Function at 0x4abd10
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
mov eax, dword [0x68e500]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword fs:[0x2c]
push esi
push edi
mov dword [esp + 0x14], edx
mov edi, dword [eax]
mov eax, dword [0x6b49cc]
mov dword [esp + 0x18], ecx
cmp eax, dword [edi + 4]
jle 0x4abd88
push 0x6b49cc
call fcn.005aa4e2
add esp, 4
cmp dword [0x6b49cc], 0xffffffff
jne 0x4abd88
push str.OpenProcessToken
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6b49cc
mov dword [0x6b49d0], eax
call fcn.005aa491
add esp, 4
mov esi, dword [0x6b49d0]
lea eax, [esp + 0x1c]
push eax
push 0x20
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x4abdca
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005aa453
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6b4a04]
cmp eax, dword [edi + 4]
jle 0x4abe1a
push 0x6b4a04
call fcn.005aa4e2
add esp, 4
cmp dword [0x6b4a04], 0xffffffff
jne 0x4abe1a
push str.LookupPrivilegeValueW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x6b4a04
mov dword [0x6b49d4], eax
call fcn.005aa491
add esp, 4
jmp 0x4abe20
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push str.SeIncreaseQuotaPrivilege
movaps xmmword [esp + 0x48], xmm0
push 0
mov dword [esp + 0x4c], 1
call dword [0x6b49d4]
test eax, eax
je 0x4abdaa
mov eax, dword [0x6b49ec]
cmp eax, dword [edi + 4]
jle 0x4abe92
push 0x6b49ec
call fcn.005aa4e2
add esp, 4
cmp dword [0x6b49ec], 0xffffffff
jne 0x4abe92
push str.AdjustTokenPrivileges
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0x6b49ec
mov dword [0x6b4a0c], eax
call fcn.005aa491
add esp, 4
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0
push 0
lea eax, [esp + 0x4c]
mov dword [esp + 0x58], 2
push eax
push 0
push dword [esp + 0x30]
call dword [0x6b4a0c]
test eax, eax
je 0x4abdaa
mov eax, dword [0x6b4a10]
cmp eax, dword [edi + 4]
jle 0x4abf0c
push 0x6b4a10
call fcn.005aa4e2
add esp, 4
cmp dword [0x6b4a10], 0xffffffff
jne 0x4abf0c
push str.GetShellWindow
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0x6b4a10
mov dword [0x6b4a00], eax
call fcn.005aa491
add esp, 4
call dword [0x6b4a00]
test eax, eax
je 0x4abdaa
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [esp + 0x28], 0
je 0x4abdaa
mov eax, dword [0x6b49e8]
cmp eax, dword [edi + 4]
jle 0x4abf79
push 0x6b49e8
call fcn.005aa4e2
add esp, 4
cmp dword [0x6b49e8], 0xffffffff
jne 0x4abf79
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x6b49e8
mov dword [0x6b49f8], eax
call fcn.005aa491
add esp, 4
mov eax, dword [0x6b49f4]
cmp eax, dword [edi + 4]
jle 0x4abfbb
push 0x6b49f4
call fcn.005aa4e2
add esp, 4
cmp dword [0x6b49f4], 0xffffffff
jne 0x4abfbb
push str.OpenProcess
push dword [0x6b49f8]
call esi
push 0x6b49f4
mov dword [0x6b4a14], eax
call fcn.005aa491
add esp, 4
push dword [esp + 0x28]
push 0
push 0x400
call dword [0x6b4a14]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4abdaa
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push 2
push eax
call dword [0x6b49d0]
test eax, eax
jne 0x4ac020
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x20]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005aa453
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6b4a18]
cmp eax, dword [edi + 4]
jle 0x4ac068
push 0x6b4a18
call fcn.005aa4e2
add esp, 4
cmp dword [0x6b4a18], 0xffffffff
jne 0x4ac068
push str.DuplicateTokenEx
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0x6b4a18
mov dword [0x6b49f0], eax
call fcn.005aa491
add esp, 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 1
push 2
push 0
push 0xf01ff
push dword [esp + 0x34]
call dword [0x6b49f0]
test eax, eax
jne 0x4ac0c2
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005aa453
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6b49dc]
cmp eax, dword [edi + 4]
jle 0x4ac10a
push 0x6b49dc
call fcn.005aa4e2
add esp, 4
cmp dword [0x6b49dc], 0xffffffff
jne 0x4ac10a
push str.CreateProcessWithTokenW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0x6b49dc
mov dword [0x6b49fc], eax
call fcn.005aa491
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 0x44
mov word [esp + 0x92], ax
xorps xmm0, xmm0
mov eax, 1
movlpd qword [esp + 0x54], xmm0
mov word [esp + 0x80], ax
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x54]
movlpd qword [esp + 0x60], xmm0
push eax
push 0
push 0
push 0
push dword [esp + 0x28]
movups xmmword [esp + 0x44], xmm0
push dword [esp + 0x30]
movlpd qword [esp + 0x80], xmm0
push 0
push dword [esp + 0x44]
movlpd qword [esp + 0x90], xmm0
movlpd qword [esp + 0x98], xmm0
movlpd qword [esp + 0xa6], xmm0
movlpd qword [esp + 0xae], xmm0
call dword [0x6b49fc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x1c]
test eax, eax
jne 0x4ac1d0
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
push dword [esp + 0x2c]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005aa453
mov esp, ebp
pop ebp
ret
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
push dword [esp + 0x2c]
call esi
mov ecx, dword [esp + 0x9c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.005aa453
mov esp, ebp
pop ebp
ret