Function at 0x406340
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x308
mov eax, dword [0x44d014]
xor eax, esp
mov dword [esp + 0x304], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push edi
mov edi, dword [ebp + 0xc]
push 0x800
push 0
push str.advapi32.dll
mov dword [esp + 0x38], edi
call esi
push 0x800
push 0
push str.shell32.dll
call esi
push 0x800
push 0
push str.shlwapi.dll
call esi
push 0x800
push 0
push str.tdh.dll
call esi
push 0x800
push 0
push str.user32.dll
call esi
push 2
call fcn.0042423b
add esp, 4
mov edx, eax
mov ecx, 0xfffffff4
call fcn.00402ec0
push 1
call fcn.0042423b
add esp, 4
mov edx, eax
mov ecx, 0xfffffff5
call fcn.00402ec0
mov ecx, dword [ebp + 8]
mov edx, edi
mov byte [0x44ed98], al
call fcn.00401980
test al, al
jne 0x406407
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
cmp byte [0x44ed71], 0
je 0x4064d7
push 0x6c
lea eax, [esp + 0x90]
push 0
push eax
call fcn.00422ca0
add esp, 0xc
lea eax, [esp + 0xfc]
push 0x20c
push 0
push eax
call fcn.00422ca0
add esp, 0xc
mov dword [esp + 0x88], 0x280
lea eax, [esp + 0x88]
mov dword [esp + 0xf8], 0x78
push 1
push eax
push dword [0x44ed48]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlTraceW]
test eax, eax
je 0x406979
cmp eax, 0x1069
je 0x4064ab
push eax
push dword [0x44ed48]
push str.error:_failed_to_terminate_existing_session___s_:__lu_n
call fcn.00403ab0
add esp, 0xc
mov eax, 7
pop edi
pop esi
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
push dword [0x44ed48]
push str.error:_no_existing_sessions_found:__s_n
call fcn.00403ab0
add esp, 8
mov eax, 7
pop edi
pop esi
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
cmp dword [0x44ed44], 0
jne 0x406616
push 0x800
push 0
push str.advapi32.dll
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.GetTokenInformation
push edi
mov dword [esp + 0x28], eax
call esi
push str.LookupPrivilegeValueA
push edi
mov dword [esp + 0x2c], eax
call esi
push str.AdjustTokenPrivileges
push edi
mov dword [esp + 0x30], eax
call esi
cmp dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
je 0x406597
cmp dword [esp + 0x24], 0
je 0x406597
mov esi, dword [esp + 0x28]
test esi, esi
je 0x406597
test eax, eax
je 0x406597
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x2c]
test eax, eax
je 0x406597
lea eax, [esp + 0x64]
mov dword [esp + 0x60], 1
push eax
push str.SeDebugPrivilege
xorps xmm0, xmm0
mov dword [esp + 0x74], 2
push 0
movlpd qword [esp + 0x70], xmm0
call esi
test eax, eax
jne 0x4065c7
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [0x44ed76], 0
je 0x406609
mov edx, dword [esp + 0x2c]
mov ecx, dword [ebp + 8]
call fcn.0040ab70
pop edi
pop esi
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x10
lea eax, [esp + 0x6c]
push eax
push 0
push dword [esp + 0x2c]
call dword [esp + 0x34]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x18]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x40659e
cmp dword [esp + 0x1c], 0x514
je 0x40659e
jmp 0x406616
push str.warning:_PresentMon_requires_elevated_privilege_in_order_to_query_processes_that_are_n_________short_running_or_started_on_another_account.__Without_it__those_processes_will_n_________be_listed_as__error__and_they_cant_be_targeted_by__process_name_nor_trigger_n__________terminate_on_proc_exit._n
call fcn.00403a90
add esp, 4
push 0x2c
lea eax, [esp + 0x38]
mov dword [esp + 0x34], 0x30
push 0
push eax
call fcn.00422ca0
add esp, 0xc
mov dword [esp + 0x38], 0x4061e0
lea eax, [esp + 0x30]
mov dword [esp + 0x58], str.PresentMon
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x406675
push str.error:_failed_to_register_hotkey_class._n
call fcn.00403ab0
add esp, 4
mov eax, 3
pop edi
pop esi
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push str.PresentMonWnd
push dword [esp + 0x80]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x44edac], eax
test eax, eax
jne 0x4066d6
push str.error:_failed_to_create_hotkey_window._n
call fcn.00403ab0
add esp, 4
push 0
push dword [esp + 0x5c]
call dword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 4
pop edi
pop esi
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
cmp byte [0x44ed75], 0
je 0x406739
push dword [0x44ed5c]
push dword [0x44ed58]
push 0x80
push eax
call dword [sym.imp.USER32.dll_RegisterHotKey]
test eax, eax
jne 0x406739
push str.error:_failed_to_register_hotkey._n
call fcn.00403ab0
add esp, 4
push dword [0x44edac]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push dword [esp + 0x5c]
call dword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 5
pop edi
pop esi
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 1
push 0x406160
call esi
call fcn.0040b5a0
test al, al
jne 0x40678b
push 0
push 0x406160
call esi
push dword [0x44edac]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push dword [esp + 0x5c]
call dword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0x304]
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
cmp byte [0x44ed6f], 0
je 0x4067a5
mov cl, byte [0x44ed99]
call fcn.00406040
mov byte [esp + 0x17], al
jmp 0x4067aa
mov byte [esp + 0x17], 0
cmp byte [0x44ed75], 0
jne 0x4067d4
mov eax, dword [0x44ed58]
and eax, 0xffffbfff
push eax
push 0x80
push 0x312
push dword [0x44edac]
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x60]
push 0
push 0
push dword [0x44edac]
xorps xmm0, xmm0
mov dword [esp + 0x84], 0
push eax
movaps xmmword [esp + 0x70], xmm0
movq qword [esp + 0x80], xmm0
call esi
test eax, eax
je 0x40683d
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
cmp eax, 0xffffffff
je 0x40683d
lea eax, [esp + 0x60]
push eax
call edi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push dword [0x44edac]
lea eax, [esp + 0x6c]
push eax
call esi
test eax, eax
jne 0x406811
cmp byte [0x44ed6f], 0
je 0x40684f
mov cl, byte [esp + 0x17]
call fcn.00406040
mov ecx, 0x44da88
call fcn.00411300
cmp dword [0x44ed80], 0
je 0x406899
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [0x44ed80]
cmp ecx, eax
je 0x40698f
push 0
push ecx
push dword [0x44ed7c]
call fcn.004208ee
add esp, 0xc
test eax, eax
jne 0x406996
xorps xmm0, xmm0
movlpd qword [0x44ed7c], xmm0
cmp dword [0x44ed88], 0
je 0x4068eb
mov byte [0x44ed9a], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [0x44ed88]
cmp ecx, eax
je 0x40698f
push 0
push ecx
push dword [0x44ed84]
call fcn.004208ee
add esp, 0xc
test eax, eax
jne 0x406996
xorps xmm0, xmm0
push 0x44edd4
movlpd qword [0x44ed84], xmm0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [0x44edf0]
test ecx, ecx
je 0x4068fb
push ecx
call fcn.0040bcc0
mov ecx, dword [0x44edec]
test ecx, ecx
je 0x40690b
push ecx
call fcn.0040bb80
push dword [0x44edac]
mov dword [0x44edf0], 0
mov dword [0x44edec], 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push dword [esp + 0x5c]
call dword [sym.imp.USER32.dll_UnregisterClassW]
cmp byte [0x44ed98], 0
je 0x406979
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [esp + 0x60]
mov dword [esp + 0x70], 0
push ecx
xorps xmm0, xmm0
mov word [esp + 0x78], 0
push eax
movaps xmmword [esp + 0x68], xmm0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov eax, dword [esp + 0x64]
mov dword [0x44ed9c], eax
call fcn.00403270
mov ecx, dword [esp + 0x30c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00420eb4
mov esp, ebp
pop ebp
ret
push 5
call fcn.0042070f
push 2
call fcn.0042070f
int3