Function at 0x401bb0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
push ebp
push esi
push eax
call fcn.00401b30
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x401e14
push ebp
push 0
push 0x1001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401e14
lea ecx, [esp + 0x5c]
push ecx
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401e0d
lea edx, [esp + 0x14]
push edi
push edx
push str.SeDebugPrivilege
push 0
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], ecx
push edx
mov edx, dword [esp + 0x64]
push eax
lea ecx, [esp + 0x34]
push 0x10
push ecx
push 0
push edx
mov dword [esp + 0x44], 1
mov dword [esp + 0x50], 2
call edi
mov ecx, dword [esp + 0x60]
push 0
push 0
lea eax, [esp + 0x34]
push 0x10
push eax
push 1
push ecx
call edi
mov edx, dword [esp + 0x60]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00401ad0
mov eax, dword [esp + 0x6c]
push 1
push str.SeChangeNotifyPrivilege
push eax
call fcn.00401ad0
mov ecx, dword [esp + 0x78]
push 1
push str.SeTcbPrivilege
push ecx
call fcn.00401ad0
mov edx, dword [esp + 0x84]
push 1
push str.SeImpersonatePrivilege
push edx
call fcn.00401ad0
mov eax, dword [esp + 0x90]
push 1
push str.SeLoadDriverPrivilege
push eax
call fcn.00401ad0
mov ecx, dword [esp + 0x9c]
push 1
push str.SeRestorePrivilege
push ecx
call fcn.00401ad0
mov edx, dword [esp + 0xa8]
add esp, 0x48
push 1
push str.SeBackupPrivilege
push edx
call fcn.00401ad0
mov eax, dword [esp + 0x6c]
push 1
push str.SeSecurityPrivilege
push eax
call fcn.00401ad0
mov ecx, dword [esp + 0x78]
push 1
push str.SeSystemEnvironmentPrivilege
push ecx
call fcn.00401ad0
push 1
mov edx, dword [esp + 0x88]
push str.SeIncreaseQuotaPrivilege
push edx
call fcn.00401ad0
mov eax, dword [esp + 0x90]
push 1
push str.SeTakeOwnershipPrivilege
push eax
call fcn.00401ad0
mov ecx, dword [esp + 0x9c]
push 1
push str.SeIncreaseBasePriorityPrivilege
push ecx
call fcn.00401ad0
mov edx, dword [esp + 0xa8]
add esp, 0x48
push 1
push str.SeShutdownPrivilege
push edx
call fcn.00401ad0
mov eax, dword [esp + 0x6c]
push 1
push str.SeAssignPrimaryTokenPrivilege
push eax
call fcn.00401ad0
add esp, 0x18
xor edi, edi
lea edx, [esp + 0x20]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], edi
push edx
mov byte [esp + 0x24], 1
mov byte [esp + 0x25], 1
mov byte [esp + 0x2b], 0x10
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], 0x20
mov dword [esp + 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [esp + 0x60]
add eax, 8
push eax
lea eax, [esp + 0x14]
push eax
push 0x19
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea edx, [esp + 0x3c]
push ebp
push edx
call fcn.00401980
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
push eax
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
call fcn.00401a90
add esp, 0x18
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x40]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
add esp, 0x50
ret