Function at 0x477720
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5142b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x20]
push eax
push ecx
xor esi, esi
push str.explorer.exe
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
call fcn.00477690
add esp, 0xc
test eax, eax
je 0x477770
push str.Unable_to_get_the_explorer.exe_process_token_n
call fcn.00423ad0
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea edx, [ebp - 0x10]
push edx
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push ecx
push eax
push str.CheckForShutdownPrivilege_:_SE_SHUTDOWN_NAME_:_LUID_lower_part_:__d___LUID_upper_part_:__d_n
mov dword [ebp - 0x24], eax
call fcn.00423db0
mov eax, dword [ebp - 0x20]
add esp, 0xc
lea edx, [ebp - 0x18]
push edx
push 0xff
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 3
push eax
mov dword [ebp - 0x18], 0xff
call esi
mov ecx, dword [ebp - 0x18]
push ecx
mov edi, eax
call fcn.00494ad4
mov ecx, dword [ebp - 0x20]
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x18]
push edx
push eax
push ebx
push 3
push ecx
call esi
test edi, edi
jne 0x47781e
push str.CheckForShutdownPrivilege_:_GetTokenInformation_failed._So_returning_false1_n
call fcn.00423db0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
call esi
test eax, eax
je 0x4778d8
call esi
push eax
push str.CheckForShutdownPrivilege_:_returned_with_error_code_:__d__n
call fcn.00423db0
add esp, 8
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx]
push edx
push str.CheckForShutdownPrivilege_:_Privilege_count_:__d__n
call fcn.00423db0
add esp, 8
cmp dword [ebx], 0
mov dword [ebp - 0x1c], 0
jbe 0x4778c1
lea edi, [ebx + 4]
push 0xff
push 1
mov dword [ebp - 0x18], 0xff
call fcn.00491e51
add esp, 8
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
test eax, eax
jne 0x477875
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4778eb
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push ecx
push edx
push str.CheckForShutdownPrivilege_:_LUID_lower_part_:__d___LUID_upper_part_:__d_n
call fcn.00423960
mov eax, dword [ebp - 0x24]
add esp, 0xc
push esi
cmp dword [edi], eax
je 0x477912
mov ecx, dword [ebp - 0x1c]
push ecx
push str.CheckForShutdownPrivilege_:_Privilege_No_:__d_found_is_:__s_n
call fcn.00423db0
add esp, 0xc
test esi, esi
je 0x4778b3
push esi
call fcn.0048efd8
add esp, 4
mov eax, dword [ebp - 0x1c]
inc eax
add edi, 0xc
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebx]
jb 0x477841
mov eax, dword [ebp + 8]
push eax
push str.CheckForShutdownPrivilege_:_Shutdown_privilege_is_not_available_for_the_session_Id_:__d_n
call fcn.00423db0
push ebx
call fcn.0048efd8
add esp, 0xc
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CheckForShutdownPrivilege_:_returned_with_error_code_:__d__n
call fcn.00423db0
add esp, 8
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1c]
push edx
push str.CheckForShutdownPrivilege_:_Shutdown_Privilege_No_:__d_found_is_:__s_n
call fcn.00423db0
add esp, 0xc
test esi, esi
je 0x477930
push esi
call fcn.0048efd8
add esp, 4
push ebx
call fcn.0048efd8
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop ebx
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0048ed61
mov esp, ebp
pop ebp
ret