Function at 0x4357f0
Capabilities:
Manipulate user privileges

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov eax, dword [esp + 0x80]
test al, al
mov byte [0x53e010], al
jne 0x435810
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x28
mov dword [esp], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call ebx
sub esp, 0xc
cmp eax, 1
je 0x4358f0
call esi
lea edx, [esp + 0x38]
mov dword [esp + 4], 8
mov dword [esp], eax
mov dword [esp + 8], edx
call ebx
sub esp, 0xc
cmp eax, 1
jne 0x435807
mov eax, dword [esp + 0x38]
lea ebp, [esp + 0x48]
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], ebp
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [esp + 0x2c], eax
call eax
sub esp, 0x14
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x4359a0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 0x14
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x435807
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 1
mov dword [esp + 0x54], 2
mov dword [esp + 4], str.SeLockMemoryPrivilege
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
sub esp, 0xc
cmp eax, 1
jne 0x43583f
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
sub esp, 0x18
cmp eax, 1
jne 0x43583f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43583f
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
or dword [0x5762d4], 1
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
sub esp, 8
mov ecx, eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x28], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 0x14
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x2c], edx
mov dword [esp], eax
call edx
sub esp, 4
mov edx, dword [esp + 0x28]
test edx, edx
je 0x435807
xor edx, edx
xor eax, eax
mov dword [ebp + eax], edx
add eax, 4
cmp eax, 0x18
jb 0x435a06
lea eax, [esp + 0x3c]
mov dword [esp + 8], 0xf0fff
mov dword [esp + 4], ebp
mov dword [esp], 0
mov dword [esp + 0xc], eax
call sub.ADVAPI32.dll_LsaOpenPolicy
sub esp, 0x10
test eax, eax
je 0x435a4e
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
jmp 0x435807
mov dword [esp], str.SeLockMemoryPrivilege
call sub.msvcrt.dll_wcslen
lea edx, [eax + eax]
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 0x44], str.SeLockMemoryPrivilege
mov word [esp + 0x42], ax
mov eax, dword [esp + 0x28]
mov word [esp + 0x40], dx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.dll_LsaAddAccountRights
sub esp, 0x10
test eax, eax
je 0x435ab0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.dll_LsaClose
sub esp, 4
jmp 0x435a39
mov eax, dword [0x576044]
mov dword [esp + 8], str.Huge_pages_support_was_successfully_enabled__but_reboot_required_to_use_it
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.0040af70
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.dll_LsaClose
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
call esi
mov dword [esp + 8], edi
mov dword [esp + 4], 0x28
mov dword [esp], eax
call ebx
sub esp, 0xc
cmp eax, 1
jne 0x435807
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 1
mov dword [esp + 0x54], 2
mov dword [esp + 4], str.SeLockMemoryPrivilege
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
sub esp, 0xc
cmp eax, 1
jne 0x435807
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
sub esp, 0x18
cmp eax, 1
jne 0x435807
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x435807
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [esp + 0x2c]
push eax
jmp 0x435988