Function at 0x40afbb
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov esi, str.SeDebugPrivilege
push esi
call fcn.0040aee3
push esi
call fcn.0040aee3
mov esi, dword [0x42f1c4]
mov edx, dword [0x42f1c0]
mov eax, 0x239
cmp esi, eax
cmove esi, eax
mov eax, edx
not eax
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, 0x2b2
and eax, ebx
neg eax
sbb eax, eax
pop ecx
pop ecx
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov ecx, edx
not ecx
and ecx, ebx
shl esi, 0x13
or esi, 1
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or eax, ecx
xor ebx, ebx
mov dword [0x42f1c4], esi
mov dword [0x42f1c0], eax
test esi, esi
jne 0x40b03e
push ebx
call edi
mov esi, dword [0x42f1c4]
inc esi
mov eax, 0x149
cmove esi, eax
mov dword [0x42f1c4], esi
push str.NtQuerySystemInformation
mov esi, str.ntdll.dll
push esi
call fcn.0040b98d
push str.NtDuplicateObject
push esi
mov ebp, eax
call fcn.0040b98d
push str.NtQueryObject
push esi
mov dword [esp + 0x44], eax
call fcn.0040b98d
mov dword [esp + 0x48], eax
mov al, byte [esp + 0x6c]
add esp, 0x18
mov dword [esp + 0x1c], ebx
test al, al
jne 0x40b1bb
mov edx, dword [0x42f1c4]
shl edx, 0xe
or edx, 0x20b
mov esi, 0x10000
mov dword [0x42f1c4], edx
jne 0x40b0b6
push 0
call edi
mov edx, dword [0x42f1c4]
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
and ecx, 0x2b2
neg ecx
sbb ecx, ecx
add eax, eax
neg ecx
or eax, ecx
mov dword [0x42f1c0], eax
mov eax, 0x17a
cmp edx, eax
push esi
cmove edx, eax
push 0
mov dword [0x42f1c4], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov ebx, eax
push ebx
push 0x10
mov dword [esp + 0x2c], eax
call ebp
cmp eax, 0xc0000004
jne 0x40b161
add esi, esi
push esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebx, eax
mov eax, dword [0x42f1c4]
or eax, 0x32c
mov dword [0x42f1c4], eax
jne 0x40b144
push 0
call edi
mov eax, dword [0x42f1c4]
test eax, eax
jne 0x40b144
push eax
call edi
mov eax, dword [0x42f1c4]
push 0
push esi
push ebx
or eax, 0x398
push 0x10
mov dword [0x42f1c4], eax
call ebp
cmp eax, 0xc0000004
je 0x40b109
mov dword [esp + 0x1c], ebx
test eax, eax
js 0x40b169
test ebx, ebx
jne 0x40b1b7
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
and ecx, 0x2b2
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or eax, ecx
cmp dword [0x42f1c4], 0
mov dword [0x42f1c0], eax
jne 0x40b1b0
xor ebx, ebx
push ebx
call edi
cmp dword [0x42f1c4], ebx
jne 0x40b1b0
push 0x2a9
mov eax, 0x430738
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x40b80b
mov al, byte [esp + 0x54]
mov ebp, dword [esp + 0x50]
xor edx, edx
lea edi, [ebx + 4]
mov ebx, dword [0x42f1c4]
mov byte [esp + 0x13], dl
mov esi, edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], esi
test al, al
je 0x40b1e3
mov eax, 0xffff
jmp 0x40b1e9
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
cmp esi, eax
jae 0x40b7f7
mov esi, edi
lea edi, [esp + 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x48], 0x12019f
je 0x40b7e0
mov eax, 0x3c4
cmp ebx, eax
cmove ebx, eax
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
or ebx, 0x3ac
mov esi, 0x2b2
and ecx, esi
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or eax, ecx
mov ecx, 0x1a4
cmp ebx, ecx
cmove ebx, ecx
or ebx, 0x35a
mov dword [0x42f1c4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [0x42f1c0], eax
jne 0x40b260
push edx
call ebx
mov eax, dword [0x42f1c0]
xor edx, edx
mov edi, dword [esp + 0x3c]
mov ecx, eax
not ecx
and ecx, esi
neg ecx
sbb ecx, ecx
push edi
neg ecx
add eax, eax
push edx
or eax, ecx
push 0x40
mov dword [0x42f1c0], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov si, word [esp + 0x42]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40b303
xor eax, eax
push eax
push eax
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
movzx eax, si
push eax
push dword [esp + 0x2c]
call dword [esp + 0x48]
test eax, eax
jns 0x40b303
mov ecx, dword [0x42f1c0]
push dword [esp + 0x14]
mov eax, ecx
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
mov edx, 0x80000000
and eax, edx
add eax, edx
shr ecx, 1
or ecx, eax
mov eax, dword [0x42f1c4]
mov dword [0x42f1c0], ecx
inc eax
mov ecx, 0x36d
cmove eax, ecx
mov dword [0x42f1c4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [0x42f1c4]
jmp 0x40b7de
push 0x1000
push 0
movzx esi, si
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x40b3a1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [0x42f1c4]
mov eax, 0x351
cmp ebx, eax
cmove ebx, eax
mov dword [0x42f1c4], ebx
test ebx, ebx
jne 0x40b35f
push 0x125
mov eax, 0x43073c
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [0x42f1c4]
mov eax, dword [0x42f1c0]
mov edx, eax
not edx
mov esi, 0x2b2
and edx, esi
neg edx
sbb edx, edx
add eax, eax
neg edx
or edx, eax
mov ecx, edx
not ecx
and ecx, esi
or ebx, 0x238
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or ecx, eax
mov dword [0x42f1c4], ebx
mov dword [0x42f1c0], ecx
jmp 0x40b7de
push 0
push 0x1000
push eax
push 2
push esi
call dword [esp + 0x44]
test eax, eax
jns 0x40b3d7
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40b2f8
push esi
call fcn.0040abc4
pop ecx
mov ecx, eax
mov dword [esp + 0x38], ecx
test ecx, ecx
je 0x40b66a
xor edx, edx
cmp word [ecx], dx
jbe 0x40b66a
mov al, byte [esp + 0x40]
inc dword [ebp + 0x1c]
mov byte [ebp + 0xc], al
mov eax, dword [esp + 0x18]
mov dword [ebp], edi
mov edi, dword [esp + 0x14]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp + 8], esi
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], edx
mov dword [ebp + 4], edi
cmp dword [eax], edx
je 0x40b577
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
push ebp
call dword [eax + ecx*8]
mov edi, dword [0x42f1c4]
pop ecx
mov dword [esp + 0x34], eax
test edi, edi
jne 0x40b45a
push 0x352
mov eax, 0x430740
push eax
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [0x42f1c4]
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
mov esi, 0x2b2
and ecx, esi
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or ecx, eax
mov edx, ecx
not edx
and edx, esi
neg edx
sbb edx, edx
lea eax, [ecx + ecx]
neg edx
or edx, eax
mov esi, edx
not esi
and esi, 0x2b2
neg esi
sbb esi, esi
mov eax, 0x80000000
and esi, eax
add esi, eax
shr edx, 1
mov ecx, edi
or esi, edx
shl ecx, 3
or ecx, 0x529
mov dword [0x42f1c0], esi
mov dword [0x42f1c4], ecx
jne 0x40b504
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x19b
mov eax, 0x430744
push eax
push eax
xor edi, edi
push edi
call esi
mov ecx, dword [0x42f1c4]
test ecx, ecx
jne 0x40b4fc
push edi
call ebx
mov ecx, dword [0x42f1c4]
test ecx, ecx
jne 0x40b4fc
push 0xa1
mov eax, 0x430748
push eax
push eax
push edi
call esi
mov ecx, dword [0x42f1c4]
mov esi, dword [0x42f1c0]
jmp 0x40b506
xor edi, edi
mov eax, dword [esp + 0x34]
or ecx, 0x273
inc dword [ebp + 0x18]
mov dword [0x42f1c4], ecx
cmp eax, 1
je 0x40b564
test eax, eax
je 0x40b573
cmp eax, 2
je 0x40b660
mov eax, 0xfe
cmp ecx, eax
cmove ecx, eax
mov eax, esi
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
mov edx, 0x80000000
and eax, edx
add eax, edx
shr esi, 1
or eax, esi
shl ecx, 0xc
or ecx, 1
mov dword [esp + 0x34], edi
mov dword [0x42f1c0], eax
mov dword [0x42f1c4], ecx
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
cmp dword [eax + ecx*8], edi
jne 0x40b426
mov edi, dword [esp + 0x14]
push dword [esp + 0x18]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [0x42f1c4]
or esi, 0x18d
mov dword [0x42f1c4], esi
jne 0x40b5aa
xor eax, eax
push eax
call ebx
mov esi, dword [0x42f1c4]
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
and ecx, 0x2b2
neg ecx
sbb ecx, ecx
add eax, eax
neg ecx
or ecx, eax
mov edx, ecx
not edx
and edx, 0x2b2
neg edx
sbb edx, edx
neg edx
lea eax, [ecx + ecx]
or edx, eax
or esi, 0x35f
mov eax, 0x296
cmp esi, eax
cmove esi, eax
inc esi
mov eax, 0x212
cmove esi, eax
mov eax, edx
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or eax, edx
mov dword [0x42f1c4], esi
mov dword [0x42f1c0], eax
test esi, esi
jne 0x40b625
xor eax, eax
push eax
call ebx
mov esi, dword [0x42f1c4]
mov eax, 0x3d5
cmp esi, eax
cmove esi, eax
mov dword [0x42f1c4], esi
test esi, esi
jne 0x40b644
xor eax, eax
push eax
call ebx
mov esi, dword [0x42f1c4]
or esi, 0x338
mov dword [0x42f1c4], esi
jne 0x40b77b
xor esi, esi
push esi
call ebx
jmp 0x40b77d
mov byte [esp + 0x13], 1
jmp 0x40b573
mov edx, dword [0x42f1c4]
or edx, 0x33a
mov eax, 0x319
cmp edx, eax
cmove edx, eax
or edx, 0x40
add eax, 0xffffffbb
cmp edx, eax
cmove edx, eax
shl edx, 9
or edx, 1
mov eax, 0x242
cmp edx, eax
cmove edx, eax
inc edx
mov eax, 0x2df
cmove edx, eax
mov eax, dword [esp + 0x18]
inc dword [ebp + 0x1c]
mov dword [ebp + 0x10], eax
mov eax, dword [0x42f1c0]
mov ecx, eax
not ecx
and ecx, 0x2b2
neg ecx
sbb ecx, ecx
mov dword [ebp + 8], esi
mov esi, 0x80000000
and ecx, esi
shr eax, 1
add ecx, esi
or ecx, eax
inc edx
mov eax, 0x168
cmove edx, eax
mov eax, 0x38b
cmp edx, eax
cmove edx, eax
shl edx, 0x1a
or edx, 1
mov dword [ebp], edi
mov dword [0x42f1c0], ecx
mov dword [0x42f1c4], edx
jne 0x40b708
xor edi, edi
push edi
call ebx
mov edx, dword [0x42f1c4]
jmp 0x40b70a
xor edi, edi
mov eax, 0xc0
or edx, 0x384
cmp edx, eax
cmove edx, eax
mov al, byte [esp + 0x40]
mov dword [ebp + 0x14], edi
mov byte [ebp + 0xc], al
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x18], edi
mov edi, dword [esp + 0x14]
xor esi, esi
mov dword [ebp + 4], edi
mov dword [0x42f1c4], edx
cmp dword [eax], esi
je 0x40b577
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
push ebp
call dword [eax + ecx*8]
inc dword [ebp + 0x18]
pop ecx
mov ecx, dword [ebp + 0x18]
cmp eax, 1
je 0x40b764
test eax, eax
je 0x40b577
cmp eax, 2
je 0x40b771
mov eax, dword [ebp + 0x20]
cmp dword [eax + ecx*8], esi
jne 0x40b741
jmp 0x40b577
mov byte [esp + 0x13], 1
jmp 0x40b577
xor esi, esi
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40b794
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x42f1c0]
mov edx, eax
not edx
mov ebx, 0x2b2
and edx, ebx
neg edx
sbb edx, edx
add eax, eax
neg edx
or edx, eax
mov ecx, edx
not ecx
and ecx, ebx
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or ecx, eax
cmp byte [esp + 0x13], 0
mov ebx, 0x81000375
mov dword [0x42f1c0], ecx
mov dword [0x42f1c4], ebx
jne 0x40b7f5
xor edx, edx
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov al, byte [esp + 0x54]
inc esi
add edi, 0x10
jmp 0x40b1d0
xor edx, edx
push dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret