Function at 0x40e310
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x44e06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
call fcn.00406d60
movsx ebx, al
call fcn.00406d50
movsx eax, al
imul ebx, eax
mov dword [ebp - 0x3c], ebx
call fcn.00406d90
movsx esi, al
xor edx, edx
movsx eax, byte [0x44eae1]
movsx ecx, byte [0x44eae0]
add eax, esi
mov dword [ebp - 0x40], esi
lea eax, [eax + ebx*8]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e626
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40e38f
lea ecx, [eax + 1]
xor edx, edx
jmp 0x40e39d
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.0043b5f0
movsd qword [ebp - 0x28], xmm0
xor eax, eax
je 0x40e3ac
add byte [edi], cl
mov esi, 0x44eae205
add byte [ebx], dh
ror byte [ebx + 0x758bc45d], cl
shl byte [esi + 0xf], 0x6e
ror byte [edi], 1
mov esi, 0x44eae405
add byte [ebp + 0xdd0c], cl
add byte [eax], al
movsx eax, byte [0x44eae2]
xor edx, edx
mov ebx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
movd xmm2, eax
movsx eax, byte [0x44eae4]
lea ecx, [ebx*8]
cvtdq2pd xmm2, xmm2
sub ecx, ebx
add ecx, esi
mov dword [ebp - 0x44], ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
addsd xmm1, xmm1
subsd xmm2, xmm1
mulsd xmm2, qword [ebp - 0x28]
movsd qword [ebp - 0x28], xmm2
movsx eax, byte [0x44eae1]
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e449
call fcn.00406d70
movsx ecx, al
movsx eax, byte [0x45037c]
imul ecx, eax
add ecx, ecx
call fcn.00406da0
movsx eax, al
sub ecx, eax
call fcn.00406d80
movsx eax, al
add eax, ecx
movsx ecx, byte [0x44eae4]
add ecx, eax
je 0x40e449
mov edi, 1
jmp 0x40e4b6
movsx eax, byte [0x44eae1]
lea ecx, [ebx + ebx*8]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x44eae0]
add eax, esi
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e4b3
movsx ecx, byte [0x44eae1]
lea eax, [ebx + esi]
lea eax, [eax + ebx*2]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
movsd xmm0, qword [ebp - 0x28]
sub eax, ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x44a340]
mulsd xmm0, xmm1
cvttsd2si edi, xmm0
jmp 0x40e4b6
mov edi, dword [ebp - 0x24]
lea eax, [ebx + ebx*8]
xor edx, edx
lea ecx, [eax + esi]
movsx eax, byte [0x44eae1]
add eax, ecx
mov dword [ebp - 0x24], ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
imul eax, edi
test eax, eax
je 0x40e626
movsx eax, byte [0x44eae1]
lea ecx, [ebx + ebx*4]
add eax, esi
xor edx, edx
lea eax, [eax + ecx*2]
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x44a340]
movsd qword [ebp - 0x38], xmm0
xor eax, eax
je 0x40e528
add byte [edi], cl
mov esi, 0x44eae205
add byte [ebx], dh
shl byte [esi + 0xf], cl
outsb dx, byte [esi]
enter 0xffffffffffffbe0f, 5
in al, 0xea
inc esp
add bl, dh
invalid
movsx eax, byte [0x44eae2]
xor edx, edx
movd xmm1, eax
movsx eax, byte [0x44eae4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [ebp - 0x38]
movsd qword [ebp - 0x38], xmm1
movsx eax, byte [0x44eae1]
add eax, dword [ebp - 0x44]
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e5af
call fcn.00406d70
movsx ecx, al
movsx eax, byte [0x45037c]
imul ecx, eax
add ecx, ecx
call fcn.00406da0
movsx eax, al
sub ecx, eax
call fcn.00406d80
movsx eax, al
add eax, ecx
movsx ecx, byte [0x44eae4]
add ecx, eax
jne 0x40eab7
movsx eax, byte [0x44eae1]
xor edx, edx
add eax, dword [ebp - 0x24]
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
mov ebx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
je 0x40e61b
movsx ecx, byte [0x44eae1]
lea eax, [ebx + esi]
lea eax, [eax + ebx*2]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
movsd xmm0, qword [ebp - 0x38]
sub eax, ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x44a340]
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
jmp 0x40e61e
mov eax, dword [ebp - 0x24]
test eax, eax
jg 0x40eab7
movsx ecx, byte [0x44eae1]
lea eax, [ebx + esi]
lea eax, [eax + ebx*4]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e90f
lea eax, [ebp - 0xc]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40e66b
lea ecx, [eax + 1]
xor edx, edx
jmp 0x40e679
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.0043b5f0
movsd qword [ebp - 0x38], xmm0
xor eax, eax
je 0x40e688
add byte [edi], cl
mov esi, 0x44eae205
add byte [ebx], dh
ror byte [ebx + 0x758bc45d], cl
shl byte [esi + 0xf], 0x6e
ror byte [edi], 1
mov esi, 0x44eae405
add byte [ebp + 0xdd0c], cl
add byte [eax], al
movsx eax, byte [0x44eae2]
xor edx, edx
mov ebx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
movd xmm2, eax
movsx eax, byte [0x44eae4]
lea ecx, [ebx*8]
cvtdq2pd xmm2, xmm2
sub ecx, ebx
mov dword [ebp - 0x44], ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
addsd xmm1, xmm1
subsd xmm2, xmm1
mulsd xmm2, qword [ebp - 0x38]
movsd qword [ebp - 0x38], xmm2
movsx eax, byte [0x44eae1]
add eax, ecx
movsx ecx, byte [0x44eae0]
add eax, esi
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e725
call fcn.00406d70
movsx ecx, al
movsx eax, byte [0x45037c]
imul ecx, eax
add ecx, ecx
call fcn.00406da0
movsx eax, al
sub ecx, eax
call fcn.00406d80
movsx eax, al
add eax, ecx
movsx ecx, byte [0x44eae4]
add ecx, eax
je 0x40e725
mov edi, 1
jmp 0x40e792
movsx eax, byte [0x44eae1]
lea ecx, [ebx + ebx*8]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x44eae0]
add eax, esi
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e78f
movsx ecx, byte [0x44eae1]
lea eax, [ebx + esi]
lea eax, [eax + ebx*2]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
movsd xmm0, qword [ebp - 0x38]
sub eax, ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x44a340]
mulsd xmm0, xmm1
cvttsd2si edi, xmm0
jmp 0x40e792
mov edi, dword [ebp - 0x24]
movsx eax, byte [0x44eae1]
lea ecx, [ebx + ebx*2]
add eax, esi
xor edx, edx
lea eax, [eax + ecx*2]
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
imul eax, edi
test eax, eax
je 0x40e90f
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x44]
xor edx, edx
movsx eax, byte [0x44eae1]
add ecx, esi
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x44a340]
movsd qword [ebp - 0x38], xmm0
xor eax, eax
je 0x40e809
add byte [edi], cl
mov esi, 0x44eae205
add byte [ebx], dh
ror byte [ebx + 0x758bbc4d], cl
rol byte [ebx], 0xce
movsx eax, byte [0x44eae2]
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x40]
add ecx, esi
movd xmm1, eax
movsx eax, byte [0x44eae4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [ebp - 0x38]
movsd qword [ebp - 0x38], xmm1
movsx eax, byte [0x44eae1]
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e897
call fcn.00406d70
movsx ecx, al
movsx eax, byte [0x45037c]
imul ecx, eax
add ecx, ecx
call fcn.00406da0
movsx eax, al
sub ecx, eax
call fcn.00406d80
movsx eax, al
add eax, ecx
movsx ecx, byte [0x44eae4]
add ecx, eax
jne 0x40eab7
mov ebx, dword [ebp - 0x3c]
xor edx, edx
movsx eax, byte [0x44eae1]
lea ecx, [ebx + ebx*8]
add eax, ecx
movsx ecx, byte [0x44eae0]
add eax, esi
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40e904
movsx ecx, byte [0x44eae1]
lea eax, [ebx + esi]
lea eax, [eax + ebx*2]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
movsd xmm0, qword [ebp - 0x38]
sub eax, ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x44a340]
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
jmp 0x40e907
mov eax, dword [ebp - 0x24]
test eax, eax
jg 0x40eab7
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
setne byte [ebp - 0x29]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movsx ecx, byte [0x44eae1]
lea eax, [esi + ebx*2]
add eax, ebx
xor edx, edx
mov dword [ebp - 0x24], eax
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x44a340]
movsd qword [ebp - 0x38], xmm0
xor eax, eax
je 0x40e999
add byte [edi], cl
mov esi, 0x44eae205
add byte [ebx], dh
ror byte [ebx + 0x7d8bc475], cl
shl byte [esi + 0xf], 0x6e
enter 0xffffffffffffbe0f, 5
in al, 0xea
inc esp
add byte [ebp + 0xf50c], cl
add byte [eax], al
movsx eax, byte [0x44eae2]
xor edx, edx
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x40]
movd xmm1, eax
movsx eax, byte [0x44eae4]
lea ecx, [esi*8]
cvtdq2pd xmm1, xmm1
sub ecx, esi
add ecx, edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [ebp - 0x38]
movsd qword [ebp - 0x38], xmm1
movsx eax, byte [0x44eae1]
add eax, ecx
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40ea2c
call fcn.00406d70
movsx ecx, al
movsx eax, byte [0x45037c]
imul ecx, eax
add ecx, ecx
call fcn.00406da0
movsx eax, al
sub ecx, eax
call fcn.00406d80
movsx eax, al
add eax, ecx
movsx ecx, byte [0x44eae4]
add ecx, eax
jne 0x40ea98
movsx eax, byte [0x44eae1]
lea ecx, [esi + esi*8]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x44eae0]
add eax, edi
div ecx
movsx ecx, byte [0x44eae3]
sub eax, ecx
je 0x40ea91
movsx eax, byte [0x44eae1]
xor edx, edx
add eax, dword [ebp - 0x24]
movsx ecx, byte [0x44eae0]
div ecx
movsx ecx, byte [0x44eae3]
movsd xmm0, qword [ebp - 0x38]
sub eax, ecx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x44a340]
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
jmp 0x40ea94
mov eax, dword [ebp - 0x24]
test eax, eax
jle 0x40eab9
cmp byte [ebp - 0x29], 0
je 0x40eab7
cmp dword [ebp - 0x44], 0
jne 0x40eab7
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d30f
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d30f
mov esp, ebp
pop ebp
ret