Function at 0x40a5a6
Capabilities:
Acquire debug privileges

Disassembly:
push 0x154
mov eax, 0x5117b1
call fcn.004d8af2
mov dword [ebp - 0x130], edx
mov edi, ecx
mov dword [ebp - 0x150], edi
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x12c], edi
xor esi, esi
mov ebx, vtable.ATL::CAccessToken.0
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a678
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0xd0
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x128]
call fcn.00406620
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.00407189
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x140], ebx
call fcn.004065be
jmp 0x40aaf6
mov eax, dword [ebp - 0x12c]
push esi
push ecx
push str.SeDebugPrivilege
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x13c], eax
call fcn.004064e5
test al, al
jne 0x40a6f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0xd5
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x128]
call fcn.00406620
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x120]
lea ecx, [ecx - 0x10]
jmp 0x40a65d
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x140], ebx
call fcn.004065be
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
lea edx, [ebp - 0x140]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x128]
call fcn.0040a1ba
mov byte [ebp - 4], 4
cmp dword [ebp - 0x128], 0
jge 0x40a7b3
cmp dword [ebp - 0x124], 0
mov eax, 0xd9
cmovne eax, dword [ebp - 0x124]
push eax
push dword [ebp - 0x128]
push ecx
mov ecx, dword [ebp - 0x120]
mov esi, esp
mov dword [ebp - 0x130], esi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x15c]
mov dword [esi], eax
call fcn.00406620
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 5
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x154]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x120]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x40aae1
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x120]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov edx, str.SeDebugPrivilege
lea ecx, [ebp - 0x15c]
call fcn.0040124a
mov ecx, dword [ebp - 0x154]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, esi
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x13c], eax
jbe 0x40aac8
mov edi, dword [ebp - 0x140]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x12c], edi
cmp eax, dword [ebp - 0x13c]
jae 0x40aafe
push dword [edi]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x144], esi
test esi, esi
jne 0x40a83e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 4], 3
jmp 0x40a9ff
and dword [ebp - 0x11c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movzx ecx, word [edi + 6]
lea edx, [ebp - 0x11c]
push 2
push 0
push 0
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x40a874
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40a9e0
and dword [ebp - 0x94], 0
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x11c]
lea ecx, [ebp - 0x128]
push eax
call fcn.0040a388
pop ecx
cmp dword [ebp - 0x128], 0
jl 0x40a9b9
mov eax, dword [ebp - 0x94]
cmp word [eax], 6
jne 0x40a9b9
mov eax, dword [eax + 4]
movzx ecx, word [eax]
cmp ecx, 0x4a
je 0x40a8c9
cmp ecx, 0x6a
jne 0x40a9b9
movzx ecx, word [eax + 2]
cmp ecx, 0x4f
je 0x40a8db
cmp ecx, 0x6f
jne 0x40a9b9
movzx eax, word [eax + 4]
cmp eax, 0x42
je 0x40a8ed
cmp eax, 0x62
jne 0x40a9b9
and dword [ebp - 0x118], 0
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x11c]
lea ecx, [ebp - 0x15c]
push eax
call fcn.0040a0a8
pop ecx
push eax
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0xb
call fcn.004032ed
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x154]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x128], 0
jge 0x40a94a
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
jmp 0x40a9ac
mov eax, dword [ebp - 0x118]
and dword [ebp - 0x148], 0
cmp dword [eax + 4], 0
jbe 0x40a9a4
push 8
pop ecx
mov dword [ebp - 0x144], ecx
mov edi, dword [eax + ecx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
je 0x40aa28
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x118]
inc edx
mov ecx, dword [ebp - 0x144]
add ecx, 4
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], ecx
cmp edx, dword [eax + 4]
jb 0x40a966
mov edi, dword [ebp - 0x12c]
lea ecx, [ebp - 0x114]
cmp eax, ecx
je 0x40a9b9
lea ecx, [ebp - 0x118]
call fcn.0040ad94
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.00407189
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
je 0x40a9e0
lea ecx, [ebp - 0x94]
call fcn.0040ad94
cmp dword [ebp - 0x11c], 0
je 0x40a9f8
push dword [ebp - 0x11c]
call ebx
and dword [ebp - 0x11c], 0
push esi
mov byte [ebp - 4], 3
call ebx
mov eax, dword [ebp - 0x14c]
add edi, 0x10
inc eax
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x14c], eax
cmp eax, dword [ebp - 0x13c]
jae 0x40aac2
xor esi, esi
jmp 0x40a809
mov edi, dword [ebp - 0x130]
lea eax, [ebp - 0x11c]
cmp edi, eax
je 0x40aa50
cmp dword [edi], 0
je 0x40aa41
push dword [edi]
call ebx
mov eax, dword [ebp - 0x11c]
and dword [ebp - 0x11c], 0
mov dword [edi], eax
mov edi, dword [ebp - 0x150]
and dword [edi], 0
lea ecx, [edi + 8]
and dword [edi + 4], 0
call fcn.0040687a
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
je 0x40aa7e
lea ecx, [ebp - 0x118]
call fcn.0040ad94
mov ecx, dword [ebp - 0x120]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
je 0x40aaa5
lea ecx, [ebp - 0x94]
call fcn.0040ad94
cmp dword [ebp - 0x11c], 0
je 0x40aabd
push dword [ebp - 0x11c]
call ebx
and dword [ebp - 0x11c], 0
push esi
call ebx
jmp 0x40aae1
mov edi, dword [ebp - 0x150]
push 0x11f
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, edi
call fcn.00406620
cmp dword [ebp - 0x140], 0
je 0x40aaf6
push dword [ebp - 0x140]
call fcn.004e3620
pop ecx
mov eax, edi
call fcn.004d8aa1
ret
mov edx, 0x302
mov ecx, 0x80070057
call fcn.004071ab
int3