Function at 0x10003640
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0x10029034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [0x10029a10], eax
mov eax, dword [ebp + 0xc]
push 0x400
mov dword [0x10029a14], eax
lea eax, [ebp - 0x404]
push 0
push eax
mov dword [0x10029a0c], esi
call fcn.1000b850
add esp, 0xc
test esi, esi
je 0x100036b2
mov esi, dword [esi]
test esi, esi
je 0x100036b2
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.10007150
mov eax, dword [0x10029a0c]
add esp, 8
mov ecx, dword [esi]
push esi
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 9
mov dword [ebp - 0x420], 0
call fcn.10009cc7
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
add esp, 4
mov word [edi + 7], 0x32
push edi
mov dword [edi], 0x6e72656b
mov word [edi + 4], 0x6c65
mov byte [edi + 6], 0x33
call ebx
push edi
mov esi, eax
call fcn.10009cd0
add esp, 4
test esi, esi
je 0x100037cb
push 0xd
call fcn.10009cc7
mov edi, eax
add esp, 4
push edi
mov dword [edi], 0x61766441
mov dword [edi + 8], 0x6c6c642e
mov byte [edi + 0xc], 0
mov word [edi + 5], 0x3369
mov byte [edi + 4], 0x70
mov byte [edi + 7], 0x32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov esi, eax
call fcn.10009cd0
add esp, 4
test esi, esi
je 0x100037cb
lea eax, [ebp - 0x420]
push eax
push 0x20
call fcn.10006430
push eax
call fcn.10006720
add esp, 0xc
test eax, eax
je 0x100037bd
lea eax, [ebp - 0x40c]
push eax
push str.SeDebugPrivilege
push 0
call fcn.10006940
add esp, 0xc
test eax, eax
je 0x100037bd
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x408]
push 0
push 0
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x41c]
push 0x10
push eax
push 0
push dword [ebp - 0x420]
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x410], 2
call fcn.10006580
add esp, 0x18
push dword [ebp - 0x420]
call fcn.10006d70
add esp, 4
push 9
call fcn.10009cc7
mov edi, eax
add esp, 4
push edi
mov dword [edi], 0x6e72656b
mov dword [edi + 5], 0x32336c
mov byte [edi + 4], 0x65
call ebx
push edi
mov esi, eax
call fcn.10009cd0
add esp, 4
test esi, esi
je 0x10003910
push 0
push 2
mov dword [ebp - 0x548], 0x128
call fcn.10006e10
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
je 0x10003910
lea eax, [ebp - 0x548]
push eax
push ebx
call fcn.10006aa0
add esp, 8
cmp eax, 1
jne 0x10003907
push 0xa
call fcn.10009cc7
mov esi, eax
add esp, 4
push esi
mov word [esi + 5], 0x642e
mov dword [esi], 0x6c64746e
mov word [esi + 8], 0x6c
mov byte [esi + 7], 0x6c
mov byte [esi + 4], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov edi, eax
call fcn.10009cd0
push 9
call fcn.10009cc7
add esp, 8
mov esi, eax
push esi
push edi
mov dword [esi + 2], 0x63697274
mov word [esi + 6], 0x706d
mov word [esi], 0x735f
mov byte [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [0x10029a08], eax
call fcn.10009cd0
mov eax, dword [0x10029a08]
add esp, 4
test eax, eax
je 0x10003907
nop
lea ecx, [ebp - 0x404]
push ecx
lea ecx, [ebp - 0x524]
push ecx
call eax
add esp, 8
test eax, eax
jne 0x100038eb
push dword [ebp - 0x540]
push eax
push 0x401
call fcn.100071e0
mov esi, eax
push 0
push esi
call fcn.10007010
push esi
call fcn.10006d70
add esp, 0x18
lea eax, [ebp - 0x548]
push eax
push ebx
call fcn.10006a00
add esp, 8
cmp eax, 1
jne 0x10003907
mov eax, dword [0x10029a08]
jmp 0x100038b0
push ebx
call fcn.10006d70
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a1d4
mov esp, ebp
pop ebp
ret