Function at 0x4ed560
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcfc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40c
mov ax, word [0xf55894]
push ebx
push esi
push edi
mov word [ebp - 0x218], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], esp
stosw word es:[edi], ax
push ecx
mov dword [ebp - 4], 0
mov edi, 1
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x418]
push 0x530278
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x218]
push eax
push 0x810
push ecx
call fcn.004edee0
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x4ed60b
push esi
push str.OpenPolicy
call fcn.004ee070
add esp, 8
mov ax, 0xd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x418]
push edx
push eax
push 0
call fcn.004edf30
add esp, 0xc
test eax, eax
je 0x4ede2c
mov ax, word [ebp + 0xc]
cmp ax, 1
jne 0x4ed643
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeTcbPrivilege
push ecx
push edx
jmp 0x4ed658
cmp ax, 0xffff
jne 0x4ed662
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeTcbPrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0xe]
cmp ax, 1
jne 0x4ed67d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeCreateTokenPrivilege
push edx
push eax
jmp 0x4ed692
cmp ax, 0xffff
jne 0x4ed69c
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeCreateTokenPrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x10]
cmp ax, 1
jne 0x4ed6b7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeTakeOwnershipPrivilege
push eax
push ecx
jmp 0x4ed6cc
cmp ax, 0xffff
jne 0x4ed6d6
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeTakeOwnershipPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x12]
cmp ax, 1
jne 0x4ed6f1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeCreatePagefilePrivilege
push ecx
push edx
jmp 0x4ed706
cmp ax, 0xffff
jne 0x4ed710
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeCreatePagefilePrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x14]
cmp ax, 1
jne 0x4ed72b
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeLockMemoryPrivilege
push edx
push eax
jmp 0x4ed740
cmp ax, 0xffff
jne 0x4ed74a
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeLockMemoryPrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x16]
cmp ax, 1
jne 0x4ed765
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeAssignPrimaryTokenPrivilege
push eax
push ecx
jmp 0x4ed77a
cmp ax, 0xffff
jne 0x4ed784
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeAssignPrimaryTokenPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x18]
cmp ax, 1
jne 0x4ed79f
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeIncreaseQuotaPrivilege
push ecx
push edx
jmp 0x4ed7b4
cmp ax, 0xffff
jne 0x4ed7be
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeIncreaseQuotaPrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x1a]
cmp ax, 1
jne 0x4ed7d9
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeIncreaseBasePriorityPrivilege
push edx
push eax
jmp 0x4ed7ee
cmp ax, 0xffff
jne 0x4ed7f8
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeIncreaseBasePriorityPrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x1c]
cmp ax, 1
jne 0x4ed813
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeCreatePermanentPrivilege
push eax
push ecx
jmp 0x4ed828
cmp ax, 0xffff
jne 0x4ed832
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeCreatePermanentPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x1e]
cmp ax, 1
jne 0x4ed84d
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeDebugPrivilege
push ecx
push edx
jmp 0x4ed862
cmp ax, 0xffff
jne 0x4ed86c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeDebugPrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x20]
cmp ax, 1
jne 0x4ed887
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeAuditPrivilege
push edx
push eax
jmp 0x4ed89c
cmp ax, 0xffff
jne 0x4ed8a6
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeAuditPrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x22]
cmp ax, 1
jne 0x4ed8c1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeSecurityPrivilege
push eax
push ecx
jmp 0x4ed8d6
cmp ax, 0xffff
jne 0x4ed8e0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeSecurityPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x24]
cmp ax, 1
jne 0x4ed8fb
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeSystemEnvironmentPrivilege
push ecx
push edx
jmp 0x4ed910
cmp ax, 0xffff
jne 0x4ed91a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeSystemEnvironmentPrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x26]
cmp ax, 1
jne 0x4ed935
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeChangeNotifyPrivilege
push edx
push eax
jmp 0x4ed94a
cmp ax, 0xffff
jne 0x4ed954
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeChangeNotifyPrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x28]
cmp ax, 1
jne 0x4ed96f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeBackupPrivilege
push eax
push ecx
jmp 0x4ed984
cmp ax, 0xffff
jne 0x4ed98e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeBackupPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x2a]
cmp ax, 1
jne 0x4ed9a9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeRestorePrivilege
push ecx
push edx
jmp 0x4ed9be
cmp ax, 0xffff
jne 0x4ed9c8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeRestorePrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x2c]
cmp ax, 1
jne 0x4ed9e3
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeShutdownPrivilege
push edx
push eax
jmp 0x4ed9f8
cmp ax, 0xffff
jne 0x4eda02
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeShutdownPrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x2e]
cmp ax, 1
jne 0x4eda1d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeLoadDriverPrivilege
push eax
push ecx
jmp 0x4eda32
cmp ax, 0xffff
jne 0x4eda3c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeLoadDriverPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x30]
cmp ax, 1
jne 0x4eda57
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeProfileSingleProcessPrivilege
push ecx
push edx
jmp 0x4eda6c
cmp ax, 0xffff
jne 0x4eda76
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeProfileSingleProcessPrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x32]
cmp ax, 1
jne 0x4eda91
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeSystemtimePrivilege
push edx
push eax
jmp 0x4edaa6
cmp ax, 0xffff
jne 0x4edab0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeSystemtimePrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x34]
cmp ax, 1
jne 0x4edacb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeUndockPrivilege
push eax
push ecx
jmp 0x4edae0
cmp ax, 0xffff
jne 0x4edaea
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeUndockPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x36]
cmp ax, 1
jne 0x4edb05
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeRemoteShutdownPrivilege
push ecx
push edx
jmp 0x4edb1a
cmp ax, 0xffff
jne 0x4edb24
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeRemoteShutdownPrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x38]
cmp ax, 1
jne 0x4edb3f
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeSystemProfilePrivilege
push edx
push eax
jmp 0x4edb54
cmp ax, 0xffff
jne 0x4edb5e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeSystemProfilePrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x3a]
cmp ax, 1
jne 0x4edb79
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeUnsolicitedInputPrivilege
push eax
push ecx
jmp 0x4edb8e
cmp ax, 0xffff
jne 0x4edb98
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeUnsolicitedInputPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x3c]
cmp ax, 1
jne 0x4edbb3
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeMachineAccountPrivilege
push ecx
push edx
jmp 0x4edbc8
cmp ax, 0xffff
jne 0x4edbd2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeMachineAccountPrivilege
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x3e]
cmp ax, 1
jne 0x4edbed
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeEnableDelegationPrivilege
push edx
push eax
jmp 0x4edc02
cmp ax, 0xffff
jne 0x4edc0c
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeEnableDelegationPrivilege
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x40]
cmp ax, 1
jne 0x4edc27
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeSyncAgentPrivilege
push eax
push ecx
jmp 0x4edc3c
cmp ax, 0xffff
jne 0x4edc46
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeSyncAgentPrivilege
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x42]
cmp ax, 1
jne 0x4edc61
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeInteractiveLogonRight
push ecx
push edx
jmp 0x4edc76
cmp ax, 0xffff
jne 0x4edc80
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeInteractiveLogonRight
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x44]
cmp ax, 1
jne 0x4edc9b
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeNetworkLogonRight
push edx
push eax
jmp 0x4edcb0
cmp ax, 0xffff
jne 0x4edcba
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeNetworkLogonRight
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x46]
cmp ax, 1
jne 0x4edcd5
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeBatchLogonRight
push eax
push ecx
jmp 0x4edcea
cmp ax, 0xffff
jne 0x4edcf4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeBatchLogonRight
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x48]
cmp ax, 1
jne 0x4edd0f
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeServiceLogonRight
push ecx
push edx
jmp 0x4edd24
cmp ax, 0xffff
jne 0x4edd2e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeServiceLogonRight
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x4a]
cmp ax, 1
jne 0x4edd49
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeDenyInteractiveLogonRight
push edx
push eax
jmp 0x4edd5e
cmp ax, 0xffff
jne 0x4edd68
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeDenyInteractiveLogonRight
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x4c]
cmp ax, 1
jne 0x4edd83
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 1
push str.SeDenyNetworkLogonRight
push eax
push ecx
jmp 0x4edd98
cmp ax, 0xffff
jne 0x4edda2
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 0
push str.SeDenyNetworkLogonRight
push edx
push eax
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov ax, word [ebp + 0x4e]
cmp ax, 1
jne 0x4eddbd
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
push str.SeDenyBatchLogonRight
push ecx
push edx
jmp 0x4eddd2
cmp ax, 0xffff
jne 0x4edddc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push 0
push str.SeDenyBatchLogonRight
push eax
push ecx
call fcn.004ee100
add esp, 0x10
mov esi, eax
mov eax, dword [ebp + 0x50]
cmp ax, 1
jne 0x4eddf6
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push 1
push str.SeDenyServiceLogonRight
push edx
push eax
jmp 0x4ede0b
cmp ax, 0xffff
jne 0x4ede15
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0
push str.SeDenyServiceLogonRight
push ecx
push edx
call fcn.004ee100
add esp, 0x10
mov esi, eax
test esi, esi
je 0x4ede45
push esi
push str.SetPrivilegeOnAccount
call fcn.004ee070
add esp, 8
or edi, 0xffffffff
jmp 0x4ede45
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetAccountSid
call fcn.004ee090
add esp, 8
mov edi, 0xfffffffe
mov eax, dword [ebp - 0x18]
push eax
call sub.ADVAPI32.dll_LsaClose
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4ede65
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ax, di
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret