Function at 0x403eb0
Capabilities:
Acquire debug privileges
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x1c], 1
push edi
push str.AddBypassNROReg__s_
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 1
call fcn.004044f0
push edi
call fcn.00404bf0
add esp, 0xc
test eax, eax
je 0x403f24
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403f3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Open_process_token_failed___u
call fcn.004044f0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
push 0x28
call fcn.0040b401
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
test ebx, ebx
jne 0x403f6e
push str.Failed_to_alloc_privileges_memory
call fcn.004044f0
lea eax, [ebx + 1]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [ebx + 4]
push eax
push str.SeDebugPrivilege
push 0
call esi
test eax, eax
je 0x40417c
lea eax, [ebx + 0x10]
push eax
push str.SeBackupPrivilege
push 0
call esi
test eax, eax
je 0x40417c
lea eax, [ebx + 0x1c]
push eax
push str.SeRestorePrivilege
push 0
call esi
test eax, eax
je 0x40417c
push 0
push 0
push 0x28
mov dword [ebx], 3
push ebx
push 0
mov dword [ebx + 0xc], 2
mov dword [ebx + 0x18], 2
mov dword [ebx + 0x24], 2
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x404175
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x404175
push str.AdjustTokenPrivileges_success
call fcn.004044f0
add esp, 4
push edi
push str.VTOYNEWSW
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
test eax, eax
je 0x40402b
push eax
push str.RegLoadKey_Failed_0x_x
call fcn.004044f0
add esp, 8
jmp 0x404189
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 4
push 0
push 0
push str.VTOYNEWSWMicrosoftWindowsCurrentVersion
push 0x80000002
call edi
mov esi, str.SUCCESS
test eax, eax
je 0x404073
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.Failed_to_create_reg_key_VTOYNEWSWMicrosoftWindowsCurrentVersion__u__u
call fcn.004044f0
jmp 0x404147
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 7
push 0
push 0
push 0
push str.OOBE
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4040ab
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.Failed_to_create_OOBE_reg___u__u
call fcn.004044f0
jmp 0x404147
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.BypassNRO
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
test eax, eax
mov ecx, esi
mov eax, str.FAILED
cmovne ecx, eax
push ecx
push str.Create_BypassNRO_registry__s__u
call fcn.004044f0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
add esp, 0xc
push dword [ebp - 0x14]
call ebx
push dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
call edi
add esi, eax
mov ecx, str.FAILED
mov eax, str.SUCCESS
push esi
cmovne eax, ecx
push eax
push str.Flush_and_close_subkey__s__u
call fcn.004044f0
add esp, 0xc
push dword [ebp - 0x10]
call ebx
push dword [ebp - 0x10]
mov esi, eax
call edi
add esi, eax
mov ecx, str.FAILED
push esi
mov esi, str.SUCCESS
mov eax, esi
cmovne eax, ecx
push eax
push str.Flush_and_close_key__s__u
call fcn.004044f0
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0
add esp, 0xc
push str.VTOYNEWSW
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
push eax
test eax, eax
mov eax, str.FAILED
cmovne esi, eax
push esi
push str.RegUnLoadKey__s__u
call fcn.004044f0
add esp, 0xc
jmp 0x404189
push str.AdjustTokenPrivileges_failed_
jmp 0x404181
push str.LookupPrivilegeValue_failed_
call fcn.004044f0
add esp, 4
push ebx
call fcn.0040b3c9
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040b2c4
mov esp, ebp
pop ebp
ret