Function at 0x10003421
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100efe7e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2058
call fcn.100ccb40
mov eax, dword [0x10110164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2054], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2050], eax
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
push edi
push ebx
push 0x60000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10003704
mov dword [ebp - 0x201c], ebx
mov dword [ebp - 0x2018], ebx
push dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [ebp - 0x201c]
call fcn.10003351
mov byte [ebp - 4], 1
mov dword [ebp - 0x2028], ebx
mov dword [ebp - 0x2024], ebx
mov dword [ebp - 0x2020], ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x202c]
push eax
push ebx
push ebx
push 4
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
call ebx
test eax, eax
jne 0x1000350f
lea eax, [ebp - 0x2028]
push eax
push dword [ebp - 0x202c]
mov ecx, eax
call fcn.10003294
mov eax, dword [ebp - 0x2028]
mov dword [ebp - 0x2048], eax
lea ecx, [ebp - 0x202c]
push ecx
push dword [ebp - 0x202c]
push eax
push 4
push esi
call ebx
test eax, eax
jne 0x1000353a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2028]
call fcn.10004afc
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2018]
test ecx, ecx
je 0x10003704
call fcn.10002bb1
jmp 0x10003704
cmp dword [ebp - 0x2048], 0
je 0x1000350f
lea eax, [ebp - 0x2044]
push eax
push 0x28
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000350f
xor ebx, ebx
mov dword [ebp - 0x2034], ebx
mov dword [ebp - 0x2030], ebx
push dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2044]
lea ecx, [ebp - 0x2034]
call fcn.10003351
mov byte [ebp - 4], 3
mov ecx, 0x2000
mov dword [ebp - 0x204c], ecx
lea eax, [ebp - 0x204c]
push eax
push ecx
lea eax, [ebp - 0x2014]
push eax
push 1
push dword [ebp - 0x2044]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x100035d7
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2030]
test ecx, ecx
je 0x100035c0
call fcn.10002bb1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2028]
call fcn.10004afc
mov byte [ebp - 4], bl
jmp 0x10003522
push 1
lea eax, [ebp - 0x2068]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0x2040], ebx
mov dword [ebp - 0x203c], ebx
mov dword [ebp - 0x2038], ebx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2040]
push eax
push 0x2000
mov ecx, eax
call fcn.10003294
mov ebx, dword [ebp - 0x2040]
push 2
push 0x2000
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push dword [ebp - 0x2014]
push sym.xclio_egg_Win32.dll_Ordinal_2
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x10003666
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2040]
call fcn.10004afc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2030]
test ecx, ecx
je 0x1000350f
call fcn.10002bb1
jmp 0x1000350f
push 1
push ebx
push 1
lea eax, [ebp - 0x2068]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1000363b
lea eax, [ebp - 0x2068]
push eax
push 4
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
call ebx
test eax, eax
je 0x1000363b
push edi
push dword [ebp - 0x2050]
push dword [ebp - 0x2054]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push dword [ebp - 0x2048]
push 4
push esi
call ebx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2040]
call fcn.10004afc
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2030]
test ecx, ecx
je 0x100036d4
call fcn.10002bb1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2028]
call fcn.10004afc
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2018]
test ecx, ecx
je 0x100036f6
call fcn.10002bb1
mov eax, edi
jmp 0x10003706
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100cc9b8
leave
ret 0xc