Function at 0x42c320
Capabilities:
Manipulate user privileges

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rax, qword [0x00523030]
mov rbx, qword [0x00523070]
mov rsi, qword [0x00523020]
cmp ecx, 1
mov dword [rax], ecx
mov dword [rbx], edx
mov byte [rsi], r8b
je 0x42c421
test r8b, r8b
mov eax, 2
je 0x42c421
imul eax, edx
add eax, 1
shl eax, 0x15
cmp ecx, 2
cdqe
je 0x42c43a
mov rbx, qword [0x00523040]
test r9b, r9b
mov qword [rbx], rax
je 0x42c450
lea r12, [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rsi
mov r8, r12
mov edx, 0x28
mov rcx, rax
mov rbp, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call rbp
cmp eax, 1
je 0x42c483
call rsi
lea r8, [rsp + 0x40]
mov edx, 8
mov rcx, rax
call rbp
cmp eax, 1
je 0x42c520
xor ecx, ecx
mov r9d, 4
mov r8d, 0x20003000
mov rdx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, qword [0x00523060]
test rax, rax
mov qword [r12], rax
je 0x42c580
mov r9, qword [0x00523050]
or dword [r9], 2
mov eax, 1
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 1
imul eax, edx
add eax, 1
shl eax, 0x15
cmp ecx, 2
cdqe
jne 0x42c37a
mov rbx, qword [0x00523040]
add rax, rax
test r9b, r9b
mov qword [rbx], rax
jne 0x42c38d
test rax, rax
je 0x42c510
lea rcx, [rax + 0x10]
call sub.msvcrt.dll_malloc
test rax, rax
je 0x42c510
lea r11, [rax + 0x10]
and r11, 0xfffffffffffffff0
mov qword [r11 - 8], rax
mov rbx, qword [0x00523060]
mov qword [rbx], r11
jmp 0x42c408
xor ecx, ecx
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x6c], 2
lea r8, [rsp + 0x64]
lea rdx, str.SeLockMemoryPrivilege
lea rdi, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, 1
jne 0x42c3b8
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, 1
jne 0x42c3b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42c3b8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [0x00523050]
or dword [r8], 1
jmp 0x42c3d2
xor r11d, r11d
jmp 0x42c477
lea r13, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov r15, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call r15
mov edx, dword [rsp + 0x60]
test edx, edx
jne 0x42c5b3
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 1
call r15
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42c3d2
mov rcx, qword [rbx]
test rcx, rcx
je 0x42c71c
add rcx, 0x10
call sub.msvcrt.dll_malloc
test rax, rax
je 0x42c71c
lea r10, [rax + 0x10]
and r10, 0xfffffffffffffff0
mov qword [r10 - 8], rax
mov qword [r12], r10
jmp 0x42c408
mov edx, edx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0x60]
mov r14, rax
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], r13
call r15
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
call rax
test r14, r14
je 0x42c3d2
xor eax, eax
mov ecx, 6
mov rdi, r13
rep stosq qword [rdi], rax
lea r9, [rsp + 0x48]
mov r8d, 0xf0fff
mov rdx, r13
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
je 0x42c630
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x42c3d2
lea rcx, str.SeLockMemoryPrivilege
lea rdi, str.SeLockMemoryPrivilege
call sub.msvcrt.dll_wcslen
lea ecx, [rax + rax]
mov rdx, qword [r14]
add eax, 1
add eax, eax
mov r9d, 1
mov r8, r12
mov word [rsp + 0x50], cx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x52], ax
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, qword [rsp + 0x48]
mov r15d, eax
call sub.ADVAPI32.dll_LsaClose
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15d, r15d
jne 0x42c3d2
call rsi
mov r8, r12
mov edx, 0x28
mov rcx, rax
call rbp
cmp eax, 1
jne 0x42c3d2
xor ecx, ecx
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x6c], 2
lea r8, [r13 + 4]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, 1
jne 0x42c3d2
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8, r13
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, 1
jne 0x42c3d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42c3d2
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x38]
call rsi
jmp 0x42c4fc
xor r10d, r10d
jmp 0x42c5aa