Function at 0x402070
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x80
push esi
xor eax, eax
mov esi, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
xor edx, edx
mov dword [esp + 0x30], eax
cmp dword [esi + 0x10], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x44], 0x44
jne 0x4020c4
mov ecx, dword [esp + 0x8c]
push ecx
mov ecx, esi
call fcn.00401ff0
pop edi
pop esi
add esp, 0x80
ret 4
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, edx
push ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
je 0x4020f5
call eax
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4020f9
pop ebp
pop edi
xor al, al
pop esi
add esp, 0x80
ret 4
mov ebp, dword [esp + 0x1c]
push ebx
push ebp
mov ecx, esi
call fcn.00401eb0
mov ebx, eax
test ebx, ebx
jne 0x402117
pop ebx
pop ebp
pop edi
xor al, al
pop esi
add esp, 0x80
ret 4
mov eax, dword [esi + 0xc]
test eax, eax
je 0x402157
lea edx, [esp + 0x1c]
push edx
push ebp
call eax
test eax, eax
jne 0x402157
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x402286
mov eax, dword [esp + 0x94]
push eax
mov ecx, esi
call fcn.00401ff0
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x80
ret 4
xor eax, eax
push ebx
push eax
mov ecx, 0x11
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
push 0x2000000
mov dword [esp + 0x58], 0x44
mov dword [esp + 0x60], str.winsta0default
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
push 0x201eb
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402286
lea edx, [esp + 0x24]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x402286
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
mov ebx, 1
push ebx
push ebx
push 0
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x28]
push 0x2000000
push eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], 2
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x402286
mov ecx, dword [esp + 0x10]
push 4
push ebp
push 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov eax, dword [esp + 0x10]
push 0
push 0
push 0x10
lea edx, [esp + 0x48]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x402286
mov ecx, dword [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x402286
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x18]
push 0
push edx
push 0x430
push 0
push 0
push 0
push eax
push 0
push ecx
call dword [esi + 0x10]
test eax, eax
je 0x402286
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x30]
push eax
call esi
mov dword [esp + 0x20], ebx
jmp 0x40228c
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402297
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4022a2
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4022b1
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test edi, edi
je 0x4022b8
push edi
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4022c3
push eax
call esi
mov eax, dword [esp + 0x20]
pop ebx
pop ebp
test eax, eax
pop edi
setne al
pop esi
add esp, 0x80
ret 4