Function at 0x45eb37
Capabilities:
Acquire debug privileges
Get system information on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2e0
mov edx, 0x690
mov rsi, rcx
mov ecx, 1
lea rbp, [rsp + 0xd0]
call sym.calloc
mov rbx, rax
mov qword [rsi], rax
lea rax, [0x00489234]
lea rcx, [rsp + 0x3c]
mov dword [rbx + 0x2a0], 0
mov qword [rbx + 0x2b0], 0
mov qword [rbx + 0x298], rax
mov dword [rbx + 0x2b8], 0
lea rsi, [rbx + 0x2a8]
mov dword [rsp + 0x3c], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [rsp + 0x40], 4
mov rcx, qword [rbx + 0x298]
sete al
cmp dword [rbx + 0x2a0], 0
mov dword [rbx + 0x68c], eax
je 0x45ec08
mov r8, rcx
xor edx, edx
xor ecx, ecx
mov word [rsp + 0xd0], 0
mov dword [rsp + 0x28], 0x105
or r9d, 0xffffffff
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, rsi
mov rdx, 0xffffffff80000004
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x45ec18
mov r8, rsi
mov rdx, 0xffffffff80000004
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
mov r12d, eax
mov rcx, rbp
lea rsi, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0xf0]
lea rdi, [rbx + 0x2c8]
mov ecx, 0x14
lea rdx, [rbx + 0x418]
xor r8d, r8d
mov dword [rbx + 0x30], eax
mov eax, dword [rsp + 0xd4]
mov dword [rbx + 0x2a4], eax
rep movsd dword [rdi], dword [rsi]
lea rsi, str.iphlpapi.dll
lea rdi, [rbx + 0x318]
mov ecx, 0x40
rep movsd dword [rdi], dword [rsi]
lea rsi, str.advapi32.dll
lea rdi, [rbx + 0x418]
mov ecx, 0x10
rep movsd dword [rdi], dword [rsi]
lea rsi, str.ntdll.dll
lea rdi, [rbx + 0x458]
mov ecx, 0x10
rep movsd dword [rdi], dword [rsi]
lea rsi, str.psapi.dll
lea rdi, [rbx + 0x498]
mov ecx, 0x14
rep movsd dword [rdi], dword [rsi]
lea rsi, str.winsta.dll
lea rdi, [rbx + 0x4e8]
mov ecx, 0x14
rep movsd dword [rdi], dword [rsi]
lea rsi, str.kernel32.dll
lea rdi, [rbx + 0x518]
mov ecx, 0x14
rep movsd dword [rdi], dword [rsi]
lea rsi, str.mpr.dll
lea rdi, [rbx + 0x548]
mov ecx, 0xc
rep movsd dword [rdi], dword [rsi]
mov rcx, rbx
mov dword [rbx + 4], 0xffffffff
mov rdi, rbp
call sym.sigar_dllmod_init
mov qword [rbx + 0x660], 0
mov qword [rbx + 0x668], 0
mov qword [rbx + 0x658], 0
mov qword [rbx + 0x670], 0
call sym.netif_name_short
mov ecx, 4
mov dword [rbx + 0x678], eax
xor eax, eax
rep stosd dword [rdi], eax
mov dword [rbx + 0x578], 0xffffffff
mov word [rbx + 0x67c], 0
mov dword [rbx + 0x688], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x45ed81
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45ede8
xor ecx, ecx
lea r8, [rbp + 4]
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x45edd7
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0xd0], 1
mov dword [rsp + 0xdc], 2
mov qword [rsp + 0x28], 0
mov r8, rbp
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x45eddd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call dbg.wmi_handle_open
cmp dword [rsp + 0xd0], 0
mov qword [rbx + 0x2c0], rax
je 0x45ee15
lea r8, str.Unable_to_create_WMI_handle
mov edx, 2
mov rcx, rbx
call sym.mettle.exe_sigar_log_printf
mov eax, r12d
add rsp, 0x2e0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret