Function at 0x412f40
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x20
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
push str.SeCreateGlobalPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebp, 1
lea ebx, [ebp + 3]
je 0x412f92
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ebx
call edi
lea ecx, [esp + 0x10]
push ecx
push str.SeBackupPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x412fd0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x10
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
call edi
lea edx, [esp + 0x10]
push edx
push str.SeCreatePagefilePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41300e
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ebx
call edi
lea eax, [esp + 0x10]
push eax
push str.SeCreateSymbolicLinkPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41304c
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ebx
call edi
lea ecx, [esp + 0x10]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41308a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x10
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
call edi
lea edx, [esp + 0x10]
push edx
push str.SeImpersonatePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4130c8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ebx
call edi
lea eax, [esp + 0x10]
push eax
push str.SeIncreaseBasePriorityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x413106
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ebx
call edi
lea ecx, [esp + 0x10]
push ecx
push str.SeIncreaseQuotaPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x413144
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x10
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
call edi
lea edx, [esp + 0x10]
push edx
push str.SeLoadDriverPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x413182
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ebx
call edi
lea eax, [esp + 0x10]
push eax
push str.SeManageVolumePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4131c0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ebx
call edi
lea ecx, [esp + 0x10]
push ecx
push str.SeProfileSingleProcessPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4131fe
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x10
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
call edi
lea edx, [esp + 0x10]
push edx
push str.SeRemoteShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41323c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ebx
call edi
lea eax, [esp + 0x10]
push eax
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x41327a
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ebx
call edi
lea ecx, [esp + 0x10]
push ecx
push str.SeSecurityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4132b8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x10
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
call edi
lea edx, [esp + 0x10]
push edx
push str.SeSystemEnvironmentPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4132f6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ebx
call edi
lea eax, [esp + 0x10]
push eax
push str.SeSystemProfilePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x413334
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ebx
call edi
lea ecx, [esp + 0x10]
push ecx
push str.SeSystemtimePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x413372
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x10
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
call edi
lea edx, [esp + 0x10]
push edx
push str.SeTakeOwnershipPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4133b0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0x10
lea edx, [esp + 0x24]
push edx
push 0
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ebx
call edi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x20
ret