Function at 0x40b6b7
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, 0x15a0
call fcn.004173a0
cmp dword [esp + 0x15b8], 0x10
lea edx, [esp + 0x15a4]
mov eax, dword [esp + 0x15b4]
cmovae edx, dword [esp + 0x15a4]
push ebx
push ebp
push esi
push edi
add eax, edx
mov edi, ecx
cmp dword [esp + 0x15c8], 0x10
lea edx, [esp + 0x13]
push edx
lea ecx, [esp + 0x15b8]
cmovae ecx, dword [esp + 0x15b8]
push eax
push ecx
lea ecx, [esp + 0x48]
call fcn.0040afe9
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
push 0x28
push 0x2f79e55b
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push eax
push 0x639f9ea
push 4
call fcn.0040ab30
pop ecx
pop ecx
call eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 1
push eax
push str.SeDebugPrivilege
push ebx
mov dword [esp + 0x60], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x54]
push eax
push ebx
push dword [esp + 0x28]
push 0xf21c1a30
push 4
call fcn.0040ab30
pop ecx
pop ecx
call eax
push dword [esp + 0x14]
push 0x4f6cea0b
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
lea eax, [esp + 0x30]
mov dword [esp + 0x1c], ebx
push eax
push 0x1000
lea eax, [esp + 0x5b8]
push eax
push 0xfaf65de3
push 6
call fcn.0040ab30
pop ecx
pop ecx
call eax
mov ebp, dword [esp + 0x30]
mov esi, ebx
shr ebp, 2
test ebp, ebp
je 0x40b835
mov eax, dword [esp + esi*4 + 0x5b0]
test eax, eax
je 0x40b830
push eax
push ebx
push 0x2000000
push 0x20d8aeb4
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push 0x104
mov ebx, eax
lea eax, [esp + 0xac]
push eax
push 0
push ebx
push 0xd2cc14cd
push 6
call fcn.0040ab30
pop ecx
pop ecx
call eax
lea eax, [esp + 0xa8]
push eax
call fcn.0041deca
push dword [esp + 0x15d4]
lea eax, [esp + 0xb0]
push eax
call fcn.0041b470
add esp, 0xc
test eax, eax
je 0x40b82e
test ebx, ebx
je 0x40b82e
mov dword [esp + 0x1c], ebx
xor ebx, ebx
inc esi
cmp esi, ebp
jb 0x40b7bb
push 0x1f4
push 0x310d1257
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push 0x104
lea eax, [esp + 0x1b4]
push eax
push ebx
push 0xf740085f
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push 0x48
pop ebp
push ebp
lea eax, [esp + 0x64]
mov esi, 0x93956d18
push eax
push esi
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push 0x10
lea eax, [esp + 0x24]
push eax
push esi
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
lea eax, [esp + 0x18]
push eax
push ebx
push 2
push ebx
push 0xd9a3a95f
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
mov ebx, dword [esp + 0x18]
push ebx
call fcn.0041713b
mov esi, eax
pop ecx
test esi, esi
je 0x40b8c9
push ebx
xor ebx, ebx
push ebx
push esi
call fcn.00419730
add esp, 0xc
jmp 0x40b8cd
xor ebx, ebx
mov esi, ebx
lea eax, [esp + 0x18]
mov dword [esp + 0xa4], esi
push eax
push ebx
push 2
push esi
push 0xd9a3a95f
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push ebx
push ebx
push 4
lea eax, [esp + 0x40]
mov dword [esp + 0x40], ebx
push eax
push 0x20007
push ebx
push dword [esp + 0xbc]
mov esi, 0x5199f0b9
mov dword [esp + 0x54], 0x1010
push esi
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push ebx
push ebx
push 4
lea eax, [esp + 0x28]
push eax
push 0x20000
push ebx
push dword [esp + 0xbc]
push esi
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
lea eax, [esp + 0x20]
mov dword [esp + 0x60], ebp
push eax
lea eax, [esp + 0x64]
push eax
push ebx
push ebx
push 0x80004
push ebx
push ebx
push ebx
push dword [esp + 0x15ec]
lea eax, [esp + 0x1d4]
push eax
push 0x57ae26e9
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
lea eax, [esp + 0x20]
mov ecx, edi
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.0040b5c9
mov esi, dword [esp + 0x3c]
mov ecx, edi
push esi
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi + 0xa0], ebx
lea eax, [esp + 0x24]
push eax
je 0x40b9a5
call fcn.0040bbc3
jmp 0x40b9aa
call fcn.0040ba4d
push esi
test eax, eax
je 0x40b9c0
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call fcn.0040b2cf
xor ebx, ebx
inc ebx
jmp 0x40ba29
push ebx
push 0xbf09bd92
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push eax
push 0x4f091756
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
cmp dword [esp + 0x24], 0
je 0x40b9fa
push dword [esp + 0x24]
push 0x4f6cea0b
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
cmp dword [esp + 0x20], 0
je 0x40ba29
push 0xffffffffffffffff
push dword [esp + 0x24]
push 0x54bf4072
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
push dword [esp + 0x20]
push 0x4f6cea0b
push ebx
call fcn.0040ab30
pop ecx
pop ecx
call eax
lea ecx, [esp + 0x3c]
call fcn.0040b246
lea ecx, [esp + 0x15b4]
call fcn.00405987
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x15a0
ret 0x20