Function at 0x481c20
Capabilities:
Manipulate user privileges

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov eax, dword [esp + 0x80]
test al, al
jne 0x481c40
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esp + 0x40]
mov ebx, eax
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
call edi
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x28
mov dword [esp], eax
mov esi, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call esi
sub esp, 0xc
cmp eax, 1
je 0x481ca0
call edi
lea edx, [esp + 0x38]
mov dword [esp + 4], 8
mov dword [esp], eax
mov dword [esp + 8], edx
call esi
sub esp, 0xc
cmp eax, 1
je 0x481d40
xor ebx, ebx
mov byte [0x7dd448], bl
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 1
mov dword [esp + 0x54], 2
mov dword [esp + 4], str.SeLockMemoryPrivilege
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
sub esp, 0xc
cmp eax, 1
jne 0x481c6d
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
sub esp, 0x18
cmp eax, 1
jne 0x481c6d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x481c6d
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
jmp 0x481c92
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [esp + 0x2c], eax
call eax
sub esp, 0x14
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x481dd0
lea eax, [esp + 0x48]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 0x14
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
jmp 0x481c90
mov dword [esp + 4], eax
mov dword [esp], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
sub esp, 8
mov ecx, eax
lea eax, [esp + 0x48]
mov dword [esp + 0x28], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 0x14
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esp + 0x2c], eax
call eax
sub esp, 4
mov edx, dword [esp + 0x28]
test edx, edx
je 0x481c90
xor edx, edx
xor eax, eax
mov dword [esp + eax + 0x48], edx
add eax, 4
cmp eax, 0x18
jb 0x481e39
lea eax, [esp + 0x3c]
mov dword [esp + 8], 0xf0fff
mov dword [esp], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x48]
mov dword [esp + 4], eax
call sub.ADVAPI32.dll_LsaOpenPolicy
sub esp, 0x10
test eax, eax
je 0x481e87
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
sub esp, 4
jmp 0x481c92
mov dword [esp], str.SeLockMemoryPrivilege
call sub.msvcrt.dll_wcstombs
lea edx, [eax + eax]
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], 1
mov dword [esp + 8], ebp
mov dword [esp + 0x44], str.SeLockMemoryPrivilege
mov word [esp + 0x42], ax
mov eax, dword [esp + 0x28]
mov word [esp + 0x40], dx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.dll_LsaAddAccountRights
sub esp, 0x10
test eax, eax
je 0x481ef0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.dll_LsaClose
sub esp, 4
jmp 0x481e70
mov dword [esp + 4], str.Huge_pages_support_was_successfully_enabled__but_reboot_required_to_use_it
mov dword [esp], 5
call fcn.00404ee0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.ADVAPI32.dll_LsaClose
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
sub esp, 4
call edi
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x28
mov dword [esp], eax
call esi
sub esp, 0xc
cmp eax, 1
jne 0x481c90
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 1
mov dword [esp + 0x54], 2
mov dword [esp + 4], str.SeLockMemoryPrivilege
mov dword [esp], 0
mov dword [esp + 8], eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
sub esp, 0xc
cmp eax, 1
jne 0x481c90
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
sub esp, 0x18
cmp eax, 1
jne 0x481c90
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x481c90
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [esp + 0x2c]
push eax
jmp 0x481c92