Function at 0x4bae20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x67d070]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push 0x20
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4baf0c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [0x689958]
mov edx, eax
test ecx, ecx
je 0x4baed3
push edx
push str.Privilege_lowering_failed__openProcessToken_currentprocess___Error:__u__n
push 0x622628
push 0x622628
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x68995c]
test ecx, ecx
je 0x4baef8
push edx
push str.Privilege_lowering_failed__openProcessToken_currentprocess___Error:__u__n
mov eax, dword [ecx]
push str.ProcessUtils
push 0x622628
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [esp + 0x34], 1
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x40]
mov dword [esp + 0x4c], 2
push eax
push 0
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
call edi
push dword [esp + 0x20]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
jne 0x4bafb7
mov ecx, dword [0x689958]
test ecx, ecx
je 0x4baf9e
push ebx
push str.Privilege_lowering_failed__AdjustTokenPrivileges___Error:__u__n
push 0x622628
push 0x622628
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x68995c]
test ecx, ecx
je 0x4baef8
push ebx
push str.Privilege_lowering_failed__AdjustTokenPrivileges___Error:__u__n
jmp 0x4baee3
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x4bb044
lea eax, [esp + 0x2c]
push eax
push 0x4badb0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4bb044
mov eax, dword [0x689958]
test eax, eax
je 0x4bb008
push str.Privilege_lowering_failed__Could_not_get_Shell_window_or_any_user_window._n
push 0x622628
push 0x622628
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call eax
jmp 0x4baef5
mov ecx, dword [0x68995c]
test ecx, ecx
je 0x4baef8
push str.Privilege_lowering_failed__Could_not_get_Shell_window_or_any_user_window._n
mov eax, dword [ecx]
push str.ProcessUtils
push 0x622628
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4bb098
mov eax, dword [0x689958]
test eax, eax
je 0x4bb083
push str.Privilege_lowering_failed__Could_not_get_process_ID._n
push 0x622628
push 0x622628
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call eax
jmp 0x4baef5
mov ecx, dword [0x68995c]
test ecx, ecx
je 0x4baef8
push str.Privilege_lowering_failed__Could_not_get_process_ID._n
jmp 0x4bb01b
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x4bb108
call edi
mov ecx, dword [0x689958]
mov edx, eax
test ecx, ecx
je 0x4bb0ef
push edx
push str.Privilege_lowering_failed__openProcess_desktop_shell__Error:__u__n
push 0x622628
push 0x622628
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00599c70
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x68995c]
test ecx, ecx
je 0x4baef8
push edx
push str.Privilege_lowering_failed__openProcess_desktop_shell__Error:__u__n
jmp 0x4baee3
lea eax, [esp + 0x24]
mov byte [esp + 0xf], 0
push eax
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4bb181
call edi
mov ecx, dword [0x689958]
mov edx, eax
test ecx, ecx
je 0x4bb153
push edx
push str.Privilege_lowering_failed__Error:__u__n
push 0x622628
push 0x622628
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
jmp 0x4bb24e
mov ecx, dword [0x68995c]
test ecx, ecx
je 0x4bb24e
push edx
push str.Privilege_lowering_failed__Error:__u__n
mov eax, dword [ecx]
push str.ProcessUtils
push 0x622628
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
jmp 0x4bb24e
lea eax, [esp + 0x28]
push eax
push 1
push 2
push 0
push 0x18b
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4bb1e2
call edi
mov ecx, dword [0x689958]
mov edx, eax
test ecx, ecx
je 0x4bb1d0
push edx
push str.Privilege_lowering_failed__duplicate_token___Error:__u__n
push 0x622628
push 0x622628
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
jmp 0x4bb24e
mov ecx, dword [0x68995c]
test ecx, ecx
je 0x4bb24e
push edx
push str.Privilege_lowering_failed__duplicate_token___Error:__u__n
jmp 0x4bb167
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x20]
sub esp, 8
push dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x44]
call fcn.004bab20
test eax, eax
jne 0x4bb249
call edi
mov ecx, dword [0x689958]
mov edx, eax
test ecx, ecx
je 0x4bb234
push edx
push str.Privilege_lowering_failed_PU_CreateProcessWithTokenW__Error:__u
push 0x622628
push 0x622628
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
jmp 0x4bb24e
mov ecx, dword [0x68995c]
test ecx, ecx
je 0x4bb24e
push edx
push str.Privilege_lowering_failed_PU_CreateProcessWithTokenW__Error:__u
jmp 0x4bb167
mov byte [esp + 0xf], 1
push dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [esp + 0x28]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x44]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00599c70
mov esp, ebp
pop ebp
ret