Function at 0x1003f310
Capabilities:
Create thread
Enumerate processes
Manipulate user privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008117d
mov eax, dword fs:[0]
push eax
sub esp, 0x5a4
mov eax, dword [0x10098070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x4f0], edi
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0xf
mov byte [ebp - 0x31c], 0
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f0], 0xf
mov byte [ebp - 0x304], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2d8], 0xf
mov byte [ebp - 0x2ec], 0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0xf
mov byte [ebp - 0x2d0], 0
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0xf
mov byte [ebp - 0x2b0], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x518], 0
lea ecx, [ebp - 0x4c0]
call fcn.10040740
mov esi, dword [ebp + 0x14]
mov byte [ebp - 4], 2
lea eax, [esi + 0x57e]
mov dword [ebp - 0x4c4], eax
cmp esi, eax
ja 0x1003ff84
mov cl, byte [ebp - 0x4c9]
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c8], ecx
cmp esi, 0x59d6
ja 0x1003fd38
je 0x1003fceb
cmp esi, 0x57e8
ja 0x1003f9cf
je 0x1003f9bd
cmp esi, 0x4a15
ja 0x1003f90d
je 0x1003f803
cmp esi, 0x3d8d
ja 0x1003f7cf
je 0x1003f7be
mov eax, esi
sub eax, 0x3d1b
je 0x1003f7af
sub eax, 0x26
je 0x1003f69c
sub eax, 0x26
jne case.0x10040064.26464
mov byte [ebp - 0x4d1], al
lea eax, [ebp - 0x50c]
push eax
push 0xf0fff
lea eax, [ebp - 0x5b0]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x1003f68b
xor esi, esi
mov edi, 4
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x504], edi
cmp esi, 0x3f
ja case.0x1003f503.1
movzx eax, byte [esi + 0x1004025c]
jmp dword [eax*4 + 0x10040248]
xor eax, eax
mov dword [ebp - 0x4dc], eax
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x4e0]
push eax
mov eax, dword [ebp - 0x4d8]
push dword [eax]
push dword [ebp - 0x50c]
call dword [sym.imp.ADVAPI32.dll_LsaEnumerateAccountRights]
test eax, eax
jne 0x1003f5f7
mov esi, 0x17bc
mov dword [ebp - 0x52c], esi
mov eax, esi
sub eax, 0x17bc
je 0x1003f56c
sub eax, 0x37
je 0x1003f626
sub eax, 0x37
jne 0x1003f5cc
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
jmp 0x1003f5cc
xor edi, edi
cmp dword [ebp - 0x4e4], edi
jbe 0x1003f5cc
mov eax, dword [ebp - 0x4e0]
mov ecx, dword [ebp - 0x4e4]
mov dx, word [ebp - 0x18]
cmp word [eax + edi*8], dx
jne 0x1003f5c1
mov edx, dword [eax + edi*8 + 4]
mov esi, 0x26
mov eax, dword [ebp - 0x14]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x1003f5b1
add edx, 4
add eax, 4
sub esi, 4
jae 0x1003f598
mov cx, word [edx]
cmp cx, word [eax]
je 0x1003f61c
mov dx, word [ebp - 0x18]
mov ecx, dword [ebp - 0x4e4]
mov eax, dword [ebp - 0x4e0]
inc edi
cmp edi, ecx
jb 0x1003f586
mov esi, dword [ebp - 0x52c]
add esi, 0x37
mov dword [ebp - 0x52c], esi
cmp esi, 0x182a
jbe 0x1003f547
mov eax, dword [ebp - 0x4dc]
mov esi, dword [ebp - 0x508]
mov edi, dword [ebp - 0x504]
test eax, eax
jne case.0x1003f503.1
push 1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x4d8]
push dword [eax]
push dword [ebp - 0x50c]
call dword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
sete byte [ebp - 0x4d1]
jmp case.0x1003f503.1
mov dword [ebp - 0x4dc], 1
mov esi, 0x17f3
jmp 0x1003f5cc
mov eax, 0x2a
mov dword [ebp - 0x14], str.SeLockMemoryPrivilege
mov word [ebp - 0x18], ax
jmp case.0x1003f503.1
push dword [ebp - 0x50c]
call dword [sym.imp.ADVAPI32.dll_LsaClose]
jmp case.0x1003f503.1
mov eax, 0x2c
mov dword [ebp - 0x4e0], 0
mov word [ebp - 0x16], ax
mov dword [ebp - 0x4e4], 0
add esi, 0x15
sub edi, 1
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x504], edi
jne 0x1003f4f3
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp - 0x4f0]
push dword [ebp - 0x4d8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1004016c
lea eax, [ebp - 0x4f4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1003f78b
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x7cdb
cmp esi, 0x7d8b
ja 0x1003f718
je 0x1003f70b
mov eax, esi
sub eax, 0x7cdb
je 0x1003f6f5
sub eax, 0x58
jne 0x1003f773
lea eax, [ebp - 0x554]
push eax
push 4
lea eax, [ebp - 0x558]
push eax
push 0x14
jmp 0x1003f767
mov dword [ebp - 0x554], 4
mov dword [ebp - 0x4f8], 0
jmp 0x1003f773
lea eax, [ebp - 0x4f8]
push eax
push 0
push 0
jmp 0x1003f765
mov eax, esi
sub eax, 0x7de3
je 0x1003f730
sub eax, 0x58
jne 0x1003f773
push dword [ebp - 0x4f4]
call edi
jmp 0x1003f773
mov eax, dword [ebp - 0x4f8]
test eax, eax
je 0x1003f773
cmp dword [ebp - 0x558], 0
je 0x1003f773
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x4d8], eax
lea eax, [ebp - 0x4f8]
push eax
push dword [ebp - 0x4f8]
push dword [ebp - 0x4d8]
push 1
push dword [ebp - 0x4f4]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
add esi, 0x58
cmp esi, 0x7e3b
jbe 0x1003f6c5
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp - 0x4f0]
cmp dword [ebp - 0x4d8], 0
je 0x1003ff7d
xorps xmm0, xmm0
movups xmmword [ebp - 0x5b0], xmm0
movq qword [ebp - 0x5a0], xmm0
jmp 0x1004016c
mov dword [ebp - 0x4d8], 0
jmp case.0x10040064.26464
mov al, byte [ebp - 0x4d1]
mov byte [ebp - 0x4d0], al
jmp case.0x10040064.26464
cmp esi, 0x3db3
je 0x1003ff84
cmp esi, 0x49ef
jne 0x1004017e
push 0x6f2d
push 0
push 0
push dword [ebp - 0x4ec]
call fcn.10053430
add esp, 0x10
jmp 0x1004016c
cmp dword [edi + 0x244], 0xffffffff
jne 0x1003f82b
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [edi + 0x244], eax
cmp eax, 0xffffffff
je 0x1003ff7d
mov ecx, dword [ebp - 0x4c8]
cmp byte [edi + 0x258], 0
je 0x1003f8e5
xor esi, esi
nop word [eax + eax]
cmp esi, 0x10
ja case.0x1003f84c.1
movzx eax, byte [esi + 0x100402b4]
jmp dword [eax*4 + 0x1004029c]
test cl, cl
je case.0x1003f84c.1
push dword [ebp - 0x510]
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, dword [ebp - 0x4c8]
jmp case.0x1003f84c.1
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov ecx, dword [ebp - 0x4c8]
mov dword [ebp - 0x510], eax
jmp case.0x1003f84c.1
lea eax, [edi + 0x18]
push eax
push dword [edi + 0x244]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1003ff7d
mov ecx, dword [ebp - 0x4c8]
jmp case.0x1003f84c.1
mov cl, 1
mov byte [edi + 0x258], 0
jmp 0x1003f8b8
xor eax, eax
movzx ecx, cl
cmp dword [ebp - 0x510], eax
cmove ecx, eax
mov dword [ebp - 0x4c8], ecx
add esi, 4
lea eax, [esi + 0x51bc]
cmp eax, 0x51cc
jbe 0x1003f840
mov ecx, dword [ebp - 0x4ec]
lea eax, [edi + 0x3c]
mov esi, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x1004016c
lea eax, [edi + 0x18]
push eax
push dword [edi + 0x244]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1003ff7d
mov ecx, dword [ebp - 0x4ec]
lea eax, [edi + 0x3c]
mov dword [ecx], eax
jmp 0x1004016c
cmp esi, 0x4a87
ja 0x1003f965
je 0x1003ff84
mov eax, esi
sub eax, 0x4a3b
je 0x1003f948
sub eax, 0x26
jne case.0x10040064.26464
mov eax, dword [ebp - 0x530]
test byte [eax], 3
jne 0x10040191
mov byte [ebp - 0x4d0], 1
jmp case.0x10040064.26464
mov ecx, dword [ebp - 0x4ec]
mov eax, dword [edi + 0x20]
mov dword [ecx + 0xc], eax
mov eax, dword [edi + 0x30]
mov dword [ecx + 0x10], eax
mov eax, dword [edi + 0x2c]
mov dword [ecx + 0x14], eax
jmp 0x10040172
mov eax, esi
sub eax, 0x579c
je 0x1003f9a2
sub eax, 0x26
jne case.0x10040064.26464
mov eax, dword [0x1009085a]
mov dword [ebp - 0x78], eax
movzx eax, word [0x1009085e]
mov word [ebp - 0x74], ax
mov eax, dword [0x10090970]
mov dword [ebp - 0x72], eax
movzx eax, word [0x10090974]
mov word [ebp - 0x6e], ax
jmp case.0x10040064.26464
mov eax, dword [0x10090d8e]
mov dword [ebp - 0x80], eax
mov eax, dword [0x10090d92]
mov dword [ebp - 0x7c], eax
xor eax, eax
mov word [ebp - 0x78], ax
jmp case.0x10040064.26464
mov edi, dword [ebp - 0x4f0]
mov dword [ebp - 0x6c], 0x72
jmp 0x1004017e
cmp esi, 0x58f2
ja 0x1003fad7
je 0x1003faa6
lea eax, [esi - 0x580e]
cmp eax, 0xbe
ja case.0x10040064.26464
movzx eax, byte [eax + 0x100402e4]
jmp dword [eax*4 + 0x100402c8]
xor eax, eax
mov dword [ebp - 0x6a], 0x500079
mov word [ebp - 0x66], ax
jmp case.0x10040064.26464
push 2
lea eax, [ebp - 0x80]
push 0x100909e2
push eax
call fcn.1006db47
push 3
lea eax, [ebp - 0x60]
push 0x10090a9a
push eax
call fcn.1006fe81
add esp, 0x18
xor eax, eax
mov word [ebp - 0x5a], ax
jmp 0x1004016c
push 2
lea eax, [ebp - 0x80]
push 0x10090c46
push eax
call fcn.1006db47
push 0x1009a198
push 0
push 0x3fd7
call fcn.10052e40
add esp, 0x18
jmp 0x1004016c
push 0x7bd9
call fcn.1000de30
add esp, 4
test al, al
je 0x1004021f
jmp 0x1004016c
mov dword [ebp - 0x66], 0x72
jmp case.0x10040064.26464
push 0x477a
push 0x1009a198
call fcn.100301e0
add esp, 8
jmp 0x1004016c
lea eax, [ebp - 0x80]
push eax
push 0x64d8
call fcn.1000e4d0
add esp, 8
test al, al
jne 0x1004016c
push 0x3d1b
push 0
push 0
push 0
call fcn.1003f310
add esp, 0x10
jmp 0x1004016c
lea eax, [esi - 0x5918]
cmp eax, 0x98
ja case.0x10040064.26464
movzx eax, byte [eax + 0x100403bc]
jmp dword [eax*4 + 0x100403a4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1006dc78
add esp, 4
lea ecx, [ebp - 0x380]
push 0x1008dc60
call fcn.1005b5a0
push 0x1008dc60
lea ecx, [ebp - 0x368]
mov byte [ebp - 4], 3
call fcn.1005b5a0
push 0x1008dc60
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 4
call fcn.1005b5a0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x334]
push 0x1008dc60
mov word [ebp - 0x338], 1
call fcn.1005b5a0
push 0x58b7
push 0x1009a1e4
lea eax, [ebp - 0x380]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0x4dc], 0x1bb
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.1001d2a0
add esp, 0x14
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x380]
call fcn.100409c0
jmp 0x1004016c
mov eax, dword [0x1009a294]
mov dword [ebp - 0x4e8], eax
lea eax, [ebp - 0x528]
push eax
push 0x1e9
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x4e8]
push eax
call fcn.100027a0
add esp, 0x10
lea eax, [ebp - 0x528]
mov dword [ebp - 0x568], eax
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x564], eax
mov eax, dword [0x1009a294]
push 0
mov dword [ebp - 0x560], eax
mov eax, dword [0x1009a298]
push 0
mov dword [ebp - 0x55c], eax
lea eax, [ebp - 0x598]
movups xmm0, xmmword [ebp - 0x568]
push eax
push 0x10052570
push 0
push 0
movups xmmword [ebp - 0x598], xmm0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x4e8], eax
jmp 0x1004016c
push 0
push 0
push 0
push 0x100301a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x534], eax
jmp 0x1004016c
mov eax, dword [ebp - 0x534]
test eax, eax
je 0x1004021f
push eax
call edx
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0x4dc], 0x10039970
push 0x3aec
push eax
call fcn.100277b0
add esp, 8
jmp 0x1004016c
mov eax, dword [ebp - 0x4e8]
test eax, eax
jne 0x1003fce3
mov ecx, 0x6e6
mov eax, ecx
sub eax, 0x6e6
je 0x1003fcc7
sub eax, 0x53
jne 0x1003fcd2
xor esi, esi
lea edi, [eax + 4]
mov ecx, 0x7025
lea edx, [eax + 0xa]
nop
cmp esi, 0x1e
ja case.0x1003fcc0.1
movzx eax, byte [esi + 0x1004046c]
jmp dword [eax*4 + 0x10040458]
mov eax, dword [sym.imp.KERNEL32.dll__hwrite]
mov dword [ebp - 0x514], eax
add ecx, 0x53
cmp ecx, 0x739
jbe 0x1003fc94
mov eax, dword [ebp - 0x4e8]
push eax
call edx
jmp 0x1004016c
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x4c0]
push eax
push 0x1009a198
push 0x6899
call fcn.1001b810
lea eax, [ebp - 0x4c0]
push 0x397b
push eax
call fcn.10031820
push 0
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0x2611
call fcn.10056250
add esp, 0x2c
jmp 0x1004016c
cmp esi, 0x6655
ja 0x1003fe9e
je 0x1003fe8c
cmp esi, 0x6571
ja 0x1003fe0d
je 0x1003fdea
cmp esi, 0x64ff
ja 0x1003fda8
je 0x1003fd97
mov eax, esi
sub eax, 0x59fc
je 0x1003fd88
sub eax, 0x26
je 0x1003ff84
sub eax, 0xab7
je 0x10040091
jmp case.0x10040064.26464
mov dword [ebp - 0x4d0], 0
jmp case.0x10040064.26464
xor edi, edi
mov word [ebp - 0x4e], di
mov edi, dword [ebp - 0x4f0]
jmp 0x1004017e
mov eax, esi
sub eax, 0x6525
je 0x1003fdcf
sub eax, 0x26
jne case.0x10040064.26464
mov eax, 0x6c
mov dword [ebp - 0x46], 0x6c0064
mov word [ebp - 0x42], ax
jmp case.0x10040064.26464
mov eax, dword [0x10090c0c]
mov dword [ebp - 0x4e], eax
mov eax, dword [0x10090c10]
mov dword [ebp - 0x4a], eax
xor eax, eax
mov word [ebp - 0x46], ax
jmp case.0x10040064.26464
xor edx, edx
mov word [ebp - 0x40], dx
mov edx, 0x73
mov word [ebp - 0x24], dx
mov edx, 0x636f
mov word [ebp - 0x23], dx
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1004017e
lea eax, [esi - 0x6597]
cmp eax, 0x98
ja case.0x10040064.26464
movzx eax, byte [eax + 0x100404a4]
jmp dword [eax*4 + 0x1004048c]
mov eax, 0x5f
mov word [ebp - 0x36], ax
jmp case.0x10040064.26464
mov eax, dword [0x10090e20]
mov dword [ebp - 0x30], eax
mov ax, word [0x10090e24]
mov dword [ebp - 0x34], 0x320033
mov word [ebp - 0x2c], ax
jmp case.0x10040064.26464
xor eax, eax
mov word [ebp - 0x34], ax
jmp case.0x10040064.26464
xor eax, eax
mov word [ebp - 0x36], ax
jmp case.0x10040064.26464
mov eax, dword [0x10090eaa]
mov dword [ebp - 0x3c], eax
mov ax, word [0x10090eae]
mov dword [ebp - 0x21], 0x74656b
mov word [ebp - 0x38], ax
jmp case.0x10040064.26464
mov ecx, dword [ebp - 0x4c8]
mov dword [ebp - 0x2a], 0x6c
jmp 0x1004017e
cmp esi, 0x6739
ja 0x1004004c
je 0x1003ff67
lea eax, [esi - 0x667b]
cmp eax, 0x98
ja case.0x10040064.26464
movzx eax, byte [eax + 0x10040558]
jmp dword [eax*4 + 0x10040540]
mov dword [ebp - 0x544], 2
jmp case.0x10040064.26464
mov byte [ebp - 0x4c9], 1
jmp case.0x10040064.26464
xorps xmm0, xmm0
movups xmmword [ebp - 0x298], xmm0
movq qword [ebp - 0x288], xmm0
jmp case.0x10040064.26464
push 0x5bd5
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54c], 0
push eax
push 0x15
mov dword [ebp - 0x548], 1
call fcn.10005f70
add esp, 0xc
mov dword [ebp - 0x538], eax
jmp 0x1004016c
push 0x5bd5
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x540], 2
push eax
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x588], xmm0
call fcn.10005f70
add esp, 0xc
mov dword [ebp - 0x4fc], eax
jmp 0x1004016c
push edi
push 0x6d18
call fcn.100353b0
add esp, 8
test al, al
je 0x1004016c
mov byte [ebp - 0x4d0], 0
mov esi, dword [ebp - 0x4d0]
lea ecx, [ebp - 0x4c0]
call fcn.10040900
mov ecx, dword [ebp - 0x528]
test ecx, ecx
je 0x1003fff8
push dword [ebp - 0x514]
mov edx, dword [ebp - 0x524]
push ecx
call fcn.1005f200
mov ecx, dword [ebp - 0x520]
mov eax, 0x51eb851f
mov edi, dword [ebp - 0x528]
add esp, 8
sub ecx, edi
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push edi
call fcn.1005c210
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x524], 0
mov dword [ebp - 0x520], 0
lea ecx, [ebp - 0x2b0]
call fcn.1005b950
lea ecx, [ebp - 0x2d0]
call fcn.1005b950
lea ecx, [ebp - 0x2ec]
call fcn.1005b950
lea ecx, [ebp - 0x304]
call fcn.1005b950
lea ecx, [ebp - 0x31c]
call fcn.1005b950
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100685c5
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x675f]
cmp eax, 0x98
ja case.0x10040064.26464
movzx eax, byte [eax + 0x1004060c]
jmp dword [eax*4 + 0x100405f4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x578], xmm0
jmp case.0x10040064.26464
mov eax, 0x3ca6
cmp eax, eax
je 0x10040229
add eax, 0x48
cmp eax, 0x3ca6
jbe 0x10040081
mov eax, dword [0x10090b92]
mov dword [ebp - 0x54], eax
mov ax, word [0x10090b96]
mov word [ebp - 0x50], ax
jmp case.0x10040064.26464
push 4
lea eax, [ebp - 0x53c]
push eax
push 1
push 6
push dword [edi]
call dword [ebp - 0x538]
cmp dword [ebp - 0x500], 0
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x4c8]
mov eax, dword [ebp - 0x4c4]
jne 0x1004017e
mov byte [ebp - 0x4c9], 0
jmp 0x1004017e
lea eax, [ebp - 0x500]
mov dword [ebp - 0x500], 0
push eax
lea eax, [ebp - 0x578]
mov dword [ebp - 0x53c], 1
push eax
push dword [ebp - 0x550]
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x540]
lea eax, [ebp - 0x588]
push eax
push dword [ebp - 0x544]
push dword [ebp - 0x548]
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_CreateRestrictedToken]
jmp 0x1004016c
push 0
push 1
push 2
mov dword [ebp - 0x550], 2
call dword [ebp - 0x4fc]
push edi
push 0x6d18
mov dword [edi], eax
call fcn.100353b0
add esp, 8
test al, al
je 0x1003ff7d
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x4c8]
mov eax, dword [ebp - 0x4c4]
add esi, 0x26
mov dword [ebp + 0x14], esi
cmp esi, eax
jbe 0x1003f450
jmp 0x1003ff84
mov eax, dword [eax]
push 0
push edi
mov dword [ebp - 0x4fc], eax
lea eax, [ebp - 0x4fc]
push 0x6657
push eax
push dword [ebp - 0x4ec]
call fcn.100393b0
add esp, 0x14
mov byte [ebp - 0x4d0], al
jmp 0x1003ff84
mov eax, 0x72
mov word [ebp - 0x19], ax
jmp case.0x1003fcc0.1
push dword [ebp - 0x514]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.10001100
add esp, 0xc
mov ecx, 0x7025
mov edx, 0xa
jmp case.0x1003fcc0.1
mov dword [ebp - 0x18], 0x20657469
mov dword [ebp - 0x14], 0xa7025
jmp case.0x1003fcc0.1
mov eax, 0x5f
mov word [ebp - 0x1c], ax
mov eax, 0x7768
mov word [ebp - 0x1b], ax
add esi, 0xa
sub edi, 1
jne 0x1003fcb0
mov esi, 1
jmp 0x1003ff8a
mov al, byte [ebp - 0x4c9]
test al, al
je 0x1004023b
push dword [ebp - 0x500]
call edx
mov byte [ebp - 0x4d0], 1
jmp 0x1003ff84