Function at 0x528320
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x64a070]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push eax
push 0x20
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x52840c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x656c44]
mov edx, eax
test ecx, ecx
je 0x5283d3
push edx
push str.Privilege_lowering_failed__Error:__u__n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005765b2
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x5283f8
push edx
mov eax, dword [ecx]
push str.Privilege_lowering_failed__Error:__u__n
push str.ProcessUtils
push 0x5f8398
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005765b2
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [esp + 0x34], 1
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x40]
mov dword [esp + 0x4c], 2
push eax
push 0
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
push dword [esp + 0x20]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x5284b2
mov ecx, dword [0x656c44]
test ecx, ecx
je 0x52849e
push ebx
push str.Privilege_lowering_failed__Error:__u__n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005765b2
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x5283f8
push ebx
jmp 0x5283de
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x52853f
lea eax, [esp + 0x2c]
push eax
push 0x5282b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x52853f
mov eax, dword [0x656c44]
test eax, eax
je 0x528503
push str.Privilege_lowering_failed__Could_not_get_Shell_window_or_any_user_window._n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call eax
jmp 0x5283f5
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x5283f8
push str.Privilege_lowering_failed__Could_not_get_Shell_window_or_any_user_window._n
mov eax, dword [ecx]
push str.ProcessUtils
push 0x5f8398
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005765b2
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x528593
mov eax, dword [0x656c44]
test eax, eax
je 0x52857e
push str.Privilege_lowering_failed__Could_not_get_process_ID._n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call eax
jmp 0x5283f5
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x5283f8
push str.Privilege_lowering_failed__Could_not_get_process_ID._n
jmp 0x528516
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x5285ae
call edi
jmp 0x528392
lea eax, [esp + 0x24]
mov byte [esp + 0xf], 0
push eax
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x528627
call edi
mov ecx, dword [0x656c44]
mov edx, eax
test ecx, ecx
je 0x5285f9
push edx
push str.Privilege_lowering_failed__Error:__u__n
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
jmp 0x5286b1
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x5286b1
push edx
push str.Privilege_lowering_failed__Error:__u__n
mov eax, dword [ecx]
push str.ProcessUtils
push 0x5f8398
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
jmp 0x5286b1
lea eax, [esp + 0x28]
push eax
push 1
push 2
push 0
push 0x18b
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x5285c5
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x20]
sub esp, 8
push dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x44]
call fcn.00528020
test eax, eax
jne 0x5286ac
call edi
mov ecx, dword [0x656c44]
mov edx, eax
test ecx, ecx
je 0x528697
push edx
push str.Privilege_lowering_failed__Error:__u
push 0x5f8398
push 0x5f8398
push str.ProcessUtils
push str.OOBEUtils
push 0x32
call ecx
add esp, 0x1c
jmp 0x5286b1
mov ecx, dword [0x656c48]
test ecx, ecx
je 0x5286b1
push edx
push str.Privilege_lowering_failed__Error:__u
jmp 0x52860d
mov byte [esp + 0xf], 1
push dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x28]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x44]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005765b2
mov esp, ebp
pop ebp
ret