Function at 0x4acc00
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
mov eax, dword [0x68f500]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword fs:[0x2c]
push esi
push edi
mov dword [esp + 0x14], edx
mov edi, dword [eax]
mov eax, dword [0x6b59cc]
mov dword [esp + 0x18], ecx
cmp eax, dword [edi + 4]
jle 0x4acc78
push 0x6b59cc
call fcn.005ab465
add esp, 4
cmp dword [0x6b59cc], 0xffffffff
jne 0x4acc78
push str.OpenProcessToken
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6b59cc
mov dword [0x6b59d0], eax
call fcn.005ab414
add esp, 4
mov esi, dword [0x6b59d0]
lea eax, [esp + 0x1c]
push eax
push 0x20
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x4accba
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6b5a04]
cmp eax, dword [edi + 4]
jle 0x4acd0a
push 0x6b5a04
call fcn.005ab465
add esp, 4
cmp dword [0x6b5a04], 0xffffffff
jne 0x4acd0a
push str.LookupPrivilegeValueW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x6b5a04
mov dword [0x6b59d4], eax
call fcn.005ab414
add esp, 4
jmp 0x4acd10
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push str.SeIncreaseQuotaPrivilege
movaps xmmword [esp + 0x48], xmm0
push 0
mov dword [esp + 0x4c], 1
call dword [0x6b59d4]
test eax, eax
je 0x4acc9a
mov eax, dword [0x6b59ec]
cmp eax, dword [edi + 4]
jle 0x4acd82
push 0x6b59ec
call fcn.005ab465
add esp, 4
cmp dword [0x6b59ec], 0xffffffff
jne 0x4acd82
push str.AdjustTokenPrivileges
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0x6b59ec
mov dword [0x6b5a0c], eax
call fcn.005ab414
add esp, 4
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0
push 0
lea eax, [esp + 0x4c]
mov dword [esp + 0x58], 2
push eax
push 0
push dword [esp + 0x30]
call dword [0x6b5a0c]
test eax, eax
je 0x4acc9a
mov eax, dword [0x6b5a10]
cmp eax, dword [edi + 4]
jle 0x4acdfc
push 0x6b5a10
call fcn.005ab465
add esp, 4
cmp dword [0x6b5a10], 0xffffffff
jne 0x4acdfc
push str.GetShellWindow
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0x6b5a10
mov dword [0x6b5a00], eax
call fcn.005ab414
add esp, 4
call dword [0x6b5a00]
test eax, eax
je 0x4acc9a
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [esp + 0x28], 0
je 0x4acc9a
mov eax, dword [0x6b59e8]
cmp eax, dword [edi + 4]
jle 0x4ace69
push 0x6b59e8
call fcn.005ab465
add esp, 4
cmp dword [0x6b59e8], 0xffffffff
jne 0x4ace69
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x6b59e8
mov dword [0x6b59f8], eax
call fcn.005ab414
add esp, 4
mov eax, dword [0x6b59f4]
cmp eax, dword [edi + 4]
jle 0x4aceab
push 0x6b59f4
call fcn.005ab465
add esp, 4
cmp dword [0x6b59f4], 0xffffffff
jne 0x4aceab
push str.OpenProcess
push dword [0x6b59f8]
call esi
push 0x6b59f4
mov dword [0x6b5a14], eax
call fcn.005ab414
add esp, 4
push dword [esp + 0x28]
push 0
push 0x400
call dword [0x6b5a14]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4acc9a
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push 2
push eax
call dword [0x6b59d0]
test eax, eax
jne 0x4acf10
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x20]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6b5a18]
cmp eax, dword [edi + 4]
jle 0x4acf58
push 0x6b5a18
call fcn.005ab465
add esp, 4
cmp dword [0x6b5a18], 0xffffffff
jne 0x4acf58
push str.DuplicateTokenEx
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0x6b5a18
mov dword [0x6b59f0], eax
call fcn.005ab414
add esp, 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 1
push 2
push 0
push 0xf01ff
push dword [esp + 0x34]
call dword [0x6b59f0]
test eax, eax
jne 0x4acfb2
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6b59dc]
cmp eax, dword [edi + 4]
jle 0x4acffa
push 0x6b59dc
call fcn.005ab465
add esp, 4
cmp dword [0x6b59dc], 0xffffffff
jne 0x4acffa
push str.CreateProcessWithTokenW
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0x6b59dc
mov dword [0x6b59fc], eax
call fcn.005ab414
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 0x44
mov word [esp + 0x92], ax
xorps xmm0, xmm0
mov eax, 1
movlpd qword [esp + 0x54], xmm0
mov word [esp + 0x80], ax
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x54]
movlpd qword [esp + 0x60], xmm0
push eax
push 0
push 0
push 0
push dword [esp + 0x28]
movups xmmword [esp + 0x44], xmm0
push dword [esp + 0x30]
movlpd qword [esp + 0x80], xmm0
push 0
push dword [esp + 0x44]
movlpd qword [esp + 0x90], xmm0
movlpd qword [esp + 0x98], xmm0
movlpd qword [esp + 0xa6], xmm0
movlpd qword [esp + 0xae], xmm0
call dword [0x6b59fc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x1c]
test eax, eax
jne 0x4ad0c0
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
push dword [esp + 0x2c]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
push dword [esp + 0x2c]
call esi
mov ecx, dword [esp + 0x9c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.005ab3d6
mov esp, ebp
pop ebp
ret