Function at 0x42654e
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or dword [esp], 0xffffffff
lea ecx, [esp]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp dword [esp], 0xffffffff
jne 0x426570
xor eax, eax
pop ecx
ret
push ebp
push edi
push 0x44e088
mov ebp, 0x16c
push ebp
call fcn.004100d6
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x426769
push 0x1e
pop ecx
mov dword [edi], ecx
lea eax, [edi + 0xc]
mov dword [eax], 2
lea eax, [eax + 0xc]
dec ecx
jne 0x426596
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [edi + 4]
push eax
push 0x44288c
xor ebx, ebx
push ebx
call esi
lea eax, [edi + 0x10]
push eax
push str.SeAssignPrimaryTokenPrivilege
push ebx
call esi
lea eax, [edi + 0x1c]
push eax
push str.SeLockMemoryPrivilege
push ebx
call esi
lea eax, [edi + 0x28]
push eax
push str.SeIncreaseQuotaPrivilege
push ebx
call esi
lea eax, [edi + 0x34]
push eax
push str.SeUnsolicitedInputPrivilege
push ebx
call esi
lea eax, [edi + 0x40]
push eax
push str.SeMachineAccountPrivilege
push ebx
call esi
lea eax, [edi + 0x4c]
push eax
push str.SeTcbPrivilege
push ebx
call esi
lea eax, [edi + 0x58]
push eax
push str.SeSecurityPrivilege
push ebx
call esi
lea eax, [edi + 0x64]
push eax
push str.SeTakeOwnershipPrivilege
push ebx
call esi
lea eax, [edi + 0x70]
push eax
push str.SeLoadDriverPrivilege
push ebx
call esi
lea eax, [edi + 0x7c]
push eax
push str.SeSystemProfilePrivilege
push ebx
call esi
lea eax, [edi + 0x88]
push eax
push str.SeSystemtimePrivilege
push ebx
call esi
lea eax, [edi + 0x94]
push eax
push str.SeProfileSingleProcessPrivilege
push ebx
call esi
lea eax, [edi + 0xa0]
push eax
push str.SeIncreaseBasePriorityPrivilege
push ebx
call esi
lea eax, [edi + 0xac]
push eax
push str.SeCreatePagefilePrivilege
push ebx
call esi
lea eax, [edi + 0xb8]
push eax
push str.SeCreatePermanentPrivilege
push ebx
call esi
lea eax, [edi + 0xc4]
push eax
push str.SeBackupPrivilege
push ebx
call esi
lea eax, [edi + 0xd0]
push eax
push str.SeRestorePrivilege
push ebx
call esi
lea eax, [edi + 0xdc]
push eax
push str.SeShutdownPrivilege
push ebx
call esi
lea eax, [edi + 0xe8]
push eax
push str.SeDebugPrivilege
push ebx
call esi
lea eax, [edi + 0xf4]
push eax
push str.SeAuditPrivilege
push ebx
call esi
lea eax, [edi + 0x100]
push eax
push str.SeSystemEnvironmentPrivilege
push ebx
call esi
lea eax, [edi + 0x10c]
push eax
push str.SeChangeNotifyPrivilege
push ebx
call esi
lea eax, [edi + 0x118]
push eax
push str.SeRemoteShutdownPrivilege
push ebx
call esi
lea eax, [edi + 0x124]
push eax
push str.SeUndockPrivilege
push ebx
call esi
lea eax, [edi + 0x130]
push eax
push str.SeSyncAgentPrivilege
push ebx
call esi
lea eax, [edi + 0x13c]
push eax
push str.SeEnableDelegationPrivilege
push ebx
call esi
lea eax, [edi + 0x148]
push eax
push str.SeManageVolumePrivilege
push ebx
call esi
lea eax, [edi + 0x154]
push eax
push str.SeImpersonatePrivilege
push ebx
call esi
lea eax, [edi + 0x160]
push eax
push str.SeCreateGlobalPrivilege
push ebx
call esi
push ebx
push ebx
push ebp
push edi
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
push edi
call fcn.004100d1
pop ecx
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
pop ecx
ret