Function at 0x42b1b0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x62c140]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
lea eax, [ebp - 0x24]
mov edx, str.explorer.exe
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
call fcn.0042a970
test eax, eax
je 0x42b1ff
push str.Unable_to_get_the_explorer.exe_process_token_n
call fcn.0043d500
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee81
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push ecx
push eax
push str.CheckForShutdownPrivilege_:_SE_SHUTDOWN_NAME_:_LUID_lower_part_:__d___LUID_upper_part_:__d_n
mov dword [ebp - 0x28], eax
call fcn.0043d7e0
mov eax, dword [ebp - 0x24]
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
push 0xff
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 3
push eax
mov dword [ebp - 0x1c], 0xff
call esi
mov ecx, dword [ebp - 0x1c]
push ecx
mov edi, eax
call fcn.0057f2a0
mov ecx, dword [ebp - 0x24]
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x1c]
push edx
push eax
push ebx
push 3
push ecx
call esi
test edi, edi
jne 0x42b2ab
push str.CheckForShutdownPrivilege_:_GetTokenInformation_failed._So_returning_false1_n
call fcn.0043d7e0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
call esi
test eax, eax
je 0x42b35d
call esi
push eax
push str.CheckForShutdownPrivilege_:_returned_with_error_code_:__d__n
call fcn.0043d7e0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee81
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx]
push edx
push str.CheckForShutdownPrivilege_:_Privilege_count_:__d__n
call fcn.0043d7e0
add esp, 8
cmp dword [ebx], 0
mov dword [ebp - 0x20], 0
jbe 0x42b346
lea edi, [ebx + 4]
push 0xff
push 1
mov dword [ebp - 0x1c], 0xff
call fcn.0057f01b
add esp, 8
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
test eax, eax
jne 0x42b2fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42b370
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push ecx
push edx
push str.CheckForShutdownPrivilege_:_LUID_lower_part_:__d___LUID_upper_part_:__d_n
call fcn.0043d390
mov eax, dword [ebp - 0x28]
add esp, 0xc
push esi
cmp dword [edi], eax
je 0x42b397
mov ecx, dword [ebp - 0x20]
push ecx
push str.CheckForShutdownPrivilege_:_Privilege_No_:__d_found_is_:__s_n
call fcn.0043d7e0
add esp, 0xc
test esi, esi
je 0x42b338
push esi
call fcn.0057f05b
add esp, 4
mov eax, dword [ebp - 0x20]
inc eax
add edi, 0xc
mov dword [ebp - 0x20], eax
cmp eax, dword [ebx]
jb 0x42b2ca
mov eax, dword [ebp + 8]
push eax
push str.CheckForShutdownPrivilege_:_Shutdown_privilege_is_not_available_for_the_session_Id_:__d_n
call fcn.0043d7e0
push ebx
call fcn.0057f05b
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee81
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CheckForShutdownPrivilege_:_returned_with_error_code_:__d__n
call fcn.0043d7e0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0057ee81
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x20]
push edx
push str.CheckForShutdownPrivilege_:_Shutdown_Privilege_No_:__d_found_is_:__s_n
call fcn.0043d7e0
add esp, 0xc
test esi, esi
je 0x42b3b5
push esi
call fcn.0057f05b
add esp, 4
push ebx
call fcn.0057f05b
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0057ee81
mov esp, ebp
pop ebp
ret