Function at 0x432df0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6441a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x1c]
push edi
push eax
push str.SeCreateGlobalPrivilege
push 0
mov edi, ecx
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x432e4b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeBackupPrivilege
push 0
call esi
test eax, eax
je 0x432e85
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeCreatePagefilePrivilege
push 0
call esi
test eax, eax
je 0x432ebf
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeCreateSymbolicLinkPrivilege
push 0
call esi
test eax, eax
je 0x432ef9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call esi
test eax, eax
je 0x432f33
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeImpersonatePrivilege
push 0
call esi
test eax, eax
je 0x432f6d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeIncreaseBasePriorityPrivilege
push 0
call esi
test eax, eax
je 0x432fa7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call esi
test eax, eax
je 0x432fe1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeLoadDriverPrivilege
push 0
call esi
test eax, eax
je 0x43301b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeManageVolumePrivilege
push 0
call esi
test eax, eax
je 0x433055
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeProfileSingleProcessPrivilege
push 0
call esi
test eax, eax
je 0x43308f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeRemoteShutdownPrivilege
push 0
call esi
test eax, eax
je 0x4330c9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeRestorePrivilege
push 0
call esi
test eax, eax
je 0x433103
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeSecurityPrivilege
push 0
call esi
test eax, eax
je 0x43313d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeSystemEnvironmentPrivilege
push 0
call esi
test eax, eax
je 0x433177
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeSystemProfilePrivilege
push 0
call esi
test eax, eax
je 0x4331b1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeSystemtimePrivilege
push 0
call esi
test eax, eax
je 0x4331eb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
lea eax, [ebp - 0x1c]
push eax
push str.SeTakeOwnershipPrivilege
push 0
call esi
test eax, eax
je 0x433225
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0
push 0
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
call ebx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cdf2e
mov esp, ebp
pop ebp
ret