Function at 0x40beb0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428549
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x438130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0
call fcn.0040a490
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x1c]
push eax
push str.SeCreateTokenPrivilege
push 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 1
call edi
test eax, eax
je 0x40bf2c
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
call edi
test eax, eax
je 0x40bf56
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeLockMemoryPrivilege
push 0
call edi
test eax, eax
je 0x40bf80
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call edi
test eax, eax
je 0x40bfaa
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeUnsolicitedInputPrivilege
push 0
call edi
test eax, eax
je 0x40bfd4
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeMachineAccountPrivilege
push 0
call edi
test eax, eax
je 0x40bffe
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeTcbPrivilege
push 0
call edi
test eax, eax
je 0x40c028
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push 0x42bb0c
push 0
call edi
test eax, eax
je 0x40c052
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeTakeOwnershipPrivilege
push 0
call edi
test eax, eax
je 0x40c07c
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeLoadDriverPrivilege
push 0
call edi
test eax, eax
je 0x40c0a6
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeSystemProfilePrivilege
push 0
call edi
test eax, eax
je 0x40c0d0
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeSystemtimePrivilege
push 0
call edi
test eax, eax
je 0x40c0fa
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeProfileSingleProcessPrivilege
push 0
call edi
test eax, eax
je 0x40c124
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeIncreaseBasePriorityPrivilege
push 0
call edi
test eax, eax
je 0x40c14e
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeCreatePagefilePrivilege
push 0
call edi
test eax, eax
je 0x40c178
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeCreatePermanentPrivilege
push 0
call edi
test eax, eax
je 0x40c1a2
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeBackupPrivilege
push 0
call edi
test eax, eax
je 0x40c1cc
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeRestorePrivilege
push 0
call edi
test eax, eax
je 0x40c1f6
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call edi
test eax, eax
je 0x40c220
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeAuditPrivilege
push 0
call edi
test eax, eax
je 0x40c24a
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeSystemEnvironmentPrivilege
push 0
call edi
test eax, eax
je 0x40c274
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeRemoteShutdownPrivilege
push 0
call edi
test eax, eax
je 0x40c29e
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeUndockPrivilege
push 0
call edi
test eax, eax
je 0x40c2c8
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeSyncAgentPrivilege
push 0
call edi
test eax, eax
je 0x40c2f2
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeEnableDelegationPrivilege
push 0
call edi
test eax, eax
je 0x40c31c
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeManageVolumePrivilege
push 0
call edi
test eax, eax
je 0x40c346
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeImpersonatePrivilege
push 0
call edi
test eax, eax
je 0x40c370
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeCreateGlobalPrivilege
push 0
call edi
test eax, eax
je 0x40c39a
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeTrustedCredManAccessPrivilege
push 0
call edi
test eax, eax
je 0x40c3c4
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeRelabelPrivilege
push 0
call edi
test eax, eax
je 0x40c3ee
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeIncreaseWorkingSetPrivilege
push 0
call edi
test eax, eax
je 0x40c418
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeTimeZonePrivilege
push 0
call edi
test eax, eax
je 0x40c442
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
lea eax, [ebp - 0x1c]
push eax
push str.SeCreateSymbolicLinkPrivilege
push 0
call edi
test eax, eax
je 0x40c46c
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
push eax
lea ecx, [esi + 4]
call fcn.0040d510
mov byte [esi + 0x38], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419146
mov esp, ebp
pop ebp
ret