Function at 0x10003a00
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0x10029094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [0x10029a78], eax
mov eax, dword [ebp + 0xc]
push 0x400
mov dword [0x10029a7c], eax
lea eax, [ebp - 0x404]
push 0
push eax
mov dword [0x10029a74], esi
call fcn.1000bcf0
add esp, 0xc
test esi, esi
je 0x10003a72
mov esi, dword [esi]
test esi, esi
je 0x10003a72
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.10007570
mov eax, dword [0x10029a74]
add esp, 8
mov ecx, dword [esi]
push esi
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 9
mov dword [ebp - 0x420], 0
call fcn.1000a16b
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
add esp, 4
mov word [edi + 7], 0x32
push edi
mov dword [edi], 0x6e72656b
mov word [edi + 4], 0x6c65
mov byte [edi + 6], 0x33
call ebx
push edi
mov esi, eax
call fcn.1000a174
add esp, 4
test esi, esi
je 0x10003b8b
push 0xd
call fcn.1000a16b
mov edi, eax
add esp, 4
push edi
mov dword [edi], 0x61766441
mov dword [edi + 8], 0x6c6c642e
mov byte [edi + 0xc], 0
mov word [edi + 5], 0x3369
mov byte [edi + 4], 0x70
mov byte [edi + 7], 0x32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov esi, eax
call fcn.1000a174
add esp, 4
test esi, esi
je 0x10003b8b
lea eax, [ebp - 0x420]
push eax
push 0x20
call fcn.10006850
push eax
call fcn.10006b40
add esp, 0xc
test eax, eax
je 0x10003b7d
lea eax, [ebp - 0x40c]
push eax
push str.SeDebugPrivilege
push 0
call fcn.10006d60
add esp, 0xc
test eax, eax
je 0x10003b7d
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x408]
push 0
push 0
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x41c]
push 0x10
push eax
push 0
push dword [ebp - 0x420]
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], 2
call fcn.100069a0
add esp, 0x18
push dword [ebp - 0x420]
call fcn.10007190
add esp, 4
push 9
call fcn.1000a16b
mov edi, eax
add esp, 4
push edi
mov dword [edi], 0x6e72656b
mov dword [edi + 5], 0x32336c
mov byte [edi + 4], 0x65
call ebx
push edi
mov esi, eax
call fcn.1000a174
add esp, 4
test esi, esi
je 0x10003cd0
push 0
push 2
mov dword [ebp - 0x548], 0x128
call fcn.10007230
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x10003cd0
lea eax, [ebp - 0x548]
push eax
push ebx
call fcn.10006ec0
add esp, 8
cmp eax, 1
jne 0x10003cc7
push 0xa
call fcn.1000a16b
mov esi, eax
add esp, 4
push esi
mov word [esi + 5], 0x642e
mov dword [esi], 0x6c64746e
mov word [esi + 8], 0x6c
mov byte [esi + 7], 0x6c
mov byte [esi + 4], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov edi, eax
call fcn.1000a174
push 9
call fcn.1000a16b
add esp, 8
mov esi, eax
push esi
push edi
mov dword [esi + 2], 0x63697274
mov word [esi + 6], 0x706d
mov word [esi], 0x735f
mov byte [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [0x10029a70], eax
call fcn.1000a174
mov eax, dword [0x10029a70]
add esp, 4
test eax, eax
je 0x10003cc7
nop
lea ecx, [ebp - 0x404]
push ecx
lea ecx, [ebp - 0x524]
push ecx
call eax
add esp, 8
test eax, eax
jne 0x10003cab
push dword [ebp - 0x540]
push eax
push 0x401
call fcn.10007600
mov esi, eax
push 0
push esi
call fcn.10007430
push esi
call fcn.10007190
add esp, 0x18
lea eax, [ebp - 0x548]
push eax
push ebx
call fcn.10006e20
add esp, 8
cmp eax, 1
jne 0x10003cc7
mov eax, dword [0x10029a70]
jmp 0x10003c70
push ebx
call fcn.10007190
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a678
mov esp, ebp
pop ebp
ret