Function at 0x428c20
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a612
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x5da084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], 0x10
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x428cf8
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x429071
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x429071
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00430ce0
mov dword [ebp - 0x58], str.customhook
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinPrivilegeElevation.cpp
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], str.SetPrivilege
mov byte [ebp - 0x44], 1
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, str.Lookup_privilege._resulted_in_error
push eax
lea ecx, [ebp - 0xf0]
call fcn.00416960
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0xf0]
call fcn.00430bd0
xor eax, eax
jmp 0x428eaf
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], 1
push eax
push 0x10
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], ecx
push eax
push 0
push edi
mov dword [ebp - 0x24], 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x428d9a
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x429071
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x429071
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00430ce0
mov dword [ebp - 0x58], str.customhook
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinPrivilegeElevation.cpp
mov dword [ebp - 0x4c], 0x53
mov dword [ebp - 0x48], str.SetPrivilege
mov byte [ebp - 0x44], 1
mov dword [ebp - 4], 1
call esi
mov edx, str.Couldnt_get_current_privilege_setting_AdjustTokenPrivileges___resulted_in_error__
jmp 0x428cd3
cmp dword [ebp + 8], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
je 0x428f47
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x428e3a
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x428e34
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00430ce0
mov dword [ebp - 0x58], str.customhook
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinPrivilegeElevation.cpp
mov dword [ebp - 0x4c], 0x5f
mov dword [ebp - 0x48], str.SetPrivilege
mov byte [ebp - 0x44], 1
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xf0]
push dword [ebp - 0x14]
mov edx, str.Value_of_Privilege
call fcn.00416960
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], 0xffffffff
call fcn.00430bd0
mov ecx, dword [0x5dfbe0]
test byte [ebp - 0x14], 2
je 0x428eca
test ecx, ecx
je 0x428eaa
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x428eaa
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00430ce0
mov dword [ebp - 0x58], str.customhook
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinPrivilegeElevation.cpp
mov dword [ebp - 0x4c], 0x62
mov dword [ebp - 0x48], str.SetPrivilege
mov byte [ebp - 0x44], 1
mov edx, str.Privilege_exists
mov dword [ebp - 4], 3
lea ecx, [ebp - 0xf0]
call fcn.00416960
lea ecx, [ebp - 0xf0]
call fcn.00430bd0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056eb71
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x428f37
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x428f37
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00430ce0
mov dword [ebp - 0x58], str.customhook
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinPrivilegeElevation.cpp
mov dword [ebp - 0x4c], 0x65
mov dword [ebp - 0x48], str.SetPrivilege
mov byte [ebp - 0x44], 1
mov edx, str.Privilege_does_not_exist_elevating
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xf0]
call fcn.00416960
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], 0xffffffff
call fcn.00430bd0
or dword [ebp - 0x14], 2
mov byte [0x5dfbdc], 1
jmp 0x428fcb
cmp byte [0x5dfbdc], 0
je 0x428eaa
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x428fc7
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x428fc7
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00430ce0
mov dword [ebp - 0x58], str.customhook
mov dword [ebp - 0x54], 3
mov dword [ebp - 0x50], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinPrivilegeElevation.cpp
mov dword [ebp - 0x4c], 0x6c
mov dword [ebp - 0x48], str.SetPrivilege
mov byte [ebp - 0x44], 1
mov edx, str.Privilege_will_be_delevated
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xf0]
call fcn.00416960
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], 0xffffffff
call fcn.00430bd0
and dword [ebp - 0x14], 0xfffffffd
push 0
push 0
push dword [ebp - 0x38]
lea eax, [ebp - 0x20]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call esi
test eax, eax
je 0x428eaa
mov ecx, dword [0x5dfbe0]
test ecx, ecx
je 0x429071
mov eax, dword [ecx]
push 3
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x429071
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00430ce0
mov dword [ebp - 0x108], str.customhook
mov dword [ebp - 0x104], 3
mov dword [ebp - 0x100], str.C:jenkins_slaveDailymain_metaDesktopWinmain_rebar_buildinstallerCoreSyncCustomHookwinPrivilegeElevation.cpp
mov dword [ebp - 0xfc], 0x7c
mov dword [ebp - 0xf8], str.SetPrivilege
mov byte [ebp - 0xf4], 1
mov dword [ebp - 4], 6
call esi
push eax
mov edx, str.Couldnt_elevate_process_privilege._AdjustTokenPrivileges___resulted_in_error__
lea ecx, [ebp - 0x1a0]
call fcn.00416960
mov ecx, eax
call fcn.00423f60
lea ecx, [ebp - 0x1a0]
call fcn.00430bd0
xor eax, eax
jmp 0x428eaf