Function at 0x42a200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7658
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xac], 0
mov ecx, dword [0x545d90]
mov dword [ebp - 0xc4], ebx
lea esi, [ecx + 2]
lea eax, [ecx + 1]
imul eax, esi
imul eax, ecx
cdq
mov ecx, 0xa
idiv ecx
cmp edx, 2
jne 0x42a271
call fcn.004aff67
mov dword [0x545d90], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0xb4]
push eax
push 0x18
call fcn.00423a30
mov edx, esi
mov ecx, eax
call fcn.00436680
test eax, eax
je 0x42a526
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0xb8]
push eax
push 0
push 0
push 0x19
push dword [ebp - 0xb4]
call ebx
test eax, eax
jne 0x42a403
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42a403
push dword [ebp - 0xb8]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x42a403
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xb8]
push esi
push 0x19
push dword [ebp - 0xb4]
call ebx
test eax, eax
je 0x42a3fc
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov al, byte [eax]
dec al
movzx eax, al
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [eax]
cmp ecx, 0x2000
jae 0x42a356
mov ecx, dword [ebp - 0xa8]
push str.Low_Integrity
mov dword [edi], 1
call fcn.00403560
mov dword [ebp - 4], 0
mov dword [ebp - 0xac], 1
mov eax, dword [ebp - 0xa8]
jmp 0x42a585
cmp ecx, 0x3000
jae 0x42a3b4
push str.Mediu
lea ecx, [ebp - 0xb0]
mov dword [edi], 2
call fcn.004025a0
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0xa8]
push str.m_Integrity
mov edx, eax
call fcn.00418660
add esp, 4
mov dword [ebp - 0xac], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.00402650
mov eax, dword [ebp - 0xa8]
jmp 0x42a585
mov ecx, dword [0x545d90]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ecx, 0x18
idiv ecx
mov dword [edi], 3
cmp edx, 6
jne 0x42a3e7
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ecx, dword [ebp - 0xa8]
push str.High_Integrity
call fcn.00403560
jmp 0x42a33a
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [0x545d90]
lea eax, [ebx + 1]
imul eax, ebx
and eax, 0x80000003
jns 0x42a427
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
jne 0x42a4b5
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, ebx
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, ebx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, ebx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, ebx
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, ebx
sar ecx, 1
xor eax, ecx
inc edx
add ebx, eax
cmp edx, 0x100
jl 0x42a432
mov dword [0x545d90], ebx
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0x15
idiv ecx
cmp edx, 0xe
jne 0x42a520
xor ecx, ecx
mov dword [ebp - 0xb0], ecx
lea edi, [ebp - 0xa0]
lea esp, [esp]
xor esi, esi
mov eax, ebx
inc esi
cdq
xor ecx, ecx
idiv esi
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xc0], edx
lea esi, [ecx + 1]
mov ecx, esi
cmp ecx, 0xe
jl 0x42a4f6
mov esi, dword [ebp - 0xbc]
add edi, 0xe
cmp esi, 5
jl 0x42a4e2
mov ecx, dword [ebp - 0xb0]
inc ecx
mov dword [ebp - 0xb0], ecx
cmp ecx, 2
jl 0x42a4e0
mov ebx, dword [ebp - 0xa8]
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 2
mov eax, 0x522eb8
test eax, 0xffff0000
jne 0x42a564
movzx esi, ax
mov ecx, esi
call fcn.00401b90
test eax, eax
je 0x42a572
push esi
push eax
mov ecx, ebx
call fcn.00402a00
jmp 0x42a572
push 1
push 0x522eb8
mov ecx, ebx
call fcn.00402790
mov dword [ebp - 4], 0
mov dword [ebp - 0xac], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af5ba
mov esp, ebp
pop ebp
ret