Function at 0x42f350
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x47d6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
xor ecx, ecx
push str.InitializeSecurity...
mov edi, 7
xor esi, esi
xor eax, eax
mov word [ebp - 0x28], cx
push str._INF___N_A_
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], vtable.LogItem.0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], esi
mov word [ebp - 0x44], ax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 2
call fcn.004074a0
mov ecx, eax
call fcn.004074a0
lea ecx, [ebp - 0x48]
call fcn.00407130
push esi
push esi
push esi
push 2
push 1
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea ecx, [ebp - 0x88]
push ecx
mov dword [ebp - 0x88], eax
push str.InitializeSecurity_result
xor edx, edx
xor eax, eax
push str._INF___N_A_
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], vtable.LogItem.0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], esi
mov word [ebp - 0x44], dx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 2
call fcn.004074a0
mov ecx, eax
call fcn.004074a0
mov ecx, eax
call fcn.00423b70
lea ecx, [ebp - 0x48]
call fcn.00407130
mov dword [ebp - 0x84], str.SeUnsolicitedInputPrivilege
mov dword [ebp - 0x80], str.SeUndockPrivilege
mov dword [ebp - 0x7c], str.SeTrustedCredManAccessPrivilege
mov dword [ebp - 0x78], str.SeTimeZonePrivilege
mov dword [ebp - 0x74], str.SeTcbPrivilege
mov dword [ebp - 0x70], str.SeTakeOwnershipPrivilege
mov dword [ebp - 0x6c], str.SeSystemtimePrivilege
mov dword [ebp - 0x68], str.SeSystemProfilePrivilege
mov dword [ebp - 0x64], str.SeSystemEnvironmentPrivilege
mov dword [ebp - 0x60], str.SeSyncAgentPrivilege
mov dword [ebp - 0x5c], str.SeShutdownPrivilege
mov dword [ebp - 0x58], str.SeSecurityPrivilege
mov dword [ebp - 0x54], str.SeRestorePrivilege
mov dword [ebp - 0x50], str.SeRemoteShutdownPrivilege
mov dword [ebp - 0x4c], str.SeRelabelPrivilege
mov dword [ebp - 0x48], str.SeProfileSingleProcessPrivilege
mov dword [ebp - 0x44], str.SeManageVolumePrivilege
mov dword [ebp - 0x40], str.SeMachineAccountPrivilege
mov dword [ebp - 0x3c], str.SeLockMemoryPrivilege
mov dword [ebp - 0x38], str.SeLoadDriverPrivilege
mov dword [ebp - 0x34], str.SeIncreaseWorkingSetPrivilege
mov dword [ebp - 0x30], str.SeIncreaseQuotaPrivilege
push 0x20
lea edx, [ebp - 0x84]
push edx
mov ecx, ebx
mov dword [ebp - 0x2c], str.SeIncreaseBasePriorityPrivilege
mov dword [ebp - 0x28], str.SeEnableDelegationPrivilege
mov dword [ebp - 0x24], str.SeDebugPrivilege
mov dword [ebp - 0x20], str.SeCreateTokenPrivilege
mov dword [ebp - 0x1c], str.SeCreateSymbolicLinkPrivilege
mov dword [ebp - 0x18], str.SeCreatePermanentPrivilege
mov dword [ebp - 0x14], str.SeCreatePagefilePrivilege
mov dword [ebp - 0x10], str.SeBackupPrivilege
mov dword [ebp - 0xc], str.SeAuditPrivilege
mov dword [ebp - 8], str.SeAssignPrimaryTokenPrivilege
call fcn.0042e750
mov dword [ebp - 0x48], vtable.LogItem.0
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 1
test eax, eax
jne 0x42f55f
xor ecx, ecx
push str.Dropping_Privileges:_Failure
mov word [ebp - 0x44], ax
mov word [ebp - 0x28], cx
mov dword [ebp - 8], 3
push str._ERR___N_A_
jmp 0x42f57c
xor edx, edx
xor eax, eax
push str.Dropping_Privileges:_Success
mov word [ebp - 0x44], dx
mov word [ebp - 0x28], ax
mov dword [ebp - 8], 2
push str._INF___N_A_
lea ecx, [ebp - 0x48]
call fcn.004074a0
mov ecx, eax
call fcn.004074a0
lea ecx, [ebp - 0x48]
call fcn.00407130
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00444268
mov esp, ebp
pop ebp
ret