Function at 0x431260
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x467040]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
test cl, cl
jne 0x4312b0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 8
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str._System_Scanner__Running_checks_for_restarted_processes..._n
call fcn.00406160
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea eax, ds:[esp + 0x18]
xorps xmm0, xmm0
push eax
push 0x28
movaps xmmword [esp + 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [esp + 0x24]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 1
push eax
push 0
push dword [esp + 0x2c]
mov dword [esp + 0x44], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x38]
mov dword [esp + 0x48], str.PlugPlay
mov dword [esp + 0x4c], str.PcaSvc
mov dword [esp + 0x50], 0x458a64
mov dword [esp + 0x54], str.Eventlog
mov dword [esp + 0x58], str.DiagTrack
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
call fcn.00430b60
test al, al
je 0x4314e6
lea eax, [esp + 0x48]
mov dword [esp + 0x18], eax
mov esi, dword [eax]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x1c]
call fcn.00443680
mov ecx, dword ds:[esp + 0x14]
test eax, eax
js 0x4314b2
lea eax, [esp + 0x20]
mov edx, esi
push eax
call fcn.004438a0
add esp, 4
test eax, eax
js 0x4314ae
cmp word [esp + 0x20], 3
jne 0x4313b9
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x38]
call fcn.00431040
jmp 0x43143e
lfence
mov eax, str.DiagTrack
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4313e9
test dx, dx
je 0x4313e5
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4313e9
add ecx, 4
add eax, 4
test dx, dx
jne 0x4313c3
xor eax, eax
jmp 0x4313ee
sbb eax, eax
or eax, 1
test eax, eax
je 0x43143e
lfence
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, str.____The_following_process_is_not_running_for_service
call fcn.00406160
mov edx, esi
mov ecx, eax
call fcn.00406160
mov edx, 0x458bac
mov ecx, eax
call fcn.00406160
mov edx, esi
mov ecx, eax
call fcn.00406160
mov edx, str.._Print_a_warning_message.
mov ecx, eax
call fcn.00406160
push 0x408660
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x431468
mov eax, dword ds:[ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x44b694]
call esi
test edi, edi
je 0x43147c
mov eax, dword [edi]
push edi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x44b694]
call esi
nop dword [eax]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x5c]
add eax, 4
mov dword [esp + 0x18], eax
cmp eax, ecx
jne 0x431361
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00444aa0
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x4314ca
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x44b694]
call esi
test edi, edi
je 0x4314de
mov eax, dword [edi]
push edi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x44b694]
call esi
nop
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
xor ecx, esp
call fcn.00444aa0
mov esp, ebp
pop ebp
ret