Function at 0x4cedb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov eax, dword [eax]
xor esi, esi
mov dword [ebp - 0x428], esi
push edi
test eax, eax
je 0x4cf515
lea ecx, [ebp - 0x428]
push ecx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4cf504
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x4cf515
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], esi
push ecx
push esi
push esi
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4cee32
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4cf504
push dword [ebp - 0x424]
call fcn.0053ac46
mov edi, eax
add esp, 4
test edi, edi
je 0x4cf504
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x424]
push edi
push 1
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4cf4fb
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jne 0x4ceeb1
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], esi
push eax
push dword [edi]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov ecx, ebx
mov esi, eax
call fcn.00468a00
push dword [ebp - 0x42c]
mov ecx, ebx
call fcn.004be550
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4cf4fb
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0053e0b0
xor eax, eax
mov dword [ebp - 0x418], 0x104
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.0053e0b0
add esp, 0x18
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [edi]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x4cf4fb
mov dword [ebp - 0x638], 0x456b5147
mov dword [ebp - 0x634], 0x6f303348
mov dword [ebp - 0x630], 0x2f4d4744
mov dword [ebp - 0x62c], 0x51383346
mov dword [ebp - 0x628], 0x3438424e
mov dword [ebp - 0x624], 0x7141774a
mov dword [ebp - 0x620], 0x63384141
mov dword [ebp - 0x61c], 0x62455345
mov dword [ebp - 0x618], 0x67527a46
mov dword [ebp - 0x614], 0x7a706e65
mov dword [ebp - 0x610], 0x64634363
mov dword [ebp - 0x60c], 0x4e634246
mov dword [ebp - 0x608], 0x2b416a44
mov dword [ebp - 0x604], 0x7a467841
mov dword [ebp - 0x600], 0x5a34444c
mov dword [ebp - 0x5fc], 0x6459774d
mov dword [ebp - 0x5f8], 0x37524164
mov dword [ebp - 0x5f4], 0x61515346
mov dword [ebp - 0x5f0], 0x2f467946
mov dword [ebp - 0x5ec], 0x446b7844
mov dword [ebp - 0x5e8], 0x4d675849
mov dword [ebp - 0x5e4], 0x306b4447
mov dword [ebp - 0x5e0], 0x36513242
mov dword [ebp - 0x5dc], 0x3834684a
mov dword [ebp - 0x5d8], 0x42415241
mov dword [ebp - 0x5d4], 0x526b7863
mov dword [ebp - 0x5d0], 0x6745434e
mov dword [ebp - 0x5cc], 0x62734447
mov dword [ebp - 0x5c8], 0x72345347
mov dword [ebp - 0x5c4], 0x61777843
mov dword [ebp - 0x5c0], 0x68524148
mov dword [ebp - 0x5bc], 0x76675849
mov dword [ebp - 0x5b8], 0x6b51774d
mov dword [ebp - 0x5b4], 0x7345435a
mov dword [ebp - 0x5b0], 0x63386864
mov dword [ebp - 0x5ac], 0x49775164
mov dword [ebp - 0x5a8], 0x67554841
mov dword [ebp - 0x5a4], 0x62593245
mov dword [ebp - 0x5a0], 0x6967514f
mov dword [ebp - 0x59c], 0x58517763
mov dword [ebp - 0x598], 0x6c5a474d
mov dword [ebp - 0x594], 0x536f334a
mov dword [ebp - 0x590], 0x6e59684c
mov dword [ebp - 0x58c], 0x77555245
mov dword [ebp - 0x588], 0x63736966
mov dword [ebp - 0x584], 0x786b684a
mov dword [ebp - 0x580], 0x36496a44
mov dword [ebp - 0x57c], 0x6c64474c
mov dword [ebp - 0x578], 0x43735765
mov dword [ebp - 0x574], 0x32386944
mov dword [ebp - 0x570], 0x35314150
mov dword [ebp - 0x56c], 0x79527a43
mov dword [ebp - 0x568], 0x6c6f7865
mov dword [ebp - 0x564], 0x55515842
mov dword [ebp - 0x560], 0x2b387842
mov dword [ebp - 0x55c], 0x39525164
mov dword [ebp - 0x558], 0x6839424c
mov dword [ebp - 0x554], 0x79636961
mov dword [ebp - 0x550], 0x5959525a
mov dword [ebp - 0x54c], 0x3235444b
mov dword [ebp - 0x548], 0x67426a63
mov dword [ebp - 0x544], 0x34516761
mov dword [ebp - 0x540], 0x4149325a
mov dword [ebp - 0x53c], 0x56553349
mov dword [ebp - 0x538], 0x66676e42
mov dword [ebp - 0x534], 0x486b6a64
mov dword [ebp - 0x530], 0x2b305164
mov dword [ebp - 0x52c], 0x6e526d44
mov dword [ebp - 0x528], 0x3441674d
mov dword [ebp - 0x524], 0x364d5342
mov dword [ebp - 0x520], 0x53635363
mov dword [ebp - 0x51c], 0x656b6761
mov dword [ebp - 0x518], 0x68674448
mov dword [ebp - 0x514], 0x574d7847
mov dword [ebp - 0x510], 0x72344441
mov dword [ebp - 0x50c], 0x47454142
mov dword [ebp - 0x508], 0x72596e63
mov dword [ebp - 0x504], 0x41636d46
mov dword [ebp - 0x500], 0x6b41535a
mov dword [ebp - 0x4fc], 0x59554347
mov dword [ebp - 0x4f8], 0x6b315150
push 0
sub esp, 0xc
mov dword [ebp - 0x4f4], 0x34784350
mov ecx, esp
mov dword [ebp - 0x4f0], 0x684a7950
lea eax, [ebp - 0x42d]
mov dword [ebp - 0x4ec], 0x4b456959
lea edx, [ebp - 0x48e]
mov dword [ebp - 0x4e8], 0x4c73784e
push eax
push edx
lea esi, [ebp - 0x638]
mov dword [ebp - 0x4e4], 0x6e675464
push esi
mov dword [ebp - 0x4e0], 0x394a7847
mov dword [ebp - 0x4dc], 0x6c5a5162
mov dword [ebp - 0x4d8], 0x42634447
mov dword [ebp - 0x4d4], 0x4b6f7765
mov dword [ebp - 0x4d0], 0x5241534c
mov dword [ebp - 0x4cc], 0x6b514245
mov dword [ebp - 0x4c8], 0x4e514248
mov dword [ebp - 0x4c4], 0x4d517a44
mov dword [ebp - 0x4c0], 0x34555143
mov dword [ebp - 0x4bc], 0x2f344866
mov dword [ebp - 0x4b8], 0x4f496a48
mov dword [ebp - 0x4b4], 0x6a64414c
mov dword [ebp - 0x4b0], 0x4b736966
mov dword [ebp - 0x4ac], 0x4f6f7765
mov dword [ebp - 0x4a8], 0x2b673342
mov dword [ebp - 0x4a4], 0x4a775359
mov dword [ebp - 0x4a0], 0x67774148
mov dword [ebp - 0x49c], 0x79643344
mov dword [ebp - 0x498], 0x78313350
mov dword [ebp - 0x494], 0x42414141
mov word [ebp - 0x490], 0x514f
call fcn.004676d0
lea eax, [ebp - 0x644]
push eax
call fcn.00480790
add esp, 0x10
mov ecx, eax
call fcn.0046bf80
push eax
mov ecx, ebx
call fcn.00467e70
lea ecx, [ebp - 0x644]
call fcn.00467b80
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.004b87f0
push 0
sub esp, 0xc
mov dword [ebp - 0x48c], 0x2b455347
lea eax, [ebp - 0x42d]
mov dword [ebp - 0x488], 0x3535584e
mov ecx, esp
mov dword [ebp - 0x484], 0x6a344866
mov dword [ebp - 0x480], 0x30595266
lea esi, [ebp - 0x48c]
mov dword [ebp - 0x47c], 0x4e6b434e
lea edx, [ebp - 0x430]
mov dword [ebp - 0x478], 0x3355434d
mov dword [ebp - 0x474], 0x366c5365
mov dword [ebp - 0x470], 0x50494244
mov dword [ebp - 0x46c], 0x67305749
mov dword [ebp - 0x468], 0x6e6b7763
mov dword [ebp - 0x464], 0x6b464441
mov dword [ebp - 0x460], 0x34305241
mov dword [ebp - 0x45c], 0x3051684a
mov dword [ebp - 0x458], 0x79634842
mov dword [ebp - 0x454], 0x5038424a
mov dword [ebp - 0x450], 0x51776763
mov dword [ebp - 0x44c], 0x31304346
mov dword [ebp - 0x448], 0x4755474c
mov dword [ebp - 0x444], 0x77735747
mov dword [ebp - 0x440], 0x5945674e
mov dword [ebp - 0x43c], 0x6e387a41
mov dword [ebp - 0x438], 0x416b5443
mov dword [ebp - 0x434], 0x41424141
push eax
push edx
push esi
call fcn.004676d0
lea eax, [ebp - 0x644]
push eax
call fcn.00480790
add esp, 0x10
mov ecx, eax
call fcn.0046bf80
push eax
mov ecx, ebx
call fcn.004b87f0
lea ecx, [ebp - 0x644]
call fcn.00467b80
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.004b87f0
mov esi, 1
push edi
call fcn.0053c1e0
add esp, 4
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x4cf515
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret