Function at 0x40bccc
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov esi, str.SeDebugPrivilege
push esi
call fcn.0040bada
push esi
call fcn.0040bada
push str.NtQuerySystemInformation
mov esi, str.ntdll.dll
push esi
call fcn.0040c388
push str.NtDuplicateObject
push esi
mov ebx, eax
call fcn.0040c388
push str.NtQueryObject
push esi
mov dword [esp + 0x48], eax
call fcn.0040c388
mov dword [esp + 0x4c], eax
mov al, byte [esp + 0x68]
xor ecx, ecx
add esp, 0x20
mov ebp, ecx
test al, al
jne 0x40bded
mov edi, 0x10000
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
jmp 0x40bdc4
add edi, edi
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, dword [0x4301c4]
mov ebp, eax
test esi, esi
jne 0x40bd7b
push 0x362
mov eax, 0x43174c
push eax
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [0x4301c4]
mov eax, dword [0x4301c0]
mov ecx, eax
not ecx
and ecx, 0x3b9
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
neg ecx
or edx, ecx
inc esi
mov eax, 0x30f
cmove esi, eax
mov eax, edx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov dword [0x4301c4], esi
mov dword [0x4301c0], edx
xor esi, esi
push esi
push edi
push ebp
push 0x10
call ebx
cmp eax, 0xc0000004
je 0x40bd42
test eax, eax
js 0x40bde0
test ebp, ebp
jne 0x40bde7
xor al, al
jmp 0x40c2f7
mov al, byte [esp + 0x48]
xor ecx, ecx
mov ebx, dword [esp + 0x44]
mov byte [esp + 0x13], cl
mov esi, ecx
lea edi, [ebp + 4]
test al, al
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov eax, 0xffff
jne 0x40be0e
mov eax, dword [ebp]
cmp esi, eax
jae 0x40c2e6
mov esi, edi
lea edi, [esp + 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x3c], 0x12019f
je 0x40c2cf
push dword [esp + 0x30]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov si, word [esp + 0x36]
mov edi, eax
test edi, edi
je 0x40be74
xor eax, eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
movzx eax, si
push eax
push edi
call dword [esp + 0x44]
test eax, eax
jns 0x40be74
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c2cd
mov ecx, dword [0x4301c0]
mov eax, ecx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
shr ecx, 1
mov edx, 0x80000000
and eax, edx
add eax, edx
or ecx, eax
mov edx, dword [0x4301c4]
mov eax, ecx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
neg eax
add ecx, ecx
or ecx, eax
or edx, 0x37f
inc edx
mov eax, 0x18b
cmove edx, eax
mov eax, ecx
not eax
and eax, 0x3b9
or edx, 0x207
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
shr ecx, 1
or ecx, eax
mov eax, ecx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
shr ecx, 1
movzx esi, si
or ecx, eax
mov dword [esp + 0x18], esi
mov dword [0x4301c4], edx
mov dword [0x4301c0], ecx
test edx, edx
jne 0x40bf1e
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x4301c4]
inc edx
mov eax, 0xe1
cmove edx, eax
push 0x1000
xor eax, eax
push eax
mov dword [0x4301c4], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40bffc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4301c4]
or eax, 0x2e6
mov dword [0x4301c4], eax
jne 0x40bf76
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4301c4]
jmp 0x40bf78
xor esi, esi
mov ecx, 0x3e8
cmp eax, ecx
cmove eax, ecx
mov dword [0x4301c4], eax
test eax, eax
jne 0x40bfc3
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4301c4]
test eax, eax
jne 0x40bfc3
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4301c4]
test eax, eax
jne 0x40bfc3
push 0x234
mov eax, 0x431750
push eax
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x4301c4]
inc eax
mov ecx, 0xf4
cmove eax, ecx
mov ecx, dword [0x4301c0]
mov dword [0x4301c4], eax
mov eax, ecx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
mov edx, 0x80000000
and eax, edx
add eax, edx
shr ecx, 1
or ecx, eax
mov dword [0x4301c0], ecx
jmp 0x40c2cd
mov ecx, dword [0x4301c4]
test ecx, ecx
jne 0x40c015
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4301c4]
mov edx, dword [0x4301c0]
mov eax, edx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
shr edx, 1
or edx, eax
inc ecx
mov eax, 0x336
cmove ecx, eax
mov eax, 0x9f
cmp ecx, eax
cmove ecx, eax
mov dword [0x4301c0], edx
mov dword [0x4301c4], ecx
test ecx, ecx
jne 0x40c06e
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4301c4]
mov edx, dword [0x4301c0]
mov eax, 0xc8
cmp ecx, eax
cmove ecx, eax
inc ecx
push 0x26
mov eax, 0x80
cmove ecx, eax
pop eax
cmp ecx, eax
cmove ecx, eax
mov eax, edx
not eax
and eax, 0x3b9
or ecx, 0xfd
neg eax
sbb eax, eax
mov dword [0x4301c4], ecx
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or eax, edx
mov dword [0x4301c0], eax
xor eax, eax
push eax
push 0x1000
push dword [esp + 0x1c]
push 2
push esi
call dword [esp + 0x40]
test eax, eax
jns 0x40c0eb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40c2cd
push esi
call fcn.0040b64e
pop ecx
mov esi, eax
xor ecx, ecx
test esi, esi
je 0x40c161
cmp word [esi], cx
jbe 0x40c161
mov eax, dword [esp + 0x30]
inc dword [ebx + 0x1c]
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 8], eax
mov al, byte [esp + 0x34]
mov byte [ebx + 0xc], al
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], ecx
mov dword [ebx + 4], edi
cmp dword [eax], ecx
je 0x40c1be
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
push ebx
call dword [eax + ecx*8]
inc dword [ebx + 0x18]
pop ecx
cmp eax, 1
je 0x40c153
test eax, eax
je 0x40c1be
cmp eax, 2
je 0x40c1b9
xor eax, eax
mov dword [esp + 0x18], eax
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
cmp dword [eax + ecx*8], 0
jne 0x40c131
jmp 0x40c1be
mov eax, dword [esp + 0x30]
inc dword [ebx + 0x1c]
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x10], eax
mov al, byte [esp + 0x34]
mov byte [ebx + 0xc], al
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 4], edi
cmp dword [eax], ecx
je 0x40c1be
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
push ebx
call dword [eax + ecx*8]
inc dword [ebx + 0x18]
pop ecx
mov ecx, dword [ebx + 0x18]
cmp eax, 1
je 0x40c1ae
test eax, eax
je 0x40c1be
cmp eax, 2
je 0x40c1b9
mov eax, dword [ebx + 0x20]
cmp dword [eax + ecx*8], 0
jne 0x40c18f
jmp 0x40c1be
mov byte [esp + 0x13], 1
push dword [esp + 0x14]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x40c1e7
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x4301c0]
mov esi, dword [0x4301c4]
mov edx, eax
not edx
and edx, 0x3b9
neg edx
sbb edx, edx
mov ecx, 0x80000000
and edx, ecx
shr eax, 1
add edx, ecx
or edx, eax
push 0x63
pop eax
cmp esi, eax
cmove esi, eax
mov dword [0x4301c0], edx
mov dword [0x4301c4], esi
test esi, esi
jne 0x40c246
push 0xc2
mov eax, 0x431754
push eax
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [0x4301c4]
mov edx, dword [0x4301c0]
mov ecx, edx
not ecx
and ecx, 0x3b9
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or ecx, eax
mov edx, ecx
not edx
and edx, 0x3b9
neg edx
sbb edx, edx
lea eax, [ecx + ecx]
neg edx
or edx, eax
mov ecx, edx
not ecx
inc esi
mov eax, 0x2a4
cmove esi, eax
and ecx, 0x3b9
neg ecx
sbb ecx, ecx
mov eax, 0x80000000
and ecx, eax
add ecx, eax
shr edx, 1
or ecx, edx
mov eax, ecx
not eax
and eax, 0x3b9
or esi, 0x37a
neg eax
sbb eax, eax
mov edx, 0x80000000
and eax, edx
add eax, edx
shr ecx, 1
or eax, ecx
push edi
mov dword [0x4301c4], esi
mov dword [0x4301c0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0
jne 0x40c2e4
xor ecx, ecx
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov al, byte [esp + 0x48]
inc esi
add edi, 0x10
jmp 0x40bdfa
xor ecx, ecx
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret