Function at 0x45ea46
Capabilities:
Acquire debug privileges
Compare security identifiers

Disassembly:
push 0x340
mov eax, 0x51b94d
call fcn.004d8af2
mov dword [ebp - 0x30c], edx
mov esi, ecx
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x2dc], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x300], ebx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x45eacd
push 0x14a
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x290]
call fcn.00406620
lea eax, [ebp - 0x290]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.0040121b
mov ecx, dword [ebp - 0x288]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, esi
jmp 0x45fc16
lea ecx, [ebp - 0x348]
mov byte [ebp - 0x29c], bl
call fcn.00405dc6
mov dword [ebp - 4], 1
mov edi, vtable.ATL::CAccessToken.0
mov dword [ebp - 0x2c8], edi
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2bc], ebx
push ebx
push 0x28
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 2
call fcn.0040654e
test al, al
jne 0x45eb90
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x154
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x290]
call fcn.00406620
mov byte [ebp - 4], 3
lea eax, [ebp - 0x290]
mov ecx, esi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x288]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 0x2c8], edi
call fcn.004065be
lea ecx, [ebp - 0x348]
call fcn.00405f23
jmp 0x45eac6
push ebx
push ecx
push str.SeTcbPrivilege
lea ecx, [ebp - 0x2c8]
call fcn.004064e5
test al, al
jne 0x45ebe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x156
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x290]
call fcn.00406620
mov byte [ebp - 4], 4
jmp 0x45eb53
mov edx, dword [ebp - 0x2c4]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.0045e2cf
pop ecx
mov ecx, dword [ebp - 0x2ac]
add ecx, 0xfffffff0
call fcn.00407189
lea eax, [ebp - 0x29c]
push eax
push ecx
push str.SeDebugPrivilege
lea ecx, [ebp - 0x2c8]
call fcn.004064e5
test al, al
jne 0x45ec63
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x15a
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x290]
call fcn.00406620
mov byte [ebp - 4], 5
jmp 0x45eb53
push ecx
push ecx
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.004d54a7
test al, al
jne 0x45ecbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x15d
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x290]
call fcn.00406620
mov byte [ebp - 4], 6
jmp 0x45eb53
push dword [ebp - 0x2c4]
call dword [sym.imp.ADVAPI32.dll_IsTokenRestricted]
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], ebx
push eax
push 1
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp dword [ebp - 0x284], 0
je 0x45ecfa
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 0x2c8], edi
call fcn.004065be
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2cc], ebx
lea edx, [ebp - 0x2d4]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c4]
call fcn.0042c68a
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x2d4]
cmp edi, dword [ebp - 0x2d0]
jne 0x45ee11
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x290]
call fcn.0040121b
mov byte [ebp - 4], 9
cmp dword [ebp - 0x290], 0
jge 0x45edff
cmp dword [ebp - 0x28c], 0
mov eax, 0x16a
cmovne eax, dword [ebp - 0x28c]
push eax
push dword [ebp - 0x290]
push ecx
mov esi, esp
mov dword [ebp - 0x280], esi
mov edi, dword [ebp - 0x288]
lea ecx, [edi - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x1c]
mov dword [esi], eax
call fcn.00406620
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x1c]
mov ebx, dword [ebp - 0x274]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2bc]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2d4]
test ecx, ecx
je 0x45fc09
mov eax, dword [ebp - 0x2cc]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
jmp 0x45fc02
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x288]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov esi, dword [ebp - 0x2d0]
mov eax, ebx
sub esi, edi
mov byte [ebp - 0x29a], bl
sar esi, 2
mov dword [ebp - 0x24], str.services.exe
mov dword [ebp - 0x20], str.lsass.exe
mov dword [ebp - 0x1c], str.winlogon.exe
mov dword [ebp - 0x18], str.csrss.exe
mov dword [ebp - 0x14], str.wininit.exe
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x2d8], esi
push dword [ebp + eax*4 - 0x24]
lea ecx, [ebp - 0x2a8]
call fcn.00406fea
mov eax, ebx
mov dword [ebp - 0x284], eax
test esi, esi
je 0x45f036
push dword [edi + eax*4]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x2b8], esi
test esi, esi
jne 0x45ee97
call fcn.00406710
jmp 0x45f01b
lea ecx, [ebp - 0x278]
call fcn.0040687a
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0xd
push eax
mov edx, esi
lea ecx, [ebp - 0x2b4]
call fcn.0042b2d1
pop ecx
mov ecx, dword [ebp - 0x2ac]
mov ebx, dword [eax]
shr ebx, 0x1f
lea ecx, [ecx - 0x10]
call fcn.00407189
test bl, bl
je 0x45eeee
mov ecx, dword [ebp - 0x278]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x45f01b
lea ecx, [ebp - 0x278]
call fcn.00404593
lea ecx, [ebp - 0x2a4]
mov edx, dword [eax]
call fcn.0042957d
lea edx, [ebp - 0x2a8]
mov ecx, eax
call fcn.00405d14
mov ecx, dword [ebp - 0x2a4]
mov bl, al
add ecx, 0xfffffff0
call fcn.00407189
mov ecx, dword [ebp - 0x278]
lea ecx, [ecx - 0x10]
call fcn.00407189
test bl, bl
je 0x45eee0
xor ebx, ebx
mov byte [ebp - 0x29a], 1
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x288], ebx
push esi
push 8
lea ecx, [ebp - 0x294]
call fcn.0040654e
test al, al
jne 0x45ef76
call fcn.00406710
jmp 0x45efff
lea ecx, [ebp - 0x84]
call fcn.004d546f
push ecx
push ecx
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x294]
call fcn.004d53ae
test al, al
je 0x45f86e
push 0x12
push 1
lea eax, [ebp - 0xe4]
push 0x53d240
push eax
call fcn.004d6394
or dword [ebp - 0x300], 2
lea eax, [ebp - 0xe0]
add esp, 0x10
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x45efe9
push dword [ebp - 0x290]
call dword [sym.imp.ADVAPI32.dll_IsTokenRestricted]
test eax, eax
je 0x45f11f
lea ecx, [ebp - 0xe4]
call fcn.004d6486
lea ecx, [ebp - 0x84]
call fcn.004d6486
lea ecx, [ebp - 0x294]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
call fcn.004065be
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x284]
mov esi, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x284], eax
cmp eax, esi
jb 0x45ee72
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2a8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp eax, 5
jb 0x45ee53
lea eax, [ebp - 0x279]
mov byte [ebp - 0x29b], bl
push eax
lea edx, [ebp - 0x29b]
mov byte [ebp - 0x279], bl
lea ecx, [ebp - 0x290]
call fcn.0045e658
pop ecx
mov byte [ebp - 4], 0x1d
cmp dword [ebp - 0x290], 0
jge 0x45f905
cmp dword [ebp - 0x28c], 0
mov eax, 0x1e9
cmovne eax, dword [ebp - 0x28c]
push eax
push dword [ebp - 0x290]
push ecx
mov esi, esp
mov dword [ebp - 0x2b8], esi
mov edi, dword [ebp - 0x288]
lea ecx, [edi - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2b4]
mov dword [esi], eax
call fcn.00406620
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x274]
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2ac]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [edi - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2bc]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x2d4]
call fcn.004a9173
jmp 0x45f1f8
lea ecx, [ebp - 0xe4]
call fcn.004d6486
lea ecx, [ebp - 0x84]
call fcn.004d6486
lea ecx, [ebp - 0x294]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
call fcn.004065be
lea ecx, [ebp - 0x270]
call fcn.0042b0ee
cmp dword [eax + 4], 6
jae 0x45f6f9
mov dword [ebp - 0x278], ebx
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x11
push eax
push 0x60000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x45f20e
call fcn.00406710
push 0x1b1
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, dword [ebp - 0x274]
call fcn.00406620
cmp dword [ebp - 0x278], 0
je 0x45f1bd
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x278], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2a8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2bc]
lea ecx, [ecx - 0x10]
call fcn.00407189
test edi, edi
je 0x45f1f8
mov eax, dword [ebp - 0x2cc]
sub eax, edi
and eax, 0xfffffffc
push eax
push edi
call fcn.00405cbf
pop ecx
pop ecx
lea ecx, [ebp - 0x348]
call fcn.00405f23
mov eax, dword [ebp - 0x274]
jmp 0x45fc16
mov dword [ebp - 0x18], vtable.ATL::CSecurityDesc.0
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x278]
push eax
push ecx
lea ecx, [ebp - 0x290]
call fcn.0045e43f
pop ecx
pop ecx
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x290], 0
jge 0x45f426
cmp dword [ebp - 0x28c], 0
mov eax, 0x1b5
cmovne eax, dword [ebp - 0x28c]
push eax
push dword [ebp - 0x290]
push ecx
mov edi, esp
mov dword [ebp - 0x280], edi
mov ecx, dword [ebp - 0x288]
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2b4]
mov dword [edi], eax
call fcn.00406620
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x2b4]
mov edi, dword [ebp - 0x274]
mov ecx, edi
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2ac]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x288]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x18], vtable.ATL::CSecurityDesc.0
je 0x45f3b8
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x304], ebx
push eax
lea eax, [ebp - 0x304]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
je 0x45f3ac
test dword [ebp - 0x304], 0x8000
jne 0x45f3ac
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2d8]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
push dword [ebp - 0x2d8]
call fcn.004e3620
pop ecx
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2a4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
push dword [ebp - 0x2a4]
call fcn.004e3620
pop ecx
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
cmp dword [ebp - 0x274], 0
je 0x45f379
push dword [ebp - 0x2a0]
call fcn.004e3620
pop ecx
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
cmp dword [ebp - 0x274], 0
je 0x45f3ac
push dword [ebp - 0x2dc]
call fcn.004e3620
pop ecx
push dword [ebp - 0x14]
call fcn.004e3620
pop ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x278], 0
je 0x45f3d3
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x278], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2a8]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2bc]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x2d4]
test ecx, ecx
je 0x45f414
mov eax, dword [ebp - 0x2cc]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.00405cbf
pop ecx
pop ecx
lea ecx, [ebp - 0x348]
call fcn.00405f23
mov eax, edi
jmp 0x45fc16
mov ecx, dword [ebp - 0x288]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov dword [ebp - 0x2f8], ebx
mov byte [ebp - 0x2f4], bl
mov dword [ebp - 0x2f0], 2
mov dword [ebp - method.ATL::CDacl.virtual_0], vtable.ATL::CDacl.0
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2e0], ebx
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x14], 0
je 0x45f4ee
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2dc]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x45f4ee
cmp dword [ebp - 0x2dc], 0
lea ecx, [ebp - 0x2fc]
je 0x45f4df
mov eax, dword [ebp - 0x2d8]
test eax, eax
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2fc]
je 0x45f4d3
call dword [eax + 8]
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x2fc]
call fcn.004d4ad5
jmp 0x45f4ee
call dword [eax + 8]
mov byte [ebp - 0x2f4], 1
jmp 0x45f4ee
mov eax, dword [ebp - 0x2fc]
call dword [eax + 8]
mov byte [ebp - 0x2f4], bl
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xe4]
push 0x53d240
push eax
call fcn.004d6394
add esp, 0x14
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x2e8], 0
mov dword [ebp - 0x284], ebx
jbe 0x45f5b2
lea ecx, [ebp - 0x84]
call fcn.004d546f
push ecx
push ecx
lea eax, [ebp - 0x2a4]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x279]
mov dword [ebp - 0x2a0], ebx
push eax
lea eax, [ebp - 0x2a0]
mov byte [ebp - 0x279], bl
push eax
lea eax, [ebp - 0x84]
mov byte [ebp - 0x2a4], bl
push eax
push dword [ebp - 0x284]
lea ecx, [ebp - 0x2fc]
call fcn.004d46b6
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x45f678
inc dword [ebp - 0x284]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x16
call fcn.004d6486
mov eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x2e8]
jb 0x45f522
push ebx
push 0x2000a
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.004d456f
push ecx
lea eax, [ebp - 0x2fc]
push eax
lea ecx, [ebp - 0x18]
call fcn.004d4480
push dword [ebp - 0x14]
push 4
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
jne 0x45f6bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1d3
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2b4]
call fcn.00406620
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x274]
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2ac]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0xe4]
call fcn.004d6486
lea ecx, [ebp - 0x2fc]
call fcn.004d4dea
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.ATL::CSecurityDesc.0
call fcn.004d5573
jmp 0x45f1a2
push dword [ebp - 0x284]
lea ecx, [ebp - 0x2fc]
call fcn.004d4f54
push dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x2a0]
lea ecx, [ebp - 0x2fc]
or eax, 2
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004d456f
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x16
call fcn.004d6486
jmp 0x45f5ca
lea ecx, [ebp - 0xe4]
call fcn.004d6486
lea ecx, [ebp - 0x2fc]
call fcn.004d4dea
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], vtable.ATL::CSecurityDesc.0
call fcn.004d5573
cmp dword [ebp - 0x278], 0
je 0x45f6f9
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x298], ebx
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 0x19
push eax
push 0xa
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x45f796
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1d9
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2b4]
call fcn.00406620
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x274]
lea eax, [ebp - 0x2b4]
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2ac]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x298], 0
je 0x45f1bd
push dword [ebp - 0x298]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x298], ebx
jmp 0x45f1bd
push dword [ebp - 0x30c]
push 1
push 3
push ebx
push 0xf01ff
push dword [ebp - 0x298]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x45f7f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1db
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2b4]
call fcn.00406620
mov byte [ebp - 4], 0x1b
jmp 0x45f752
push dword [ebp - 0x280]
push 2
push 3
push ebx
push 0xf01ff
push dword [ebp - 0x298]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x45f856
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1dc
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2b4]
call fcn.00406620
mov byte [ebp - 4], 0x1c
jmp 0x45f752
mov eax, dword [ebp - 0x274]
lea ecx, [eax + 8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.0040687a
jmp 0x45f772
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x19e
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2b4]
call fcn.00406620
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x2b4]
mov ebx, dword [ebp - 0x274]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2ac]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x84]
call fcn.004d6486
lea ecx, [ebp - 0x294]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
call fcn.004065be
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2a8]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x45fbe3
mov ecx, dword [ebp - 0x288]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea eax, [ebp - 0x18]
mov dword [ebp - 0x2a4], ebx
push eax
push str.SeDebugPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x45f931
mov esi, ebx
jmp 0x45f965
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x344]
call fcn.004060de
test eax, eax
je 0x45f92d
mov eax, dword [eax + 8]
xor esi, esi
mov dword [ebp - 0x2a4], eax
inc esi
mov byte [ebp - 0x299], bl
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x45f9df
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1f4
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2b4]
call fcn.00406620
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x2b4]
mov ebx, dword [ebp - 0x274]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2ac]
lea ecx, [ecx - 0x10]
call fcn.00407189
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x45fbe3
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x288], ebx
mov byte [ebp - 4], 0x21
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [ebp - 0x280]
push ecx
push 1
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x45fa38
mov eax, dword [ebp - 0x294]
lea ecx, [ebp - 0x294]
call dword [eax + 4]
mov edx, dword [ebp - 0x280]
mov dword [ebp - 0x290], edx
jmp 0x45fa3e
mov edx, dword [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.0045e2cf
pop ecx
mov ecx, dword [ebp - 0x2ac]
add ecx, 0xfffffff0
call fcn.00407189
lea eax, [ebp - 0x299]
push eax
push ecx
push str.SeDebugPrivilege
lea ecx, [ebp - 0x294]
call fcn.004064e5
test al, al
jne 0x45faec
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x1fb
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2b4]
call fcn.00406620
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x2b4]
mov ebx, dword [ebp - 0x274]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x2ac]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x294]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
call fcn.004065be
jmp 0x45f9d4
lea ecx, [ebp - 0x294]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
call fcn.004065be
mov byte [ebp - 4], 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push 0x6c
lea eax, [ebp - 0x150]
mov dword [ebp - 0x154], ebx
push ebx
push eax
call fcn.004d9f30
add esp, 0xc
lea eax, [ebp - 0x154]
push ebx
push 0x70
push eax
push 9
push ebx
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x45fb42
mov dword [ebp - 0x2a0], ebx
jmp 0x45fb4d
call fcn.00406710
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x308]
mov dword [ebp - 0x308], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
jne 0x45fb73
call fcn.00406710
mov ebx, eax
movzx eax, byte [ebp - 0x29a]
push 0x21e
push 0x80004005
push ecx
movzx ecx, byte [ebp - 0x299]
mov edx, esp
push ecx
push eax
push dword [ebp - 0x2a4]
movzx eax, byte [ebp - 0x29b]
push esi
push eax
movzx eax, byte [ebp - 0x29c]
push eax
xor eax, eax
cmp edi, dword [ebp - 0x2d0]
setne al
push eax
movzx eax, byte [ebp - 0x279]
push eax
push dword [ebp - 0x2a0]
push ebx
push dword [ebp - 0x308]
push str._d__08x__08x__d_d_d_d_d_d_d_d
push edx
call fcn.004011e0
mov ebx, dword [ebp - 0x274]
add esp, 0x34
mov ecx, ebx
call fcn.00406620
mov ecx, dword [ebp - 0x2bc]
lea ecx, [ecx - 0x10]
call fcn.00407189
test edi, edi
je 0x45fc09
mov eax, dword [ebp - 0x2cc]
sub eax, edi
and eax, 0xfffffffc
push eax
push edi
call fcn.00405cbf
pop ecx
pop ecx
lea ecx, [ebp - 0x348]
call fcn.00405f23
mov eax, ebx
call fcn.004d8aa1
ret