Function at 0x77cb0726
Capabilities:
Resume thread
Terminate process

Disassembly:
cmp eax, 0xc000007c
jne 0x77cad03c
mov dword [ebp - 0x24], ebx
jmp 0x77cb0881
push 4
lea eax, [ebp - 0x28]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
push dword [ebp - 0x40]
mov dword [ebp - 0x14], 1
push 0x17
push dword [edi]
call sym.ADVAPI32.dll_SetKernelObjectSecurity
mov esi, eax
cmp esi, ebx
je 0x77cad044
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
jmp 0x77cb0bb0
mov edi, dword [sym.imp.ntdll.dll_NtSetInformationThread]
push 4
lea eax, [ebp - 0x28]
push eax
push 5
push 0xfffffffffffffffe
call edi
cmp eax, ebx
jl 0x77cad03c
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x14], 1
call fcn.77cb06c0
mov esi, eax
cmp esi, ebx
je 0x77cad044
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call edi
cmp eax, ebx
jl 0x77cad03c
mov dword [ebp - 0x14], ebx
jmp 0x77cb0ae4
push 4
lea eax, [ebp - 0x28]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
push dword [ebp - 0x38]
mov dword [ebp - 0x14], 1
push 0x17
push dword [edi + 4]
call sym.ADVAPI32.dll_SetKernelObjectSecurity
mov esi, eax
cmp esi, ebx
je 0x77cad044
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
mov dword [ebp - 0x14], ebx
jmp 0x77cb0bc7
mov eax, dword [edi + 4]
jmp 0x77cb088e
push eax
jmp 0x77cdbcb7
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x77cdbe54
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x77d260c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
xor esi, esi
mov dword [ebp - 0x80], eax
mov eax, 0x1fffff
inc esi
cmp dword [ecx], ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xb8], 0x20410
mov dword [ebp - 0xb4], 0x20bea
mov dword [ebp - 0xb0], 0x121001
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], 0x20048
mov dword [ebp - 0xa4], 0x20437
mov dword [ebp - 0xa0], 0x120800
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xc8], 0x2001a
mov dword [ebp - 0xc4], 0x201e0
mov dword [ebp - 0xc0], 0x20005
mov dword [ebp - 0xbc], 0xf01ff
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x4c], ebx
je 0x77cdbcb2
cmp edx, ebx
je 0x77cb0bc7
lea eax, [ebp - 0x6c]
push eax
push 4
lea eax, [ebp - 0x70]
push eax
push 8
push edx
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
cmp eax, ebx
jl 0x77cad03c
cmp dword [ebp - 0x70], 1
jne 0x77cdbcc3
lea eax, [ebp - 0x24]
push eax
push 1
push 0xc
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtOpenThreadToken]
cmp eax, ebx
jl 0x77caad78
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
cmp edi, ebx
mov dword [ebp - 0x2c], ebx
jne 0x77cad034
xor eax, eax
lea ecx, [ebp - 0xb8]
push ecx
push dword [ebp - 0x1c]
mov edi, 0x310
push edi
push ebx
push ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
push ebx
call sym.ADVAPI32.dll_CreatePrivateObjectSecurityEx
mov esi, eax
cmp esi, ebx
je 0x77cad044
mov eax, dword [ebp - 0x80]
cmp eax, ebx
jne 0x77cdbcca
xor eax, eax
lea ecx, [ebp - 0xa8]
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push edi
push ebx
push ebx
push ecx
push eax
push ebx
call sym.ADVAPI32.dll_CreatePrivateObjectSecurityEx
mov esi, eax
cmp esi, ebx
je 0x77cad044
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push 0x110
push ebx
push ebx
push eax
push ebx
push ebx
call sym.ADVAPI32.dll_CreatePrivateObjectSecurityEx
mov esi, eax
cmp esi, ebx
je 0x77cad044
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call sym.ADVAPI32.dll_AllocateAndInitializeSid
test eax, eax
je 0x77cad042
push dword [ebp - 0x3c]
call sym.ADVAPI32.dll_GetLengthSid
mov esi, eax
add esi, 0x10
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x50], edi
je 0x77cdbcd2
push 2
push esi
push edi
call sym.ADVAPI32.dll_InitializeAcl
test eax, eax
je 0x77cad042
push dword [ebp - 0x3c]
push 0x20018
push 2
push edi
call sym.ADVAPI32.dll_AddAccessAllowedAce
test eax, eax
je 0x77cad042
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0x30]
call sym.ADVAPI32.dll_GetSecurityDescriptorDacl
test eax, eax
je 0x77cad042
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x30]
call sym.ADVAPI32.dll_GetSecurityDescriptorOwner
test eax, eax
je 0x77cad042
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x30]
call sym.ADVAPI32.dll_GetSecurityDescriptorGroup
test eax, eax
je 0x77cad042
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x30]
call sym.ADVAPI32.dll_GetSecurityDescriptorSacl
test eax, eax
je 0x77cad042
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x60]
call sym.ADVAPI32.dll_GetExplicitEntriesFromAclA
cmp eax, ebx
jne 0x77cdbce1
lea eax, [ebp - 0x48]
push eax
push edi
push dword [ebp - 0x44]
push dword [ebp - 0x84]
call sym.ADVAPI32.dll_SetEntriesInAclA
cmp eax, ebx
mov dword [ebp - 0x4c], eax
jne 0x77cdbce1
push 1
lea eax, [ebp - 0x98]
push eax
call sym.ADVAPI32.dll_InitializeSecurityDescriptor
test eax, eax
je 0x77cad042
push ebx
push dword [ebp - 0x48]
lea eax, [ebp - 0x98]
push 1
push eax
call sym.ADVAPI32.dll_SetSecurityDescriptorDacl
test eax, eax
je 0x77cad042
push dword [ebp - 0x7c]
lea eax, [ebp - 0x98]
push dword [ebp - 0x54]
push eax
call sym.ADVAPI32.dll_SetSecurityDescriptorOwner
test eax, eax
je 0x77cad042
push dword [ebp - 0x78]
lea eax, [ebp - 0x98]
push dword [ebp - 0x64]
push eax
call sym.ADVAPI32.dll_SetSecurityDescriptorGroup
test eax, eax
je 0x77cad042
cmp dword [ebp - 0x68], ebx
je 0x77cb0aac
push dword [ebp - 0x74]
lea eax, [ebp - 0x98]
push dword [ebp - 0x58]
push 1
push eax
call sym.ADVAPI32.dll_SetSecurityDescriptorSacl
test eax, eax
je 0x77cad042
lea eax, [ebp - 0x28]
push eax
push 2
push 2
push ebx
push 0xc
push dword [ebp - 0x1c]
call sym.ADVAPI32.dll_DuplicateTokenEx
mov esi, eax
cmp esi, ebx
je 0x77cad044
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x98]
push eax
call fcn.77cb06c0
test eax, eax
je 0x77cab7b6
mov edi, dword [sym.imp.ntdll.dll_NtOpenProcessToken]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push 8
push dword [eax]
call edi
test eax, eax
jl 0x77cdbce4
lea eax, [ebp - 0x6c]
push eax
push 4
lea eax, [ebp - 0x5c]
push eax
push 0x18
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
jl 0x77cdbd36
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebp - 0x34]
push dword [eax + 4]
push dword [eax]
call fcn.77cb060c
mov esi, eax
cmp esi, ebx
je 0x77cdbd3e
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
mov esi, 0x80
push esi
push dword [eax]
call edi
test eax, eax
jl 0x77cdbda0
push 4
lea eax, [ebp - 0x5c]
push eax
push 0x18
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtSetInformationToken]
push dword [ebp - 0x18]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp edi, ebx
mov dword [ebp - 0x18], ebx
jl 0x77cdbdf3
mov edi, dword [ebp - 0x10]
push ebx
push dword [edi]
call fcn.77cb0cb0
mov esi, eax
cmp esi, ebx
je 0x77cdbdf9
push dword [ebp - 0x40]
push 0x17
push dword [edi]
call sym.ADVAPI32.dll_SetKernelObjectSecurity
test eax, eax
je 0x77cab751
push dword [ebp - 0x38]
push 0x17
push dword [edi + 4]
call sym.ADVAPI32.dll_SetKernelObjectSecurity
mov esi, eax
cmp esi, ebx
je 0x77cab810
test byte [ebp + 8], 1
jne 0x77cb0bd9
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, ebx
je 0x77cad044
cmp dword [ebp - 0x30], ebx
je 0x77cb0bef
lea eax, [ebp - 0x30]
push eax
call sym.ADVAPI32.dll_DestroyPrivateObjectSecurity
cmp dword [ebp - 0x40], ebx
je 0x77cb0bfd
lea eax, [ebp - 0x40]
push eax
call sym.ADVAPI32.dll_DestroyPrivateObjectSecurity
cmp dword [ebp - 0x38], ebx
je 0x77cb0c0b
lea eax, [ebp - 0x38]
push eax
call sym.ADVAPI32.dll_DestroyPrivateObjectSecurity
cmp dword [ebp - 0x34], ebx
je 0x77cb0c19
push dword [ebp - 0x34]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x28], ebx
je 0x77cb0c30
cmp dword [ebp - 0x14], ebx
jne 0x77cdbe5c
push dword [ebp - 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x24], ebx
je 0x77cb0c53
cmp dword [ebp - 0x2c], ebx
jne 0x77cb0c4a
push 4
lea eax, [ebp - 0x24]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x3c], ebx
je 0x77cb0c60
push dword [ebp - 0x3c]
call sym.ADVAPI32.dll_FreeSid
cmp dword [ebp - 0x50], ebx
je 0x77cb0c76
push dword [ebp - 0x50]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x44], ebx
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x77cb0c86
push dword [ebp - 0x44]
call edi
cmp dword [ebp - 0x48], ebx
je 0x77cb0c90
push dword [ebp - 0x48]
call edi
cmp esi, ebx
je 0x77cdbe71
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.77cd6011
leave
ret 0x14
push 0xc0000008
xor esi, esi
call fcn.77ccf995
jmp 0x77cad044
push 0xc00000a8
jmp 0x77cdbcb7
mov eax, dword [eax + 4]
jmp 0x77cb08c2
push 8
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x77cad044
push eax
jmp 0x77cdbcd4
mov esi, dword [sym.imp.ntdll.dll_NtSetInformationThread]
push 4
lea eax, [ebp - 0x28]
push eax
push 5
push 0xfffffffffffffffe
call esi
cmp eax, ebx
jl 0x77cad03c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push 8
push dword [eax]
mov dword [ebp - 0x14], 1
call edi
cmp eax, ebx
jl 0x77cad03c
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call esi
cmp eax, ebx
jl 0x77cad03c
mov dword [ebp - 0x14], ebx
jmp 0x77cb0aff
push dword [ebp - 0x1c]
jmp 0x77cdbcb7
cmp dword [ebp - 0x24], ebx
je 0x77cb0bd9
push 4
lea eax, [ebp - 0x24]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
xor eax, eax
inc eax
push eax
push dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
push dword [eax]
call fcn.77cb060c
mov esi, eax
cmp esi, ebx
je 0x77cad044
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
mov dword [ebp - 0x2c], ebx
jmp 0x77cb0b47
push 4
lea eax, [ebp - 0x28]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push esi
push dword [eax]
mov dword [ebp - 0x14], 1
call edi
cmp eax, ebx
jl 0x77cad03c
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
mov dword [ebp - 0x14], ebx
jmp 0x77cb0b60
push edi
jmp 0x77cdbcb7
cmp dword [ebp - 0x24], ebx
je 0x77cb0bd9
push 4
lea eax, [ebp - 0x24]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
xor eax, eax
inc eax
push eax
mov dword [ebp - 0x2c], eax
mov eax, edi
push dword [eax]
call fcn.77cb0cb0
mov esi, eax
cmp esi, ebx
je 0x77cad044
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
cmp eax, ebx
jl 0x77cad03c
mov dword [ebp - 0x2c], ebx
jmp 0x77cb0b9c
mov dword [ebp - 0x4c], eax
jmp 0x77cb0be1
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
jmp 0x77cb0c27
mov edi, dword [ebp - 0x10]
mov eax, dword [edi]
cmp eax, ebx
je 0x77cdbe8b
push 5
push eax
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov edi, dword [edi + 4]
cmp edi, ebx
je 0x77cdbe99
push edi
call dword [sym.imp.ntdll.dll_NtClose]
mov edi, dword [ebp - 0x10]
push dword [ebp - 0x4c]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x77cb0c98