Function at 0x527b40
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x64a070]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push 0x20
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x527c2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x656c44]
mov edx, eax
test ecx, ecx
je 0x527bf3
push edx
push str.Privilege_lowering_failed__Error:__u__n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push 0x61c4f4
push 0x32
call ecx
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x527c18
push edx
mov eax, dword [ecx]
push str.Privilege_lowering_failed__Error:__u__n
push str.ProcessUtils
push 0x5f8398
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [esp + 0x34], 1
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x40]
mov dword [esp + 0x4c], 2
push eax
push 0
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
push dword [esp + 0x20]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x527cd2
mov ecx, dword [0x656c44]
test ecx, ecx
je 0x527cbe
push ebx
push str.Privilege_lowering_failed__Error:__u__n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push 0x61c4f4
push 0x32
call ecx
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x527c18
push ebx
jmp 0x527bfe
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x527d5f
lea eax, [esp + 0x2c]
push eax
push 0x527ad0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x527d5f
mov eax, dword [0x656c44]
test eax, eax
je 0x527d23
push str.Privilege_lowering_failed__Could_not_get_Shell_window_or_any_user_window._n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push 0x61c4f4
push 0x32
call eax
jmp 0x527c15
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x527c18
push str.Privilege_lowering_failed__Could_not_get_Shell_window_or_any_user_window._n
mov eax, dword [ecx]
push str.ProcessUtils
push 0x5f8398
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x527db3
mov eax, dword [0x656c44]
test eax, eax
je 0x527d9e
push str.Privilege_lowering_failed__Could_not_get_process_ID._n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push 0x61c4f4
push 0x32
call eax
jmp 0x527c15
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x527c18
push str.Privilege_lowering_failed__Could_not_get_process_ID._n
jmp 0x527d36
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x527dce
call edi
jmp 0x527bb2
lea eax, [esp + 0x24]
mov byte [esp + 0xf], 0
push eax
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x527e47
call edi
mov ecx, dword [0x656c44]
mov edx, eax
test ecx, ecx
je 0x527e19
push edx
push str.Privilege_lowering_failed__Error:__u__n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push 0x61c4f4
push 0x32
call ecx
add esp, 0x1c
jmp 0x527ed1
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x527ed1
push edx
push str.Privilege_lowering_failed__Error:__u__n
mov eax, dword [ecx]
push str.ProcessUtils
push 0x5f8398
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
jmp 0x527ed1
lea eax, [esp + 0x28]
push eax
push 1
push 2
push 0
push 0x18b
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x527de5
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x20]
sub esp, 8
push dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x44]
call fcn.00527840
test eax, eax
jne 0x527ecc
call edi
mov ecx, dword [0x656c44]
mov edx, eax
test ecx, ecx
je 0x527eb7
push edx
push str.Privilege_lowering_failed__Error:__u
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push 0x61c4f4
push 0x32
call ecx
add esp, 0x1c
jmp 0x527ed1
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x527ed1
push edx
push str.Privilege_lowering_failed__Error:__u
jmp 0x527e2d
mov byte [esp + 0xf], 1
push dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x28]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x44]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057608a
mov esp, ebp
pop ebp
ret