Function at 0x44df40
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x80
push esi
xor eax, eax
mov esi, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
xor edx, edx
mov dword [esp + 0x30], eax
cmp dword [esi + 0x10], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x44], 0x44
jne 0x44df94
mov ecx, dword [esp + 0x8c]
push ecx
mov ecx, esi
call fcn.0044dec0
pop edi
pop esi
add esp, 0x80
ret 4
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, edx
push ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
je 0x44dfc5
call eax
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x44dfc9
pop ebp
pop edi
xor al, al
pop esi
add esp, 0x80
ret 4
mov ebp, dword [esp + 0x1c]
push ebx
push ebp
mov ecx, esi
call fcn.0044dd80
mov ebx, eax
test ebx, ebx
jne 0x44dfe7
pop ebx
pop ebp
pop edi
xor al, al
pop esi
add esp, 0x80
ret 4
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44e027
lea edx, [esp + 0x1c]
push edx
push ebp
call eax
test eax, eax
jne 0x44e027
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x44e156
mov eax, dword [esp + 0x94]
push eax
mov ecx, esi
call fcn.0044dec0
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x80
ret 4
xor eax, eax
push ebx
push eax
mov ecx, 0x11
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
push 0x2000000
mov dword [esp + 0x58], 0x44
mov dword [esp + 0x60], str.winsta0default
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
push 0x201eb
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x44e156
lea edx, [esp + 0x24]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x44e156
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
mov ebx, 1
push ebx
push ebx
push 0
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x28]
push 0x2000000
push eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], 2
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x44e156
mov ecx, dword [esp + 0x10]
push 4
push ebp
push 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov eax, dword [esp + 0x10]
push 0
push 0
push 0x10
lea edx, [esp + 0x48]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x44e156
mov ecx, dword [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x44e156
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x18]
push 0
push edx
push 0x430
push 0
push 0
push 0
push eax
push 0
push ecx
call dword [esi + 0x10]
test eax, eax
je 0x44e156
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x30]
push eax
call esi
mov dword [esp + 0x20], ebx
jmp 0x44e15c
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44e167
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44e172
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x44e181
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test edi, edi
je 0x44e188
push edi
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x44e193
push eax
call esi
mov eax, dword [esp + 0x20]
pop ebx
pop ebp
test eax, eax
pop edi
setne al
pop esi
add esp, 0x80
ret 4