0
mov dword [eax + 8], ecx
inc dword [ebp - 0x104c]
inc edi
mov ecx, dword [esi + 4]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov dword [ecx], eax
mov esi, dword [ebp - 0x1050]
cmp edi, dword [ebp - 0x100c]
jb 0x403dd5
mov edx, dword [ebp - 0x104c]
mov ecx, esi
mov byte [ebp - 0x1044], 0
push dword [ebp - 0x1044]
call fcn.0040510b
pop ecx
mov edx, str.SeDebugPrivilege
lea ecx, [ebp - 0x1084]
call fcn.0040124a
mov ecx, dword [ebp - 0x107c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x1050]
mov edi, dword [eax]
cmp edi, eax
je 0x404018
push dword [edi + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x108c], esi
mov byte [ebp - 4], 4
test esi, esi
jne 0x403eb9
mov byte [ebp - 4], 2
jmp 0x404004
and dword [ebp - 0x1044], 0
lea eax, [ebp - 0x1044]
push eax
push dword [ebp - 0x1060]
push esi
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x40404e
cmp dword [ebp - 0x1044], 0
je 0x403ff9
and dword [ebp - 0x1074], 0
push 0x34
call fcn.004d8429
pop ecx
lea ecx, [ebp - 0x1070]
mov dword [ebp - 0x1078], eax
mov dword [eax], eax
mov dword [eax + 4], eax
call fcn.0040687a
and dword [ebp - 0x106c], 0
mov ebx, dword [ebp - 0x1064]
mov byte [ebp - 4], 6
cmp dword [ebx + 4], 0xaaaaaaa
mov eax, dword [ebx]
mov dword [ebp - 0x1048], eax
je 0x4040c6
lea eax, [ebp - 0x1078]
push eax
push ebx
lea ecx, [ebp - 0x1058]
call fcn.00405168
mov eax, dword [ebp - 0x1054]
mov edx, dword [ebp - 0x1048]
inc dword [ebx + 4]
mov ecx, dword [edx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 0x1054]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x1054]
and dword [ebp - 0x1054], 0
mov dword [edx + 4], eax
mov dword [ecx], eax
lea ecx, [ebp - 0x1058]
call fcn.00404f6f
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1070]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x1078]
call fcn.00404290
mov eax, dword [ebx]
lea ecx, [ebp - 0x1084]
mov edx, esi
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0040393d
cmp dword [ebp - 0x1084], 0
pop ecx
jge 0x403feb
mov eax, dword [ebx]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 0x1064]
mov ecx, dword [ebx]
dec dword [eax + 4]
mov eax, dword [ebx + 4]
mov dword [eax], ecx
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
lea ecx, [ebx + 8]
call fcn.004040d1
push 0x18
push ebx
call fcn.004d840d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x107c]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
cmp edi, dword [ebp - 0x1050]
jne 0x403e90
mov ebx, dword [ebp - 0x1068]
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
lea ecx, [ebp - 0x1050]
call fcn.004040e7
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d818b
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x43b
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x105c]
call fcn.00406620
mov ecx, dword [ebp - 0x1068]
lea eax, [ebp - 0x105c]
push eax
mov byte [ebp - 4], 5
call fcn.0040121b
mov ecx, dword [ebp - 0x1054]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1050]
call fcn.004040e7
mov eax, dword [ebp - 0x1068]
jmp 0x404034
push str.list_too_long
call fcn.004d6f3b
int3