Function at 0x474154
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4f5470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x164]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x144], eax
push edi
mov dword [ebp - 0x140], ebx
call fcn.00474c8c
push dword [0x4f538c]
lea ecx, [ebp - 0xac]
call fcn.0040aa10
mov edi, 0x200
mov dword [ebp - 0x140], edi
call fcn.00416130
cmp dword [eax + 0x1c], 1
jne 0x4741d2
mov esi, dword [str.ucguard_x64.sys]
push esi
call fcn.004047d0
pop ecx
push eax
push esi
lea ecx, [ebp - 0xac]
call fcn.00408730
mov edi, 0x100
mov dword [ebp - 0x140], edi
mov eax, str.drivers
push eax
mov dword [ebp - 0x15c], eax
call fcn.00404800
mov dword [ebp - 0x158], eax
mov eax, 0x4cf3c4
push eax
mov dword [ebp - 0x154], eax
call fcn.00404800
pop ecx
pop ecx
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00406040
mov ecx, eax
call fcn.00406040
mov ecx, eax
call fcn.00405dd0
lea ecx, [ebp - 0x1c]
call fcn.00405610
lea ecx, [ebp - 0x34]
call fcn.00405610
lea eax, [ebp - 0xc4]
push eax
call fcn.0040d5e0
pop ecx
test al, al
jne 0x474267
xor bl, bl
jmp 0x474a44
lea ecx, [ebp - 0xdc]
call fcn.00405570
lea eax, [ebp - 0xdc]
push eax
push 0x66
call fcn.004187f0
pop ecx
pop ecx
push 2
pop esi
test al, al
jne 0x4742cb
call fcn.0040a000
cmp eax, esi
jg 0x4742b8
push esi
push 0x60
xor ebx, ebx
lea ecx, [ebp - 0x214]
push str.d:webapps_b_build_slave_repo_build_srcwowchromeinstallerutilwow_guarder_installation_helper.cc
inc ebx
call fcn.0040a070
add eax, 8
push str.Cant_get_the_system32_dir.
push eax
call fcn.00408da0
pop ecx
pop ecx
test bl, 1
je 0x4742cb
lea ecx, [ebp - 0x214]
and ebx, 0xfffffffe
call fcn.0040a0c0
push dword [0x4f5388]
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
push str.drivers_
lea ecx, [ebp - 0x34]
call fcn.0040aa10
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0xdc]
call fcn.00405dd0
mov ecx, eax
call fcn.00405dd0
lea ecx, [ebp - 0x13c]
call fcn.00405610
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00408290
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
lea ecx, [ebp - 0x94]
call fcn.00405570
lea ecx, [ebp - 0x94]
call fcn.0041c600
test al, al
jne 0x474390
call fcn.0040a000
cmp eax, esi
jg 0x474379
push esi
push 0x68
push str.d:webapps_b_build_slave_repo_build_srcwowchromeinstallerutilwow_guarder_installation_helper.cc
lea ecx, [ebp - 0x214]
or ebx, esi
call fcn.0040a070
add eax, 8
push str.CreateUniqueTempDir_Failed.
push eax
call fcn.00408da0
pop ecx
pop ecx
test bl, 2
je 0x474389
lea ecx, [ebp - 0x214]
call fcn.0040a0c0
xor bl, bl
jmp 0x474a23
call fcn.0045161e
push 0x4efaec
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push ecx
push 0
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0xf4]
push ecx
lea ecx, [ebp - 0xc4]
push ecx
mov ecx, esi
call dword [eax + 0x14]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push str.SYSTEMCurrentControlSetServicesUCGuard
lea ecx, [ebp - 0x4c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x4c]
push edi
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x1c]
push str.DebugLevel
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push 1
push 1
push ecx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x3c]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push str.FltMgr
lea ecx, [ebp - 0x34]
call fcn.0040aa10
push str.DependOnService
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push 1
push 7
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x40]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00408290
push str.ErrorControl
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
push 1
push 1
lea ecx, [ebp - 0x1c]
push ecx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x3c]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push str.PNP_TDI
lea ecx, [ebp - 0x34]
call fcn.0040aa10
push str.Group
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push 1
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x44]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00408290
push str.system32DRIVERSucguard.sys
lea ecx, [ebp - 0x34]
call fcn.0040aa10
push str.ImagePath
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push 1
push 2
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x40]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00408290
push 0x4d76c0
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push 1
push 1
push ecx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x3c]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push 0x4d76cc
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push 1
push 2
push ecx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x3c]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push str.Type
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push 1
push 1
push ecx
push edi
lea ecx, [ebp - 0x4c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x3c]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
and dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x7c]
xor eax, eax
mov dword [ebp - 0x68], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x4c]
push eax
call fcn.00407bd0
push str.Instances
mov edi, eax
call fcn.004047d0
pop ecx
push eax
push str.Instances
mov ecx, edi
call fcn.004069c0
mov edi, dword [ebp - 0x140]
lea ecx, [ebp - 0x7c]
mov eax, dword [esi]
push edi
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x1c]
push str.ucguard
lea ecx, [ebp - 0x34]
call fcn.0040aa10
push str.DefaultInstance
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push 1
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edi
lea ecx, [ebp - 0x7c]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x44]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00408290
and dword [ebp - 0x54], 0
lea ecx, [ebp - 0x64]
xor eax, eax
mov dword [ebp - 0x50], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x7c]
push eax
call fcn.00407bd0
push 0x4efc78
mov edi, eax
call fcn.004047d0
pop ecx
push eax
push 0x4efc78
mov ecx, edi
call fcn.004069c0
push str.ucguard
mov edi, eax
call fcn.004047d0
pop ecx
push eax
push str.ucguard
mov ecx, edi
call fcn.004069c0
mov edi, dword [ebp - 0x140]
lea ecx, [ebp - 0x64]
mov eax, dword [esi]
push edi
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x1c]
push str.888999
lea ecx, [ebp - 0x34]
call fcn.0040aa10
push str.Altitude
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push 1
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edi
lea ecx, [ebp - 0x64]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x44]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00408290
push str.Flags
lea ecx, [ebp - 0x1c]
call fcn.0040aa10
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push 1
push 0
push ecx
push edi
lea ecx, [ebp - 0x64]
push ecx
push reloc.WS2_32.dll_bind
mov ecx, esi
call dword [eax + 0x3c]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00408290
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test al, al
jne 0x4747ba
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
call fcn.0040a000
cmp eax, 2
jg 0x4747a3
push 2
push 0xc7
push str.d:webapps_b_build_slave_repo_build_srcwowchromeinstallerutilwow_guarder_installation_helper.cc
lea ecx, [ebp - 0x214]
or ebx, 4
call fcn.0040a070
add eax, 8
push str.Write_guarder_register_error.
push eax
call fcn.00408da0
pop ecx
pop ecx
test bl, 4
je 0x4747b3
lea ecx, [ebp - 0x214]
call fcn.0040a0c0
xor bl, bl
jmp 0x4749f7
push str.SeDebugPrivilege
lea ecx, [ebp - 0x10c]
call fcn.00447cc0
push str.SeLoadDriverPrivilege
lea ecx, [ebp - 0x124]
call fcn.00447cc0
cmp byte [ebp - 0x10c], 0
je 0x4747ec
cmp byte [ebp - 0x124], 0
jne 0x474833
call fcn.0040a000
cmp eax, 2
jg 0x474820
push 2
push 0xcf
push str.d:webapps_b_build_slave_repo_build_srcwowchromeinstallerutilwow_guarder_installation_helper.cc
lea ecx, [ebp - 0x214]
or ebx, 8
call fcn.0040a070
add eax, 8
push str.Failed_to_enable_privileges_required_to_load_driver
push eax
call fcn.00408da0
pop ecx
pop ecx
test bl, 8
je 0x474833
lea ecx, [ebp - 0x214]
and ebx, 0xfffffff7
call fcn.0040a0c0
mov ecx, 0x4f7f60
call fcn.00474a95
xor edi, edi
cmp dword [eax + 0xc], edi
je 0x4748ed
mov ecx, 0x4f7f60
call fcn.00474a95
cmp dword [eax + 8], edi
je 0x4748ed
mov edi, 0x4f7f60
mov ecx, edi
call fcn.00474a95
push str.REGISTRYMachineSystemCurrentControlSetServicesUCGuard
lea edx, [ebp - 0x14c]
push edx
call dword [eax + 0xc]
mov ecx, edi
call fcn.00474a95
lea ecx, [ebp - 0x14c]
push ecx
call dword [eax + 8]
mov edi, eax
call fcn.0040a000
test eax, eax
jg 0x4748df
push 0
push 0xd7
push str.d:webapps_b_build_slave_repo_build_srcwowchromeinstallerutilwow_guarder_installation_helper.cc
lea ecx, [ebp - 0x214]
or ebx, 0x10
call fcn.0040a070
push edi
push str._code
push dword [ebp - 0x148]
add eax, 8
push str.NtLoadDriver
push eax
call fcn.00408da0
pop ecx
pop ecx
push eax
call fcn.0040a940
pop ecx
pop ecx
push eax
call fcn.00408da0
pop ecx
pop ecx
mov ecx, eax
call fcn.0041e010
test bl, 0x10
je 0x4749df
jmp 0x4749d4
mov ecx, 0x4f7f60
call fcn.00474a95
cmp dword [eax + 0xc], edi
jne 0x474943
call fcn.0040a000
cmp eax, 1
jg 0x474930
push 1
push 0xda
push str.d:webapps_b_build_slave_repo_build_srcwowchromeinstallerutilwow_guarder_installation_helper.cc
lea ecx, [ebp - 0x214]
or ebx, 0x20
call fcn.0040a070
add eax, 8
push str.RtlInitUnicodeString_is_not_available.
push eax
call fcn.00408da0
pop ecx
pop ecx
test bl, 0x20
je 0x474943
lea ecx, [ebp - 0x214]
and ebx, 0xffffffdf
call fcn.0040a0c0
mov ecx, 0x4f7f60
call fcn.00474a95
cmp dword [eax + 8], edi
jne 0x474999
call fcn.0040a000
cmp eax, 1
jg 0x474986
push 1
push 0xdc
push str.d:webapps_b_build_slave_repo_build_srcwowchromeinstallerutilwow_guarder_installation_helper.cc
lea ecx, [ebp - 0x214]
or ebx, 0x40
call fcn.0040a070
add eax, 8
push str.NtLoadDriver_is_not_available.
push eax
call fcn.00408da0
pop ecx
pop ecx
test bl, 0x40
je 0x474999
lea ecx, [ebp - 0x214]
and ebx, 0xffffffbf
call fcn.0040a0c0
call fcn.0040a000
cmp eax, 1
jg 0x4749d0
push 1
push 0xdd
push str.d:webapps_b_build_slave_repo_build_srcwowchromeinstallerutilwow_guarder_installation_helper.cc
lea ecx, [ebp - 0x214]
or ebx, 0x80
call fcn.0040a070
add eax, 8
push str.Cannot_install_the_guard_driver.
push eax
call fcn.00408da0
pop ecx
pop ecx
test bl, bl
jns 0x4749df
lea ecx, [ebp - 0x214]
call fcn.0040a0c0
lea ecx, [ebp - 0x124]
mov bl, 1
call fcn.00447d6a
lea ecx, [ebp - 0x10c]
call fcn.00447d6a
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00408290
push 0
push 1
lea ecx, [ebp - 0x7c]
call fcn.00408290
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00408290
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
lea ecx, [ebp - 0x94]
call fcn.0041c590
lea ecx, [ebp - 0xf4]
call fcn.00405610
lea ecx, [ebp - 0xdc]
call fcn.00405610
lea ecx, [ebp - 0xc4]
call fcn.00405610
push 0
push 1
lea ecx, [ebp - 0xac]
call fcn.00408290
lea ecx, [ebp - 0x164]
call fcn.00474dbf
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7e44
mov esp, ebp
pop ebp
ret