Function at 0x4152b0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c4c
call fcn.00408820
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 0x2810
lea eax, [ebp - 0x2c14]
mov ebx, edx
push edi
push eax
mov esi, ecx
mov dword [ebp - 0x2c48], ebx
mov dword [ebp - 0x2c4c], edi
call fcn.00405300
add esp, 0xc
lea ecx, [ebp - 0x2c4c]
push ecx
push 0x2810
lea edx, [ebp - 0x2c14]
push edx
push 3
push ebx
call dword [0x46504c]
test eax, eax
jne 0x415329
call dword [0x4651b0]
push eax
push str.LogTokenPermissions:_could_not_obtain_token_privilege_information:_0x_08x
push 1
call fcn.004343f0
jmp 0x4154ee
mov eax, dword [ebp - 0x2c14]
push eax
push str.LogTokenPermissions:_number_of_privileges:__d
push esi
push 2
call fcn.00434420
add esp, 0x10
call fcn.004344e0
test al, 0x20
je 0x415dd2
cmp dword [ebp - 0x2c14], edi
jbe 0x4154e1
lea ebx, [ebp - 0x2c08]
nop
push 0x1ff
lea ecx, [ebp - 0x203]
push 0
push ecx
mov byte [ebp - 0x204], 0
call fcn.00405300
push 0x1ff
lea edx, [ebp - 0x403]
push 0
push edx
mov byte [ebp - 0x404], 0
call fcn.00405300
add esp, 0x18
lea eax, [ebp - 0x2c40]
push eax
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebx - 8]
push edx
push 0
mov dword [ebp - 0x2c40], 0x200
mov dword [ebp - 0x2c44], 0
call dword [0x465050]
test eax, eax
jne 0x4153f6
call dword [0x4651b0]
push eax
push edi
push str.LogTokenPermissions:_LookupPrivilegeName_failed_on_Privilege___d_0x_08x
push 1
call fcn.004343f0
push 0x200
lea eax, [ebp - 0x204]
push str._empty_
push eax
call fcn.004581b0
add esp, 0x1c
lea ecx, [ebp - 0x2c44]
push ecx
lea edx, [ebp - 0x2c40]
push edx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x204]
push ecx
push 0
mov dword [ebp - 0x2c40], 0x200
call dword [0x465054]
test eax, eax
jne 0x415455
call dword [0x4651b0]
push eax
push edi
push str.LogTokenPermissions:_LookupPrivilegeDisplayName_failed_on_Privilege___d_0x_08x
push 1
call fcn.004343f0
push 0x200
lea edx, [ebp - 0x404]
push str._empty_
push edx
call fcn.004581b0
add esp, 0x1c
mov ecx, dword [ebx]
mov eax, str._no_privileges_
test ecx, ecx
je 0x415465
mov eax, 0x465a90
push eax
push ecx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x204]
push ecx
push edi
push str.LogTokenPermissions:_Privilege___d:__s___s___attributes_are_0x_08x__s
push esi
push 0x20
call fcn.00434420
add esp, 0x20
test byte [ebx], 2
je 0x41549c
push edi
push str.LogTokenPermissions:_Privilege___d:_SE_PRIVILEGE_ENABLED
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [ebx], 1
je 0x4154b2
push edi
push str.LogTokenPermissions:_Privilege___d:_SE_PRIVILEGE_ENABLED_BY_DEFAULT
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test dword [ebx], 0x80000000
je 0x4154cb
push edi
push str.LogTokenPermissions:_Privilege___d:_SE_PRIVILEGE_USED_FOR_ACCESS
push esi
push 0x20
call fcn.00434420
add esp, 0x10
inc edi
add ebx, 0xc
cmp edi, dword [ebp - 0x2c14]
jb 0x415360
mov ebx, dword [ebp - 0x2c48]
push str.LogTokenPermissions:_Done_enumerating_Privileges
push esi
push 0x20
call fcn.00434420
add esp, 0xc
push 0x282c
lea edx, [ebp - 0x2c30]
push 0
push edx
mov dword [ebp - 0x2c44], 0
call fcn.00405300
add esp, 0xc
lea eax, [ebp - 0x2c44]
push eax
push 0x282c
lea ecx, [ebp - 0x2c30]
push ecx
push 0xd
push ebx
call dword [0x46504c]
test eax, eax
jne 0x415549
call dword [0x4651b0]
push eax
push str.LogTokenPermissions:_could_not_obtain_token_group_privilege_information:_0x_08x
push 4
call fcn.004343f0
jmp 0x415943
mov edx, dword [ebp - 0x2c30]
push edx
push str.LogTokenPermissions:_number_of_SIDs:__d
push esi
push 0x20
call fcn.00434420
xor ebx, ebx
add esp, 0x10
cmp dword [ebp - 0x2c30], ebx
jbe 0x415657
mov edi, edi
mov eax, dword [ebp - 0x2c28]
push ebx
push str.LogTokenPermissions:_SID___d:
lea edi, [eax + ebx*8]
push esi
push 0x20
mov dword [ebp - 0x2c40], edi
call fcn.00434420
mov edi, dword [edi]
add esp, 0x10
call fcn.00413ff0
mov ecx, dword [ebp - 0x2c40]
test byte [ecx + 4], 4
je 0x4155b4
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_ENABLED
push esi
push 0x20
call fcn.00434420
add esp, 0x10
mov edi, dword [ebp - 0x2c40]
test byte [edi + 4], 2
je 0x4155d1
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_ENABLED_BY_DEFAULT
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test dword [edi + 4], 0xc0000000
je 0x4155eb
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_LOGON_ID
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi + 4], 1
je 0x415602
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_MANDATORY
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi + 4], 8
je 0x415619
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_OWNER
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test dword [edi + 4], 0x20000000
je 0x415633
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_RESOURCE
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi + 4], 0x10
je 0x41564a
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_USE_FOR_DENY_ONLY
push esi
push 0x20
call fcn.00434420
add esp, 0x10
inc ebx
cmp ebx, dword [ebp - 0x2c30]
jb 0x415570
mov edx, dword [ebp - 0x2c24]
push edx
push str.LogTokenPermissions:_number_of_restricted_SIDs:__d
push esi
push 0x20
call fcn.00434420
xor ebx, ebx
add esp, 0x10
cmp dword [ebp - 0x2c24], ebx
jbe 0x415767
lea esp, [esp]
mov eax, dword [ebp - 0x2c1c]
push ebx
push str.LogTokenPermissions:_restricted_SID___d:
lea edi, [eax + ebx*8]
push esi
push 0x20
mov dword [ebp - 0x2c40], edi
call fcn.00434420
mov edi, dword [edi]
add esp, 0x10
call fcn.00413ff0
mov ecx, dword [ebp - 0x2c40]
test byte [ecx + 4], 4
je 0x4156c4
push ebx
push str.LogTokenPermissions:_restricted_SID___d:_SE_GROUP_ENABLED
push esi
push 0x20
call fcn.00434420
add esp, 0x10
mov edi, dword [ebp - 0x2c40]
test byte [edi + 4], 2
je 0x4156e1
push ebx
push str.LogTokenPermissions:_restricted_SID___d:_SE_GROUP_ENABLED_BY_DEFAULT
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test dword [edi + 4], 0xc0000000
je 0x4156fb
push ebx
push str.LogTokenPermissions:_restricted_SID___d:_SE_GROUP_LOGON_ID
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi + 4], 1
je 0x415712
push ebx
push str.LogTokenPermissions:_restricted_SID___d:_SE_GROUP_MANDATORY
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi + 4], 8
je 0x415729
push ebx
push str.LogTokenPermissions:_restricted_SID___d:_SE_GROUP_OWNER
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test dword [edi + 4], 0x20000000
je 0x415743
push ebx
push str.LogTokenPermissions:_restricted_SID___d:_SE_GROUP_RESOURCE
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi + 4], 0x10
je 0x41575a
push ebx
push str.LogTokenPermissions:_restricted_SID___d:_SE_GROUP_USE_FOR_DENY_ONLY
push esi
push 0x20
call fcn.00434420
add esp, 0x10
inc ebx
cmp ebx, dword [ebp - 0x2c24]
jb 0x415680
mov edx, dword [ebp - 0x2c18]
push edx
push str.LogTokenPermissions:_number_of_privileges:__d
push esi
push 2
call fcn.00434420
xor edi, edi
add esp, 0x10
cmp dword [ebp - 0x2c18], edi
jbe 0x415930
xor ebx, ebx
mov edi, edi
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.00405300
push 0x1ff
lea ecx, [ebp - 0x403]
push 0
push ecx
mov byte [ebp - 0x404], 0
call fcn.00405300
mov ecx, dword [ebp - 0x2c10]
add esp, 0x18
lea edx, [ebp - 0x2c40]
push edx
lea eax, [ebp - 0x204]
push eax
add ecx, ebx
push ecx
push 0
mov dword [ebp - 0x2c40], 0x200
mov dword [ebp - 0x2c4c], 0
call dword [0x465050]
test eax, eax
jne 0x41582b
call dword [0x4651b0]
push eax
push edi
push str.LogTokenPermissions:_LookupPrivilegeName_failed_on_Privilege___d_0x_08x
push 1
call fcn.004343f0
push 0x200
lea edx, [ebp - 0x204]
push str._empty_
push edx
call fcn.004581b0
add esp, 0x1c
lea eax, [ebp - 0x2c4c]
push eax
lea ecx, [ebp - 0x2c40]
push ecx
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x204]
push eax
push 0
mov dword [ebp - 0x2c40], 0x200
call dword [0x465054]
test eax, eax
jne 0x41588a
call dword [0x4651b0]
push eax
push edi
push str.LogTokenPermissions:_LookupPrivilegeDisplayName_failed_on_Privilege___d_0x_08x
push 1
call fcn.004343f0
push 0x200
lea ecx, [ebp - 0x404]
push str._empty_
push ecx
call fcn.004581b0
add esp, 0x1c
mov edx, dword [ebp - 0x2c10]
mov ecx, dword [edx + ebx + 8]
mov eax, str._no_privileges_
test ecx, ecx
je 0x4158a2
mov eax, 0x465a90
push eax
push ecx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x204]
push ecx
push edi
push str.LogTokenPermissions:_Privilege___d:__s___s___attributes_are_0x_08x__s
push esi
push 0x20
call fcn.00434420
mov edx, dword [ebp - 0x2c10]
add esp, 0x20
test byte [edx + ebx + 8], 2
je 0x4158e1
push edi
push str.LogTokenPermissions:_Privilege___d:_SE_PRIVILEGE_ENABLED
push esi
push 0x20
call fcn.00434420
add esp, 0x10
mov eax, dword [ebp - 0x2c10]
test byte [eax + ebx + 8], 1
je 0x4158ff
push edi
push str.LogTokenPermissions:_Privilege___d:_SE_PRIVILEGE_ENABLED_BY_DEFAULT
push esi
push 0x20
call fcn.00434420
add esp, 0x10
mov ecx, dword [ebp - 0x2c10]
test dword [ecx + ebx + 8], 0x80000000
je 0x415920
push edi
push str.LogTokenPermissions:_Privilege___d:_SE_PRIVILEGE_USED_FOR_ACCESS
push esi
push 0x20
call fcn.00434420
add esp, 0x10
inc edi
add ebx, 0xc
cmp edi, dword [ebp - 0x2c18]
jb 0x415790
push str.LogTokenPermissions:_Done_enumerating_Privileges
push esi
push 0x20
call fcn.00434420
mov ebx, dword [ebp - 0x2c48]
add esp, 0xc
push 0x280c
lea edx, [ebp - 0x2c10]
push 0
push edx
mov dword [ebp - 0x2c44], 0
call fcn.00405300
add esp, 0xc
lea eax, [ebp - 0x2c44]
push eax
push 0x280c
lea ecx, [ebp - 0x2c10]
push ecx
push 2
push ebx
call dword [0x46504c]
test eax, eax
jne 0x4159a1
call dword [0x4651b0]
push eax
push str.LogTokenPermissions:_could_not_obtain_token_privilege_information_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x415aad
mov edx, dword [ebp - 0x2c10]
push edx
push str.LogTokenPermissions:_number_of_groups:__d
push esi
push 0x20
call fcn.00434420
xor ebx, ebx
add esp, 0x10
cmp dword [ebp - 0x2c10], ebx
jbe 0x415aad
lea eax, [ebp - 0x2c08]
mov dword [ebp - 0x2c40], eax
push ebx
push str.LogTokenPermissions:_groups___d:
push esi
push 0x20
call fcn.00434420
mov ecx, dword [ebp - 0x2c40]
mov edi, dword [ecx - 4]
add esp, 0x10
call fcn.00413ff0
mov edi, dword [ebp - 0x2c40]
test byte [edi], 4
je 0x415a0d
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_ENABLED
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi], 2
je 0x415a23
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_ENABLED_BY_DEFAULT
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test dword [edi], 0xc0000000
je 0x415a3c
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_LOGON_ID
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi], 1
je 0x415a52
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_MANDATORY
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi], 8
je 0x415a68
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_OWNER
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test dword [edi], 0x20000000
je 0x415a81
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_RESOURCE
push esi
push 0x20
call fcn.00434420
add esp, 0x10
test byte [edi], 0x10
je 0x415a97
push ebx
push str.LogTokenPermissions:_Group___d:_SE_GROUP_USE_FOR_DENY_ONLY
push esi
push 0x20
call fcn.00434420
add esp, 0x10
inc ebx
add edi, 8
mov dword [ebp - 0x2c40], edi
cmp ebx, dword [ebp - 0x2c10]
jb 0x4159d2
push 0x2804
lea edx, [ebp - 0x2c08]
push 0
push edx
mov dword [ebp - 0x2c44], 0
call fcn.00405300
mov ebx, dword [ebp - 0x2c48]
mov edi, dword [0x46504c]
add esp, 0xc
lea eax, [ebp - 0x2c44]
push eax
push 0x2804
lea ecx, [ebp - 0x2c08]
push ecx
push 4
push ebx
call edi
test eax, eax
jne 0x415b0d
call dword [0x4651b0]
push eax
push str.LogTokenPermissions:_could_not_obtain_token_owner_information:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x415b2e
push str.LogTokenPermissions:_owner_SID:
push esi
push 0x20
call fcn.00434420
mov edi, dword [ebp - 0x2c08]
add esp, 0xc
call fcn.00413ff0
mov edi, dword [0x46504c]
push 0x2804
lea edx, [ebp - 0x2c08]
push 0
push edx
mov dword [ebp - 0x2c44], 0
call fcn.00405300
add esp, 0xc
lea eax, [ebp - 0x2c44]
push eax
push 0x2804
lea ecx, [ebp - 0x2c08]
push ecx
push 5
push ebx
call edi
test eax, eax
jne 0x415b82
call dword [0x4651b0]
push eax
push str.LogTokenPermissions:_could_not_obtain_token_primary_group:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x415ba3
push str.LogTokenPermissions:_Token_Primary_Group:
push esi
push 0x20
call fcn.00434420
mov edi, dword [ebp - 0x2c08]
add esp, 0xc
call fcn.00413ff0
mov edi, dword [0x46504c]
push 0x2810
lea edx, [ebp - 0x2c14]
push 0
push edx
mov dword [ebp - 0x2c44], 0
call fcn.00405300
add esp, 0xc
lea eax, [ebp - 0x2c44]
push eax
push 0x2810
lea ecx, [ebp - 0x2c14]
push ecx
push 7
push ebx
call edi
test eax, eax
jne 0x415bf7
call dword [0x4651b0]
push eax
push str.LogTokenPermissions:_could_not_obtain_token_source:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x415c47
movsx edx, byte [ebp - 0x2c0d]
movsx eax, byte [ebp - 0x2c0e]
movsx ecx, byte [ebp - 0x2c0f]
push edx
movsx edx, byte [ebp - 0x2c10]
push eax
movsx eax, byte [ebp - 0x2c11]
push ecx
movsx ecx, byte [ebp - 0x2c12]
push edx
movsx edx, byte [ebp - 0x2c13]
push eax
movsx eax, byte [ebp - 0x2c14]
push ecx
push edx
push eax
push str.LogTokenPermissions:_Token_Source:__c_c_c_c_c_c_c_c
push esi
push 0x20
call fcn.00434420
add esp, 0x2c
push 0x2838
lea ecx, [ebp - 0x2c3c]
push 0
push ecx
mov dword [ebp - 0x2c44], 0
call fcn.00405300
add esp, 0xc
lea edx, [ebp - 0x2c44]
push edx
push 0x2838
lea eax, [ebp - 0x2c3c]
push eax
push 0xa
push ebx
call edi
test eax, eax
jne 0x415c9e
call dword [0x4651b0]
push eax
push str.LogTokenPermissions:_could_not_obtain_token_statistics:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x415d63
mov ecx, dword [ebp - 0x2c24]
mov eax, ecx
sub eax, 1
je 0x415cca
sub eax, 1
je 0x415cc3
push ecx
push str.LogTokenPermissions:_Token_Type:__unknown:_0x_08x_
push esi
push 0x20
call fcn.00434420
add esp, 0x10
jmp 0x415cda
push str.LogTokenPermissions:_Token_Type:_Impersonated
jmp 0x415ccf
push str.LogTokenPermissions:_Token_Type:_Primary
push esi
push 0x20
call fcn.00434420
add esp, 0xc
mov eax, dword [ebp - 0x2c20]
cmp eax, 3
ja case.default.0x415ce5
jmp dword [eax*4 + 0x415de8]
push str.LogTokenPermissions:_Token_Impersonation:_SecurityAnonymous
push esi
push 0x20
call fcn.00434420
add esp, 0xc
jmp 0x415d45
push str.LogTokenPermissions:_Token_Impersonation:_SecurityIdentification
push esi
push 0x20
call fcn.00434420
add esp, 0xc
jmp 0x415d45
push str.LogTokenPermissions:_Token_Impersonation:_SecurityImpersonation
push esi
push 0x20
call fcn.00434420
add esp, 0xc
jmp 0x415d45
push str.LogTokenPermissions:_Token_Impersonation:_SecurityDelegation
push esi
push 0x20
call fcn.00434420
add esp, 0xc
jmp 0x415d45
push eax
push str.LogTokenPermissions:_Token_Impersonation:__unknown:_0x_08x_
push esi
push 0x20
call fcn.00434420
add esp, 0x10
mov ecx, dword [ebp - 0x2c10]
mov edx, dword [ebp - 0x2c14]
push ecx
push edx
push str.LogTokenPermissions:_Group_Count__d_Privilege_Count__d
push esi
push 0x20
call fcn.00434420
add esp, 0x14
push 0x2808
lea eax, [ebp - 0x2c0c]
push 0
push eax
mov dword [ebp - 0x2c44], 0
call fcn.00405300
add esp, 0xc
lea ecx, [ebp - 0x2c44]
push ecx
push 0x2808
lea edx, [ebp - 0x2c0c]
push edx
push 1
push ebx
call edi
test eax, eax
jne 0x415db7
call dword [0x4651b0]
push eax
push str.LogTokenPermissions:_could_not_obtain_token_user:_0x_08x
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x415dd2
push str.LogTokenPermissions:_Token_User:
push esi
push 0x20
call fcn.00434420
mov edi, dword [ebp - 0x2c0c]
add esp, 0xc
call fcn.00413ff0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040506e
mov esp, ebp
pop ebp
ret