Function at 0x44c33b
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp dword [ecx + 8], esi
jne 0x44c383
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x44c37c
test byte [eax + 0x1c], 1
je 0x44c37c
cmp byte [eax + 0x19], 2
jb 0x44c37c
push 0x476008
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
xor al, al
jmp 0x44c505
cmp dword [ebp + 8], esi
jne 0x44c3a9
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x44c37c
test byte [eax + 0x1c], 1
je 0x44c37c
cmp byte [eax + 0x19], 2
jb 0x44c37c
push 0x476008
push 0xf
jmp 0x44c36e
lea ecx, [ebp - 0x2c]
call fcn.0042cd47
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.0042d0bc
test eax, eax
jne 0x44c41a
mov eax, dword [0x497644]
cmp eax, 0x497644
je 0x44c40d
test byte [eax + 0x1c], 1
je 0x44c40d
cmp byte [eax + 0x19], 2
jb 0x44c40d
lea ecx, [ebp - 0x2c]
call fcn.0042d07f
push eax
push dword [ebp + 8]
mov eax, dword [0x497644]
push 0x476008
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042b189
add esp, 0x18
lea ecx, [ebp - 0x2c]
call fcn.0042d0a5
jmp 0x44c37c
push ebx
lea ecx, [ebp - 0x80]
call fcn.0043a2bc
push str.SeDebugPrivilege
lea ecx, [ebp - 0x80]
call fcn.0043a812
mov esi, 0x476008
test al, al
jne 0x44c458
mov eax, dword [0x497644]
mov ebx, 0x497644
cmp eax, ebx
je 0x44c483
test byte [eax + 0x1c], 1
je 0x44c483
cmp byte [eax + 0x19], 3
jb 0x44c483
push esi
push 0x11
jmp 0x44c475
mov eax, dword [0x497644]
mov ebx, 0x497644
cmp eax, ebx
je 0x44c483
test byte [eax + 0x1c], 1
je 0x44c483
cmp byte [eax + 0x19], 4
jb 0x44c483
push esi
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.0042a49a
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
lea ecx, [ebp - 0x10]
call fcn.0042a52a
lea ecx, [ebp - 0x10]
call fcn.0042a4ab
test al, al
jne 0x44c50a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x497644]
cmp ecx, ebx
je 0x44c4e9
test byte [ecx + 0x1c], 1
je 0x44c4e9
cmp byte [ecx + 0x19], 2
jb 0x44c4e9
push eax
push edi
push esi
push 0x13
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.004402b1
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.0042a51f
lea ecx, [ebp - 0x80]
call fcn.0043a474
lea ecx, [ebp - 0x2c]
call fcn.0042d0a5
xor al, al
pop edi
pop ebx
pop esi
leave
ret 0xc
mov eax, dword [0x497644]
cmp eax, ebx
je 0x44c557
test byte [eax + 0x1c], 1
je 0x44c536
cmp byte [eax + 0x19], 4
jb 0x44c536
push edi
push esi
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042a72b
mov eax, dword [0x497644]
add esp, 0x14
cmp eax, ebx
je 0x44c557
test byte [eax + 0x1c], 1
je 0x44c557
cmp byte [eax + 0x19], 4
jb 0x44c557
push esi
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040d1fe
add esp, 0x10
push 0xc
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.0045b990
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 1
call fcn.0042a4bd
push 0
mov edi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
call fcn.0042cd60
push eax
push dword [ebp - 4]
mov eax, dword [ebp - 8]
push dword [edi]
call dword [eax + 8]
test eax, eax
jne 0x44c602
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x497644]
cmp ecx, ebx
je 0x44c5e1
test byte [ecx + 0x1c], 1
je 0x44c5e1
cmp byte [ecx + 0x19], 2
jb 0x44c5e1
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push esi
push 0x1b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0044bff0
add esp, 0x20
xor bl, bl
lea ecx, [ebp - 0x10]
call fcn.0042a51f
lea ecx, [ebp - 0x80]
call fcn.0043a474
lea ecx, [ebp - 0x2c]
call fcn.0042d0a5
mov al, bl
jmp 0x44c503
mov bl, 1
jmp 0x44c5e3