Function at 0x100057ad
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1008c274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x28
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10005693
xor al, al
jmp 0x10005863
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
xor eax, eax
test eax, eax
je 0x100056a2
jne 0x100056a1
call 0x93044729
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
jns 0x10005725
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100056b0
jmp 0x100056b2
je 0x100056ad
sti
clc
jae 0x100056b7
retf
je 0x100056bc
jne 0x100056bc
jns 0x10005723
pushf
pushfd
push 0xa
jae 0x100056c9
jmp 0x100056c4
call 0x100056cb
jae 0x100056c4
add esp, 4
jmp 0x100056d0
dec dword [esp]
jno 0x100056d5
jns 0x100056c0
jp 0x100056d9
add esp, 4
popf
jmp 0x100056e0
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100056f9
jne 0x100056f9
call 0x1fc08a4d
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov dword [ebp - 0x14], 1
mov edx, 0xc
imul eax, edx, 0
mov dword [ebp + eax - 8], 2
mov ecx, 0xc
imul edx, ecx, 0
lea eax, [ebp + edx - 0x10]
push eax
add byte [eax], al
add byte [ebx - 0x2f], ch
add byte [ebp + 0x50f01544], cl
push 0x100734b0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10005745
mov byte [ebp - 0x25], 0
jmp 0x10005769
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10005765
mov byte [ebp - 0x25], 0
jmp 0x10005769
mov byte [ebp - 0x25], 1
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x10005853
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
xor eax, eax
test eax, eax
je 0x10005784
jne 0x10005783
call 0x9304480b
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
jns 0x10005807
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10005792
jmp 0x10005794
je 0x1000578f
sti
clc
jae 0x10005799
retf
je 0x1000579e
jne 0x1000579e
jns 0x10005805
pushf
pushfd
push 0xa
jae 0x100057ab
jmp 0x100057a6
call 0x100057ad
jae 0x100057a6
add esp, 4
jmp 0x100057b2
dec dword [esp]
jno 0x100057b7
jns 0x100057a2
jp 0x100057bb
add esp, 4
popf
jmp 0x100057c2
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100057db
jne 0x100057db
call 0x1fc08b2f
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov dword [ebp - 0x24], 1
mov edx, 0xc
imul eax, edx, 0
mov dword [ebp + eax - 0x18], 2
mov ecx, 0xc
imul edx, ecx, 0
lea eax, [ebp + edx - 0x20]
push eax
add byte [eax], al
add byte [ebx - 0x2f], ch
add byte [ebp + 0x50e01544], cl
push 0x100734c4
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10005827
mov byte [ebp - 0x26], 0
jmp 0x1000584b
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10005847
mov byte [ebp - 0x26], 0
jmp 0x1000584b
mov byte [ebp - 0x26], 1
movzx eax, byte [ebp - 0x26]
test eax, eax
jne 0x10005857
xor al, al
jmp 0x10005863
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c5a5
mov esp, ebp
pop ebp
ret