Function at 0x1000423c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10032068]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
push ebx
cmovae ecx, dword [ebp + 8]
push esi
push edi
call fcn.100040a8
test eax, eax
je 0x100044fb
push eax
xor esi, esi
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100044fb
lea eax, [ebp - 0x2c]
push eax
push 0xf01ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100044fb
lea eax, [ebp - 0x18]
mov edi, str.SeDebugPrivilege
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
push esi
push esi
push 0x10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100044fb
push ecx
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeCreateTokenPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeAssignPrimaryTokenPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeLockMemoryPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeIncreaseQuotaPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeUnsolicitedInputPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeMachineAccountPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeTcbPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeSecurityPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeTakeOwnershipPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeLoadDriverPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeSystemProfilePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeSystemtimePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeProfileSingleProcessPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeIncreaseBasePriorityPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeCreatePagefilePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeCreatePermanentPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeBackupPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeRestorePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeShutdownPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, edi
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeAuditPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeSystemEnvironmentPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeChangeNotifyPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeRemoteShutdownPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeUndockPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeSyncAgentPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeEnableDelegationPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeManageVolumePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeImpersonatePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeCreateGlobalPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeTrustedCredManAccessPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeRelabelPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeIncreaseWorkingSetPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeTimeZonePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeCreateSymbolicLinkPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x2c]
mov edx, str.SeDelegateSessionUserImpersonatePrivilege
call fcn.100041c6
xor eax, eax
mov dword [ebp - 0x30], 0x20
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], 0x101
mov byte [ebp - 9], 0x10
mov dword [ebp - 8], esi
mov dword [ebp - 0x34], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x34]
push eax
push 0x19
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
lea ecx, [ebp + 8]
call fcn.10006c45
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008b95
leave
ret