Function at 0x453e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x6011be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3a8
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x20], ebx
push 1
push str.SeRestorePrivilege
mov dword [esp + 0x3c8], ebx
call fcn.00453e00
push 1
push str.SeBackupPrivilege
call fcn.00453e00
push 0x48
call fcn.004a522c
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
mov byte [esp + 0x3c0], 1
test esi, esi
je 0x453f33
push 0xfde9
lea edx, [esp + 0x3cc]
lea ecx, [esp + 0x140]
call fcn.00442f70
add esp, 4
mov byte [esp + 0x3c0], 2
mov ebx, 1
mov ecx, eax
mov dword [esp + 0x20], ebx
call fcn.00408160
push eax
mov ecx, esi
call fcn.005f81f0
mov ebp, eax
mov dword [esp + 0x20], eax
jmp 0x453f39
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x3c0], 0
test bl, 1
je 0x453f55
lea ecx, [esp + 0x13c]
call fcn.004093c0
push ecx
mov ecx, ebp
call fcn.005f82c0
test al, al
je 0x454543
lea eax, [esp + 0x18]
mov word [esp + 0x1a], 0x6b63
push eax
mov ecx, ebp
mov word [esp + 0x21], 0x70
mov word [esp + 0x1c], 0x6162
mov byte [esp + 0x20], 0x75
call fcn.00463800
test eax, eax
je 0x454536
lea ecx, [esp + 0x14]
mov word [esp + 0x15], 0x6765
push ecx
mov ecx, eax
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x1b], 0
call fcn.00463800
mov edi, eax
test edi, edi
je 0x454536
lea ecx, [esp + 0x184]
call fcn.00409520
lea ecx, [esp + 0x154]
call fcn.00409520
lea ecx, [esp + 0x124]
call fcn.00409520
lea ecx, [esp + 0x16c]
call fcn.00409520
lea ecx, [esp + 0x19c]
call fcn.00409520
lea ecx, [esp + 0x10c]
call fcn.00409520
mov byte [esp + 0x3c0], 9
mov ebp, 1
mov dword [esp + 0x34], 0x746f6f72
mov byte [esp + 0x38], 0
mov word [esp + 0x11], 0x7965
mov byte [esp + 0x10], 0x6b
mov byte [esp + 0x13], 0
mov dword [esp + 0x25], 0x656d61
mov byte [esp + 0x24], 0x6e
mov dword [esp + 0x1a], 0x65756c
mov word [esp + 0x18], 0x6176
mov word [esp + 0x3f], 0x65
mov word [esp + 0x3c], 0x7974
mov byte [esp + 0x3e], 0x70
mov dword [esp + 0x2c], 0x34367369
mov byte [esp + 0x30], 0
lea esp, [esp]
push 0x659094
lea ecx, [esp + 0x98]
call fcn.00410fe0
push 0x659094
lea ecx, [esp + 0x80]
mov byte [esp + 0x3c4], 0xa
call fcn.00410fe0
push 0x659094
lea ecx, [esp + 0xc8]
mov byte [esp + 0x3c4], 0xb
call fcn.00410fe0
push 0x659094
lea ecx, [esp + 0xb0]
mov byte [esp + 0x3c4], 0xc
call fcn.00410fe0
push 0x659094
lea ecx, [esp + 0x50]
mov byte [esp + 0x3c4], 0xd
call fcn.00410fe0
push 0x659094
lea ecx, [esp + 0xe0]
mov byte [esp + 0x3c4], 0xe
call fcn.00410fe0
lea eax, [esp + 0x34]
mov byte [esp + 0x3c0], 0xf
push eax
mov ecx, edi
call fcn.005f8310
test eax, eax
je 0x45412c
lea eax, [esp + 0x34]
mov ecx, edi
push eax
call fcn.005f8310
push eax
lea ecx, [esp + 0x98]
call fcn.0045bd80
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.005f8310
test eax, eax
je 0x454155
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.005f8310
push eax
lea ecx, [esp + 0x80]
call fcn.0045bd80
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call fcn.005f8310
test eax, eax
je 0x4541c3
lea eax, [esp + 0x24]
mov ecx, edi
push eax
call fcn.005f8310
push eax
lea ecx, [esp + 0x68]
call fcn.00410fe0
sub esp, 8
mov byte [esp + 0x3c8], 0x10
lea edx, [esp + 0x6c]
lea ecx, [esp + 0xfc]
call fcn.004430f0
add esp, 8
lea ecx, [esp + 0xc4]
push eax
call fcn.0041d020
lea ecx, [esp + 0xf4]
call fcn.004093c0
lea ecx, [esp + 0x64]
mov byte [esp + 0x3c0], 0xf
call fcn.004093c0
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.005f8310
test eax, eax
je 0x454231
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.005f8310
push eax
lea ecx, [esp + 0x68]
call fcn.00410fe0
sub esp, 8
mov byte [esp + 0x3c8], 0x11
lea edx, [esp + 0x6c]
lea ecx, [esp + 0xfc]
call fcn.004430f0
add esp, 8
lea ecx, [esp + 0xac]
push eax
call fcn.0041d020
lea ecx, [esp + 0xf4]
call fcn.004093c0
lea ecx, [esp + 0x64]
mov byte [esp + 0x3c0], 0xf
call fcn.004093c0
lea eax, [esp + 0x3c]
mov ecx, edi
push eax
call fcn.005f8310
test eax, eax
je 0x454257
lea eax, [esp + 0x3c]
mov ecx, edi
push eax
call fcn.005f8310
push eax
lea ecx, [esp + 0x50]
call fcn.0045bd80
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
call fcn.005f8310
test eax, eax
je 0x454280
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
call fcn.005f8310
push eax
lea ecx, [esp + 0xe0]
call fcn.0045bd80
mov edx, 0x659158
lea ecx, [esp + 0xdc]
call fcn.0045e350
xor ebx, ebx
lea ecx, [esp + 0x94]
test al, al
mov edx, 0x65c530
setne bl
xor esi, esi
call fcn.0045e350
test al, al
je 0x4542b6
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x4542ed
mov edx, 0x65c538
lea ecx, [esp + 0x94]
call fcn.0045e350
test al, al
je 0x4542d2
mov esi, SysReAllocString
jmp 0x4542ed
mov edx, 0x65c540
lea ecx, [esp + 0x94]
call fcn.0045e350
test al, al
mov eax, SysReAllocString
cmovne esi, eax
lea eax, [esp + 0x14]
push eax
cmp ebx, 1
jne 0x4542fe
push 0xf013f
jmp 0x454303
push 0xf003f
push ecx
lea ecx, [esp + 0x88]
call fcn.00408160
mov edx, eax
mov ecx, esi
call fcn.004889f0
add esp, 0xc
cmp eax, 2
jne 0x454358
cmp dword [0x6a48b0], 1
lea eax, [esp + 0x14]
push ecx
push eax
push ecx
lea ecx, [esp + 0x88]
jne 0x45433f
push 0xf013f
jmp 0x454344
push 0xf003f
sub esp, 0xc
call fcn.00408160
mov edx, eax
mov ecx, esi
call fcn.00488a60
add esp, 0x1c
test eax, eax
jne 0x454482
mov edx, 0x65c548
lea ecx, [esp + 0x4c]
xor esi, esi
call fcn.0045e350
test al, al
je 0x45437e
mov esi, 3
jmp 0x454443
mov edx, 0x65c554
lea ecx, [esp + 0x4c]
call fcn.0045e350
test al, al
je 0x45439a
mov esi, 4
jmp 0x454443
mov edx, 0x65c560
lea ecx, [esp + 0x4c]
call fcn.0045e350
test al, al
je 0x4543b6
mov esi, 5
jmp 0x454443
mov edx, 0x65c578
lea ecx, [esp + 0x4c]
call fcn.0045e350
test al, al
je 0x4543cf
mov esi, 2
jmp 0x454443
mov edx, 0x65c588
lea ecx, [esp + 0x4c]
call fcn.0045e350
test al, al
je 0x4543e8
mov esi, 6
jmp 0x454443
mov edx, 0x65c594
lea ecx, [esp + 0x4c]
call fcn.0045e350
test al, al
je 0x454401
mov esi, 7
jmp 0x454443
mov edx, 0x65c5a4
lea ecx, [esp + 0x4c]
call fcn.0045e350
test al, al
je 0x454417
xor esi, esi
jmp 0x454443
mov edx, 0x65c5b0
lea ecx, [esp + 0x4c]
call fcn.0045e350
test al, al
je 0x454430
mov esi, 0xb
jmp 0x454443
mov edx, 0x65c5bc
lea ecx, [esp + 0x4c]
call fcn.0045e350
test al, al
cmovne esi, ebp
lea ecx, [esp + 0xac]
call fcn.0041d0b0
push eax
lea ecx, [esp + 0xb0]
call fcn.00408160
push eax
push esi
push ecx
lea ecx, [esp + 0xd4]
call fcn.00408160
mov ecx, dword [esp + 0x24]
mov edx, eax
call fcn.00488af0
mov ecx, dword [esp + 0x24]
add esp, 0x10
call fcn.0048c9b0
push 0x65c5c4
mov ecx, edi
call fcn.004637f0
lea ecx, [esp + 0xdc]
mov edi, eax
call fcn.004093c0
lea ecx, [esp + 0x4c]
call fcn.004093c0
lea ecx, [esp + 0xac]
call fcn.004093c0
lea ecx, [esp + 0xc4]
call fcn.004093c0
lea ecx, [esp + 0x7c]
call fcn.004093c0
lea ecx, [esp + 0x94]
mov byte [esp + 0x3c0], 9
call fcn.004093c0
test edi, edi
jne 0x454070
lea ecx, [esp + 0x10c]
call fcn.004093c0
lea ecx, [esp + 0x19c]
call fcn.004093c0
lea ecx, [esp + 0x16c]
call fcn.004093c0
lea ecx, [esp + 0x124]
call fcn.004093c0
lea ecx, [esp + 0x154]
call fcn.004093c0
lea ecx, [esp + 0x184]
mov byte [esp + 0x3c0], 0
call fcn.004093c0
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x454543
mov eax, dword [ebp]
mov ecx, ebp
push 1
call dword [eax]
push 0
push str.SeRestorePrivilege
call fcn.00453e00
push 0
push str.SeBackupPrivilege
call fcn.00453e00
xor eax, eax
push 0x1fe
push eax
mov word [esp + 0x1bc], ax
lea eax, [esp + 0x1be]
push eax
call fcn.005d9ee0
add esp, 0xc
lea eax, [esp + 0x1b4]
mov ecx, 0x6b4f34
push 0x100
push eax
push 0x65c5c8
call fcn.00439d00
lea eax, [esp + 0x1b4]
push eax
lea ecx, [esp + 0x4c]
call fcn.00404720
push 0x100
lea eax, [esp + 0x1b8]
mov byte [esp + 0x3c4], 0x12
push eax
push str.RestoreEndCaption
mov ecx, 0x6b4f34
call fcn.00439d00
lea eax, [esp + 0x1b4]
push eax
lea ecx, [esp + 0x48]
call fcn.00404720
push 0x1040
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c4], 0x13
call fcn.00404880
push eax
lea ecx, [esp + 0x50]
call fcn.00404880
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x6b4960
call fcn.0043e700
test al, al
jne 0x45475a
mov ecx, 0x6b4e10
call fcn.0043c990
push eax
lea ecx, [esp + 0x68]
call fcn.00407630
lea ecx, [esp + 0x64]
mov byte [esp + 0x3c0], 0x14
call fcn.004108f0
push eax
lea ecx, [esp + 0x14]
call fcn.00404720
push 0x651e48
push str._clsid_
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c8], 0x15
call fcn.004095d0
push 0x651e48
push str._typelib_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._mshared_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._startup_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._interface_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._uninst_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._mui_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._apppath_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._mfiles_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._wboost_
lea ecx, [esp + 0x18]
call fcn.004095d0
push 0x651e48
push str._iboost_
lea ecx, [esp + 0x18]
call fcn.004095d0
lea ecx, [esp + 0x10]
call fcn.00404880
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00407630
mov ecx, 0x6b4e10
call fcn.0043c9f0
mov ecx, 0x6b4a68
call fcn.0043d0d0
lea ecx, [esp + 0x10]
call fcn.00404e10
lea ecx, [esp + 0x64]
call fcn.00406f10
lea ecx, [esp + 0x44]
call fcn.00404e10
lea ecx, [esp + 0x48]
call fcn.00404e10
lea ecx, [esp + 0x3c8]
call fcn.00406f10
mov ecx, dword [esp + 0x3b8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3b4
ret 0x18