Function at 0x10046f40
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d8
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x15c], 0
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [ebp - 0x160], eax
push 0
push 2
call fcn.1002a798
mov dword [ebp - 8], eax
mov dword [ebp - 0x158], 0x128
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1002a79e
push str.explorer.exe
lea edx, [ebp - 0x134]
push edx
call fcn.100171d1
add esp, 8
test eax, eax
jne 0x10046fd4
mov dword [ebp - 0x1c8], 0
lea eax, [ebp - 0x1c8]
push eax
mov ecx, dword [ebp - 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x10046fd4
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x10], edx
jmp 0x10046fe8
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1002a7a4
test eax, eax
jne 0x10046f8f
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x1008b3ec]
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov dword [ebp - 4], 0x30
push 0x44
push 0
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0x1a8], 0x44
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x3cc], eax
lea edx, [ebp - 0x3d0]
push edx
push 0x104
lea eax, [ebp - 0x3c8]
push eax
push 2
mov ecx, dword [ebp - 0x3cc]
push ecx
call dword [sym.imp.USER32.dll_GetUserObjectInformationA]
mov edx, 5
mov word [ebp - 0x178], dx
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x1a0], eax
push 0x10
push 0
lea ecx, [ebp - 0x28]
push ecx
call fcn.100139b0
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0xf01ff
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100470c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3d4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Process_token_open_Error:__u_n
call fcn.1001513b
add esp, 8
lea edx, [ebp - 0x1b4]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x100470ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Lookup_Privilege_value_Error:__u_n
call fcn.1001513b
add esp, 8
mov dword [ebp - 0x1c4], 1
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c0], eax
mov ecx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x1b8], 2
mov edx, dword [ebp + 8]
push edx
push 1
push 1
push 0
push 0x2000000
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1ac], eax
push 4
mov ecx, dword [0x1008b3ec]
push ecx
push 0xc
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push 0
push 0
push 0x10
lea eax, [ebp - 0x1c4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10047192
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3d8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Adjust_Privilege_value_Error:__u_n
call fcn.1001513b
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x100471ac
push str.Token_does_not_have_the_provilege_n
call fcn.1001513b
add esp, 4
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret