Function at 0x408690
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov dword [ebp - 0x248], 0
lea eax, [ebp - 0x20c]
push eax
push 0x1c
lea ecx, [ebp - 0x268]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [0x41234c]
test eax, eax
jne 0x408ab3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x230], eax
mov ecx, dword [0x414938]
mov edx, dword [ebp - 0x230]
cmp edx, dword [ecx + 0x90]
je 0x408701
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x230]
jne 0x40870c
mov eax, dword [ebp - 0x248]
jmp 0x408ab9
mov dword [ebp - 0x220], 0
mov ecx, dword [ebp - 0x220]
mov edx, dword [0x414938]
cmp dword [edx + ecx*4 + 0x94], 0
je 0x408763
mov eax, dword [ebp - 0x220]
mov ecx, dword [0x414938]
mov edx, dword [ecx + eax*4 + 0x94]
cmp edx, dword [ebp - 0x230]
jne 0x408752
mov eax, dword [ebp - 0x248]
jmp 0x408ab9
mov eax, dword [ebp - 0x220]
add eax, 1
mov dword [ebp - 0x220], eax
jmp 0x408716
lea ecx, [ebp - 0x22c]
push ecx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4087dd
lea edx, [ebp - 0x228]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4087dd
mov dword [ebp - 0x240], 1
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], 2
push 0
push 0
push 0
lea edx, [ebp - 0x240]
push edx
push 0
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x230]
push edx
push 0
push 0x47a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x408ab3
push 0x200
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.0040a430
add esp, 0xc
push 0x200
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call dword [0x412360]
movzx eax, word [ebp - 0x208]
test eax, eax
jne 0x40887c
mov ecx, dword [ebp - 0x220]
mov edx, dword [0x414938]
mov eax, dword [ebp - 0x230]
mov dword [edx + ecx*4 + 0x94], eax
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x248]
jmp 0x408ab9
mov dword [ebp - 0x214], 0
mov edx, dword [ebp - 0x214]
cmp dword [edx*4 + 0x4119ac], 0
je 0x4088f7
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax*4 + 0x4119ac]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x4088e6
mov eax, dword [ebp - 0x220]
mov ecx, dword [0x414938]
mov edx, dword [ebp - 0x230]
mov dword [ecx + eax*4 + 0x94], edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x248]
jmp 0x408ab9
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
jmp 0x408886
call fcn.004064d0
mov dword [ebp - 0x244], eax
mov edx, dword [ebp + 0x10]
and edx, 2
je 0x40897e
push 2
push 1
push 0
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [0x4148f4]
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [0x4148f4]
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x278]
mov dword [0x4148f4], ecx
push 2
push 1
push 0
lea edx, [ebp - 0x278]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [0x414954]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [0x414954]
mov dword [ebp - 0x24c], edx
mov eax, dword [ebp - 0x278]
mov dword [0x414954], eax
mov ecx, dword [ebp + 0x10]
and ecx, 4
je 0x4089f7
push 2
push 1
push 0
lea edx, [ebp - 0x278]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [0x414948]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, dword [0x414948]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x278]
mov dword [0x414948], eax
push 2
push 1
push 0
lea ecx, [ebp - 0x278]
push ecx
mov edx, dword [ebp - 0x210]
push edx
mov eax, dword [0x414950]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [0x414950]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x278]
mov dword [0x414950], edx
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.00406300
add esp, 8
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x408a6b
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x244]
add edx, dword [ebp - 0x218]
mov dword [ebp - 0x26c], edx
mov eax, dword [ebp - 0x220]
mov ecx, dword [0x414938]
mov edx, dword [ebp - 0x230]
mov dword [ecx + eax*4 + 0x94], edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x26c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x412398]
mov dword [ebp - 0x248], 1
mov edx, dword [ebp + 0x10]
and edx, 2
je 0x408a8a
mov eax, dword [ebp - 0x274]
mov dword [0x4148f4], eax
mov ecx, dword [ebp - 0x24c]
mov dword [0x414954], ecx
mov edx, dword [ebp + 0x10]
and edx, 4
je 0x408aa6
mov eax, dword [ebp - 4]
mov dword [0x414948], eax
mov ecx, dword [ebp - 0x21c]
mov dword [0x414950], ecx
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x248]
mov esp, ebp
pop ebp
ret