Function at 0x52d190
Capabilities:
Acquire debug privileges
Set current directory

Disassembly:
mov eax, 0xcf24
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0xcf20], eax
mov eax, dword [esp + 0xcf30]
push ebp
mov ebp, dword [esp + 0xcf38]
push esi
mov esi, dword [esp + 0xcf30]
push edi
mov edi, dword [esp + 0xcf44]
mov byte [esp + 0xc], 0
mov byte [esp + 0x40c], 0
mov dword [0x693914], ebp
mov dword [0x752acc], eax
test eax, eax
je 0x52d1e9
mov dword [eax], 0
push 0x752a38
mov dword [0x752a38], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x752a48], 2
jne 0x52d3e3
push 0
push str.SeCreateTokenPrivilege
mov dword [0x7523dc], 1
call fcn.004e21c0
push 0
push str.SeAssignPrimaryTokenPrivilege
call fcn.004e21c0
push 0
push str.SeLockMemoryPrivilege
call fcn.004e21c0
push 0
push str.SeIncreaseQuotaPrivilege
call fcn.004e21c0
push 0
push str.SeUnsolicitedInputPrivilege
call fcn.004e21c0
push 0
push str.SeMachineAccountPrivilege
call fcn.004e21c0
push 0
push 0x64a7d4
call fcn.004e21c0
push 0
push str.SeSecurityPrivilege
call fcn.004e21c0
add esp, 0x40
push 0
push str.SeTakeOwnershipPrivilege
call fcn.004e21c0
push 0
push str.SeLoadDriverPrivilege
call fcn.004e21c0
push 0
push str.SeSystemProfilePrivilege
call fcn.004e21c0
push 0
push str.SeSystemtimePrivilege
call fcn.004e21c0
push 0
push str.SeProfileSingleProcessPrivilege
call fcn.004e21c0
push 0
push str.SeIncreaseBasePriorityPrivilege
call fcn.004e21c0
push 0
push str.SeCreatePagefilePrivilege
call fcn.004e21c0
push 0
push str.SeCreatePermanentPrivilege
call fcn.004e21c0
add esp, 0x40
push 0
push str.SeBackupPrivilege
call fcn.004e21c0
push 0
push str.SeRestorePrivilege
call fcn.004e21c0
push 0
push str.SeShutdownPrivilege
call fcn.004e21c0
push 0
push 0x643ce8
call fcn.004e21c0
push 0
push str.SeAuditPrivilege
call fcn.004e21c0
push 0
push str.SeSystemEnvironmentPrivilege
call fcn.004e21c0
push 0
push 0x650778
call fcn.004e21c0
push 0
push str.SeRemoteShutdownPrivilege
call fcn.004e21c0
add esp, 0x40
push 0xcb20
lea eax, [esp + 0x410]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x414]
push edx
call fcn.004ec3a0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esp + 0xcf38]
mov ecx, dword [str.trayico]
mov edx, dword [0x636740]
mov dword [esp + 0x40c], ecx
mov dword [esp + 0x410], edx
test eax, eax
je 0x52d3b1
cmp byte [eax], 0
je 0x52d3b1
lea edx, [esp + 0x40c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x52d3a7
push edi
test ebp, ebp
je 0x52d3f2
push 0
lea eax, [esp + 0x414]
push eax
push 0
push 0x52aa40
call fcn.0052c7b0
cmp ebp, 0x4db
jne 0x52d40a
mov edx, dword [0x752acc]
mov eax, dword [0x752ad0]
mov dword [edx], eax
jmp 0x52d420
mov dword [0x7523dc], 0
jmp 0x52d33e
push 1
lea ecx, [esp + 0x414]
push ecx
push 0
push 0x52aa40
call fcn.0052c7b0
jmp 0x52d420
cmp ebp, 1
jne 0x52d420
cmp dword [0x75264c], ebp
jne 0x52d420
push ebp
call fcn.00509e50
add esp, 4
mov ecx, dword [esp + 0xcf2c]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.005dfbbe
add esp, 0xcf24
ret