Function at 0x4021a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4324ab
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x454680]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x454680]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, ecx
lea ebx, [edi + 0xc]
push 4
mov dword [esp + 0x24], edi
mov dword [edi], vtable.pp::core::SmartHandleBase_void___class_pp::core::DefaultHandleDeleter_.0
mov byte [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebx], 0
mov dword [edi + 0x10], 0
call fcn.00413225
add esp, 4
test eax, eax
je 0x40220f
mov dword [eax], 0
jmp 0x402211
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push eax
mov dword [edi + 0x10], eax
call esi
mov dword [esp + 0x50], 0
mov byte [edi + 0x18], 1
lea ebp, [edi + 0x1c]
xorps xmm0, xmm0
movq qword [ebp], xmm0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [esp + 0x50], 1
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
push 4
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [esp + 0x30], vtable.pp::core::SmartHandleBase_void___class_pp::core::DefaultHandleDeleter_.0
mov byte [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call fcn.00413225
add esp, 4
test eax, eax
je 0x4022ac
mov dword [eax], 0
jmp 0x4022ae
xor eax, eax
push eax
mov dword [esp + 0x40], eax
call esi
push 2
push 0
push 0
lea eax, [esp + 0x44]
mov byte [esp + 0x5c], 2
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x4022ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00402eb0
push ebx
push 0
push 0x28
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4023b0
call esi
cmp eax, 0x3f0
je 0x40231c
mov ecx, eax
call fcn.00402eb0
mov dword [esp + 0x24], vtable.pp::security::SecurityContext.0
mov dword [esp + 0x24], vtable.pp::security::SelfSecurityContext.0
mov dword [esp + 0x28], 2
mov byte [esp + 0x50], 3
lea eax, [esp + 0x24]
mov dword [esp + 0x18], eax
mov ecx, eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x1c], 0
mov eax, dword [eax + 4]
call eax
mov byte [esp + 0x1c], al
mov byte [esp + 0x50], 4
test al, al
jne 0x402368
mov ecx, 0x3f0
call fcn.00402eb0
push ebx
push 0
push 0x28
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x402384
call esi
mov ecx, eax
call fcn.00402eb0
mov byte [esp + 0x50], 3
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x24]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x4023a3
call esi
mov ecx, eax
call fcn.00402eb0
mov byte [esp + 0x50], 2
mov dword [esp + 0x24], vtable.pp::security::SecurityContext.0
push ebp
push str.SeTcbPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x4023cb
call esi
mov ecx, eax
call fcn.00402eb0
push ebp
mov ecx, edi
call fcn.004025b0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 1
call fcn.004026a0
mov dword [esp + 0x50], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00413211
add esp, 0x40
ret 8