Function at 0x401250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov ebx, dword [sym.imp.USER32.dll_FindWindowA]
mov eax, dword [esp + 0x80]
mov dword [esp + 4], str.MobAgent
mov dword [esp], str.MobAgent
mov dword [esp + 0x20], eax
call ebx
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x401750
mov ebx, 0x3837
mov dword [esp + 0x49], 0x65676150
mov dword [esp + 0x4d], 0x52746e61
mov word [esp + 0x5d], bx
mov dword [esp + 0x51], 0x65757165
mov dword [esp + 0x55], 0x32317473
mov dword [esp + 0x59], 0x36353433
mov byte [esp + 0x5f], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 8], eax
lea eax, [esp + 0x49]
mov dword [esp + 4], str.PageantRequest_08x
mov dword [esp], eax
call sub.cygwin1.dll_sprintf
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x4017b0
lea eax, [esp + 0x30]
mov dword [esp + 4], 8
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
je 0x4015e5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp + 0x10], ebp
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [esp], eax
call edi
sub esp, 0x14
test eax, eax
jne 0x4015e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4015e5
mov eax, dword [esp + 0x3c]
mov dword [esp], 0x40
mov dword [esp + 4], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x28], eax
call eax
sub esp, 8
test eax, eax
mov esi, eax
je 0x4015e5
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call edi
sub esp, 0x14
test eax, eax
je 0x401775
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
sub esp, 4
mov edi, eax
mov dword [esp], eax
call sub.cygwin1.dll_malloc
test eax, eax
mov ebp, eax
je 0x4017d0
mov eax, dword [esi]
mov dword [esp + 4], ebp
mov dword [esp], edi
mov dword [esp + 8], eax
call dword [sym.imp.ADVAPI32.dll_CopySid]
sub esp, 0xc
test eax, eax
je 0x4017a0
mov dword [esp], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
call ebx
sub esp, 4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40177e
mov dword [esp], eax
call ebx
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov dword [esp], esi
mov dword [esp + 0x24], eax
call eax
sub esp, 4
mov dword [esp], edi
call sub.cygwin1.dll_free
test ebp, ebp
je 0x401620
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x28], eax
mov dword [esp + 4], 0x14
mov dword [esp], 0x40
xor ebx, ebx
call dword [esp + 0x28]
sub esp, 8
test eax, eax
mov esi, eax
je 0x401499
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
sub esp, 8
test eax, eax
jne 0x401710
lea eax, [esp + 0x49]
mov dword [esp + 0x10], 0x2000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], ebx
mov dword [esp + 0x14], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
lea eax, [eax - 1]
sub esp, 0x18
cmp eax, 0xfffffffd
ja 0x4016c9
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov edx, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
bswap eax
add eax, 4
mov dword [esp], edx
mov dword [esp + 0x28], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call sub.cygwin1.dll_memcpy
lea ecx, [esp + 0x49]
mov dword [esp + 0x3c], 0x804e50ba
mov dword [esp], ecx
call sub.cygwin1.dll_strlen
lea ecx, [esp + 0x49]
add eax, 1
mov dword [esp + 8], 0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], 0x4a
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp], ecx
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov ecx, dword [edx]
bswap ecx
add ecx, 4
cmp ecx, 0x2000
jg 0x4016a3
test eax, eax
jle 0x4016a3
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_memcpy
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
sub esp, 4
mov dword [esp], edi
call ebx
sub esp, 4
mov dword [esp], esi
call dword [esp + 0x24]
sub esp, 4
mov dword [esp + 0x80], ebp
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.cygwin1.dll_free
xor ebp, ebp
xor edi, edi
xor esi, esi
mov dword [esp], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
sub esp, 4
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x40142d
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp], esi
mov dword [esp + 0x24], eax
call eax
push eax
mov dword [esp], edi
call sub.cygwin1.dll_free
lea esi, [esi]
lea eax, [esp + 0x49]
mov dword [esp + 0x10], 0x2000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp + 0x14], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
lea eax, [eax - 1]
sub esp, 0x18
cmp eax, 0xfffffffd
ja 0x401705
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
xor ebp, ebp
mov dword [esp + 8], 0
mov dword [esp + 4], 2
xor esi, esi
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov edx, eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
jmp 0x401515
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
sub esp, 4
mov dword [esp], edi
call ebx
sub esp, 4
mov dword [esp], esi
call dword [esp + 0x24]
sub esp, 4
mov dword [esp], ebp
call sub.cygwin1.dll_free
mov dword [esp], esi
call dword [esp + 0x24]
sub esp, 4
mov dword [esp], ebp
call sub.cygwin1.dll_free
mov eax, dword [0x4047b8]
mov dword [esp + 4], 0x4047b8
bswap eax
add eax, 4
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.cygwin1.dll_memcpy
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebp, ebp
xor esi, esi
jmp 0x4016c9
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
sub esp, 0xc
test eax, eax
je 0x401499
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x38], 1
lea ebx, [esp + 0x30]
mov dword [esp + 0x34], esi
jmp 0x401499
mov dword [esp + 4], str.Pageant
mov dword [esp], str.Pageant
call ebx
sub esp, 8
test eax, eax
mov dword [esp + 0x2c], eax
je 0x4016db
jmp 0x401288
xor ebp, ebp
xor edi, edi
jmp 0x4015eb
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp], esi
mov dword [esp + 0x24], eax
call eax
push edx
mov dword [esp], 0
call sub.cygwin1.dll_free
jmp 0x40145f
mov edi, ebp
xor ebp, ebp
jmp 0x4015eb
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4017d7
xor ebp, ebp
xor edi, edi
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40142d
xor edi, edi
jmp 0x4015eb
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp], 0
xor ebp, ebp
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x24], eax
call eax
push ecx
jmp 0x401499