Function at 0x100032570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x100]
mov byte [rbp - 8], cl
mov dword [rbp - 0x10], edx
mov byte [rbp - 0x14], 0x55
mov dword [rbp - 0x20], 0x55555555
mov dword [rbp - 0x1c], 0x55555555
mov dword [rbp - 0x28], 0x55555555
mov dword [rbp - 0x24], 0x55555555
mov dword [rbp - 0x30], 0x55555555
mov dword [rbp - 0x2c], 0x55555555
mov dword [rbp - 0x38], 0x55555555
mov dword [rbp - 0x34], 0x55555555
mov dword [rbp - 0x40], 0x55555555
mov dword [rbp - 0x3c], 0x55555555
mov dword [rbp - 0x44], 0x55555555
mov dword [rbp - 0x50], 0x55555555
mov dword [rbp - 0x4c], 0x55555555
lea rax, [rbp - 0xb8]
mov r8d, 0x55
mov edx, 0x68
mov rcx, rax
call fcn.1000029a0
lea rcx, [rbp - 0xd0]
mov r8d, 0x55
mov edx, 0x18
call fcn.1000029a0
xor edx, edx
lea rcx, str._ImpersonateAsSystemW_Vista_
call dbg.LOG
mov byte [rbp - 0x14], 0
lea rax, [sub.advapi32.dll_ImpersonateLoggedOnUser]
test rax, rax
je 0x100032818
nop
mov r8d, dword [rbp - 0x10]
xor edx, edx
mov ecx, 0x2000000
call sub.kernel32.dll_OpenProcess
mov qword [rbp - 0x20], rax
test rax, rax
je 0x100032818
nop
lea r8, [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov edx, 0x2000000
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x100032804
nop
mov dword [rsp + 0x20], 1
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov rcx, qword [rbp - 0x28]
mov r9d, 2
xor r8, r8
mov edx, 0x2000000
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x1000327f8
nop
mov ecx, 0xc
call fcn.10000d140
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x20], rax
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x30]
xor r9d, r9d
mov edx, 0x19
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x1000327ec
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
sete al
and eax, 0xff
neg eax
je 0x1000327ec
mov qword [rbp - 0x40], 0
mov edx, dword [rbp - 0x44]
lea rcx, [rbp - 0x40]
call fcn.10000d080
cmp qword [rbp - 0x40], 0
je 0x1000327ec
nop
lea rax, [rbp - 0x44]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x44]
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x30]
mov edx, 0x19
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x1000327e0
cmp byte [rbp - 8], 4
jne 0x100032745
mov rax, qword [str.S_1_16_16384]
mov qword [rbp - 0x50], rax
jmp 0x10003277c
cmp byte [rbp - 8], 3
jne 0x100032758
mov rax, qword [str.S_1_16_12288]
mov qword [rbp - 0x50], rax
jmp 0x10003277c
cmp byte [rbp - 8], 2
jne 0x10003276b
mov rax, qword [str.S_1_16_8192]
mov qword [rbp - 0x50], rax
jmp 0x10003277c
cmp byte [rbp - 8], 1
jne 0x10003277c
mov rax, qword [str.S_1_16_4096]
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp - 0x50]
call sub.advapi32.dll_ConvertStringSidToSidW
test eax, eax
je 0x1000327e0
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov qword [rax], rdx
mov rax, qword [rbp - 0x40]
mov dword [rax + 8], 0x20
mov rcx, qword [rbp - 0x38]
call sub.advapi32.dll_GetLengthSid
lea r9d, [eax + 0x10]
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x30]
mov edx, 0x19
call sub.advapi32.dll_SetTokenInformation
test eax, eax
je 0x1000327e0
mov rcx, qword [rbp - 0x30]
call sub.advapi32.dll_ImpersonateLoggedOnUser
or eax, eax
setne al
mov byte [rbp - 0x14], al
xor ecx, ecx
call sub.kernel32.dll_SetLastError
nop
nop
mov rcx, rbp
call dbg.fin$00000060
nop dword [rax]
nop
mov rcx, rbp
call dbg.fin$00000061
nop dword [rax]
nop
mov rcx, rbp
call dbg.fin$00000062
nop dword [rax]
nop
mov rcx, rbp
call dbg.fin$00000063
nop dword [rax]
jmp 0x100032818
mov al, byte [rbp - 0x14]
nop
lea rsp, [rbp]
pop rbp
ret