Function at 0x415f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x66b9a8
push 0x483300
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x676314]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
call fcn.0047337c
test al, al
je 0x415ff2
or al, 0x89
inc ebp
shr al, 1
test al, 0xd3
add eax, 0x74c08400
sbb dh, byte [eax + 0x12]
jo 0x415fec
jno 0x416047
cwde
int 0xf0
xchg byte [edi], bh
jmp 0x415fcb
cwde
ror byte [esi], 1
xchg ebx, eax
add bh, byte [edx]
call fcn.0047355f
test al, al
je 0x416011
mov eax, dword [0x895016b3]
mov al, byte [0x756bb416]
push edx
mov eax, dword [0x2f10485a]
and eax, 0xe2f877a1
sub al, 0xbf
aam 5
add byte [eax + eax*8 - 0x62e6e78c], al
lodsb al, byte [esi]
lodsd eax, dword [esi]
xlatb
jne 0x41600e
clc
loop 0x415f91
call fcn.004734d5
test al, al
je 0x416032
sbb dword [ebp + 0x75d7adac], ebx
in eax, dx
sbb eax, 0xd2466a1f
aas
invalid
call fcn.00473925
test al, al
je 0x416055
cmp dword [ebx - 0x79cd3749], eax
movsb byte es:[edi], byte [esi]
sbb dh, cl
popfd
push edi
lodsb al, byte [esi]
out dx, eax
mov dl, 0x80
aad 0xc7
in al, dx
jmp 0x416079
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x50], 0
add byte [eax], al
add byte [eax], al
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x54], 0
call fcn.00473856
test al, al
je 0x41608c
adc bh, dh
dec edi
cwde
dec byte [edi - 0x68]
sub al, 0x56
mov esi, 0xc0c10c49
jnp 0x41605f
clc
salc
mov al, byte [0xc74eb4e2]
inc ebp
mov ah, 0
add byte [eax], al
add bh, al
inc ebp
mov eax, 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
call fcn.00473337
test al, al
je 0x4160c0
add dword [edx - 0x462b721b], 0x31
xchg edi, eax
xor al, 0x6c
sub al, 0x3f
std
inc esi
imul edx, dword [ebp + esi*8 - 0x448c5dd], 0x1f2ddeb9
scasb al, byte es:[edi]
add esi, ebp
mov ah, 0xe8
scasb al, byte es:[edi]
aad 5
add byte [eax + eax*8 - 0x685ee68c], al
push ds
mov dh, 0x82
call fcn.00473673
test al, al
je 0x4160e2
mov eax, dword [0x82b61e97]
cmp eax, 0x28d69735
out 0x78, al
jno 0x4160aa
cwde
mov ecx, 0x9b14a023
mov dh, 0xce
mov byte [ecx], dl
shr al, cl
test eax, 0x840005d3
sal byte [eax + ebx - 0xa], 0x15
hlt
call fcn.00473490
test al, al
je 0x416103
not byte [0xae2bd3f4]
cmp al, ch
mov eax, dword [0x7e1bea61]
nop
dec edx
movsb byte es:[edi], byte [esi]
enter 0x47dd, 0xffffffffffffffbf
call 0xe8b311ec
inc ebx
rol dword [0x74c08400], cl
adc byte [ebx + 0x13e1d38b], dh
les eax, [ecx + 0x487101d3]
push ecx
call fcn.0047344b
test al, al
je 0x41611c
mov bl, 0x8b
shl ecx, cl
adc eax, esp
adc ebx, 0x51487101
arpl word [esi], si
into
mov es, edi
inc ebp
les eax, [eax]
add byte [eax], al
add bh, al
inc ebp
int3
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
call fcn.00473925
test al, al
je 0x41614e
stosd dword es:[edi], eax
push 0xffffffffffffff8d
sbb cl, byte [esi - 0x34cc45e6]
xor ecx, ebx
sub byte [ecx - 0x3a], bl
mov al, 0x12
dec edi
sahf
xor edx, ebp
invalid
call fcn.004732f2
test al, al
je 0x41616f
leave
pop esi
mov bh, 0xd1
dec edi
jg 0x41616f
stosb byte es:[edi], al
std
test al, 0x18
or esp, dword [edx]
frstor dword [bx + si - 0x73ab]
sar eax, 1
in al, dx
pushfd
mov ch, al
cmp ebx, eax
add eax, 0x74c08400
adc al, 0x7b
sub byte [ecx + 0x3719025c], al
scasb al, byte es:[edi]
push edx
and byte [esi + 0x34], dl
mov al, 0x72
mov bl, 0x19
xor ecx, edi
cli
pop edx
call fcn.004739af
test al, al
je 0x41618c
jnp 0x4161a2
sbb dword [edx + eax + 0x19], 0x2052ae37
push esi
xor al, 0xb0
jb 0x41613a
sbb dword [ebx], esi
iretd
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
call fcn.00473856
test al, al
je 0x4161c2
pop ds
invalid
call fcn.00473337
test al, al
je 0x4161e7
mov dl, 0xb7
pop eax
push ecx
inc ebx
xor byte [edx], 0x28
hlt
das
nop
mov al, 0xc3
xchg esi, eax
rol dword [esi - 0x1cafab5], cl
call 0xdf300f60
ljmp 0x8400
call fcn.004733c1
test al, al
je 0x416206
xor eax, 0x60a6f8f0
jp 0x416210
push eax
invalid
mov dword [ebp - 0x60], 0
call fcn.0047337c
test al, al
je 0x41622d
add eax, 0x74c08400
pop ss
mov ebx, 0x43536f4b
sbb bl, byte [esi - 0x777a10b6]
adc al, 0xe4
invalid
mov dword [ebp - 4], 0
call fcn.00473925
test al, al
je 0x416256
cld
mov word [ecx + 0x78], es
sbb byte [edi - 0x52], bh
push ebx
mov eax, 0xc02f714f
loopne 0x41627c
add eax, esp
xor dword [esi - 0x78], ebx
jp 0x4161d5
mov eax, 0xa2e885a7
aam 5
add byte [eax + eax*8 + 0x31211974], al
call fcn.004736fd
test al, al
je 0x416278
and dword [ecx], esi
lodsb al, byte [esi]
fsub dword [edi - 7]
mov bl, 0xac
loope 0x4162b7
push 0xffffffffffffffac
cmp eax, 0x85395fa8
aad 0x24
in eax, dx
cmpsb byte [esi], byte es:[edi]
mov al, 0x1e
retf
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push 0
push dword [ebp - 0x30]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x416ae7
test dword [eax + ecx], ecx
add byte [ebx + 0x5e81301d], cl
add bh, bh
rol dword [ebx + 0x15747af8], cl
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
je 0x4162bd
call ebx
push eax
push str.LookupAccountName___failed._Error__d_n
call fcn.00416c00
add esp, 8
jmp 0x416ae7
or cl, ch
sub cl, byte [eax]
add byte [eax], al
call fcn.004732ad
test al, al
je 0x4162df
sbb eax, 0xf51334df
inc edx
nop
jle 0x416274
mov eax, 0x9d0ed1d4
imul esi, dword [edi - 0x61], 0x53d843c2
mov ch, 0xc6
notrack call fcn.00473742
call fcn.00473742
test al, al
je 0x4162ff
or al, 0xc1
or ebp, ebx
les esp, [edx - 0x1e]
jne 0x4162b9
xor al, 0xea
sub dword [eax + 0x4e], esi
adc byte [edx + 4], cl
mov al, byte [0xcc0e1809]
pop ds
call fcn.004732ad
test al, al
je 0x41631f
ja 0x416345
lodsd eax, dword [esi]
mov eax, dword [0xb4f9d30]
jo 0x416296
xor al, 0x28
sub edi, dword [eax]
mov ebx, dword [eax + 6]
test eax, 0x4c155f9d
push dword [ebp - 0x54]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x416352
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.HeapAlloc___failed._Error__d_n
call fcn.00416c00
add esp, 8
jmp 0x416ae7
call fcn.0047362e
test al, al
je 0x41637b
and byte [ebx - 0x43e0fb21], dl
cmp cl, 0xf8
wait
das
mov cl, 0xb
arpl word [ebx + 0xc], si
push 0x411f873d
mov edi, 0x3e50a98
xor ebx, 0xfffffff4
push edi
das
aad 0xe8
lcall 0x74c0, 0x840005d1
pop ss
call fcn.0047351a
test al, al
je 0x41639b
rcl byte [ebp + esi*4 + 0x59dc53e5], cl
sal byte [edx - 5], 1
mov ah, 0x10
mov byte [ebx + 0x28], bh
das
invalid
call fcn.004733c1
test al, al
je 0x4163bb
and eax, dword [eax]
mov bl, byte [eax - 0x40]
ror byte [edx + 0x64ec2ca9], 1
adc eax, 0x470034ca
outsb dx, byte [esi]
movsd dword es:[edi], dword [esi]
sbb bh, byte [ebp + 0x458b9236]
mov al, 3
rcl byte [eax + 0x6a], 8
mov eax, dword [ebp - 0x50]
add eax, eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
adc eax, sym.imp.KERNEL32.dll_HeapAlloc
mov esi, eax
mov dword [ebp - 0x5c], esi
test esi, esi
je 0x416338
call fcn.0047337c
test al, al
je 0x416403
cwde
fcomp st(6)
mov ecx, 0x61d9806f
push ss
fbld tbyte [edx + 0x20bcb09]
das
mov ebx, 0x210740ab
push ebp
pop esi
out dx, al
mov esi, dword [ebp - 0x5c]
call fcn.004736b8
test al, al
je 0x41641d
sub eax, esi
jle 0x416448
adc eax, eax
sub al, 0xe9
cli
pop ebp
mov ebx, 0x7d89c7ef
invalid
call fcn.00473742
test al, al
je 0x41643d
jo 0x4163cb
dec edi
into
mov ebx, 0x6b914070
imul ebx, dword [esi - 0x2297d156], 0xa372808c
bsf edx, dword [ebx]
test dword [ebp - 0x72af67bb], 0x5650b045
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp - 0x54]
lodsb al, byte [esi]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x41646e
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.LookupAccountName___failed._Error__d_n
jmp 0x416345
call fcn.00473856
test al, al
je 0x416489
js 0x416463
mov ss, word [ebx + 0x37]
mov bl, 0x3e
sub byte [ebx], cl
test byte [esi - 0x54], dh
stosb byte es:[edi], al
pushfd
imul ecx, dword [0x458d96d9], 0xffffffb8
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 4
mov edi, dword [ebp - 0x58]
push edi
mov esi, dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
call esi
test eax, eax
jne 0x416ae7
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
je 0x4164c1
call ebx
push eax
push str.GetFileSecurity___failed._Error__d_n
jmp 0x416345
call fcn.0047344b
test al, al
je 0x4164e3
pcmpeqw mm4, mm6
salc
or bh, byte [ecx - 0x760285bd]
adc cl, dh
push 0x8b577dab
xor eax, sym.imp.ADVAPI32.dll_GetFileSecurityW
mov edi, dword [ebp - 0x58]
push dword [ebp - 0x48]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x416503
call ebx
jmp 0x41633f
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x48]
push eax
push 4
push edi
call esi
test eax, eax
jne 0x416521
call ebx
push eax
push str.GetFileSecurity___failed._Error__d_n
jmp 0x416345
pop esi
add cl, ch
and al, 0xfe
invalid
call fcn.00473925
test al, al
je 0x416545
jl 0x41651a
sbb al, 0xe6
dec esp
mov edi, 0x85aed6bf
test bl, bl
pop es
xchg ebx, eax
out 0xa1, al
and al, 0x64
aas
pop edi
jl 0x416568
call 0xe903aaaa
test al, 0xcd
add eax, 0x74c08400
sbb byte [esi + 0xc], cl
pop ecx
call fcn.004732f2
test al, al
je 0x416566
dec esi
or al, 0x59
push ecx
ror dword [esp + edx*8 - 0x4d], 1
sub byte [ecx + 0x17ca8f18], cl
or dword [esi], ebx
mov bl, 0xc4
int1
outsd dx, dword [esi]
invalid
call fcn.004739af
test al, al
je 0x416583
aam 5
add byte [eax + eax*8 - 0x5d40eb8c], al
mov ebp, 0x124a88fc
or byte [edi + 0x77], dh
mov edi, 0x88fcbda2
dec edx
adc cl, byte [eax]
ja 0x4165f0
adc eax, 0x28f35d06
dec ebp
ficom dword [0x16ac498]
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x4165a8
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.InitializeSecurityDescriptor___failed.Error__d_n
jmp 0x416345
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x4165d3
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.GetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x416345
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp dword [ebp - 0x3c], ecx
cmove eax, ecx
mov dword [ebp - 0x38], eax
call fcn.0047337c
test al, al
je 0x416616
adc dl, al
stc
scasd eax, dword es:[edi]
xor esi, ebp
mov dl, 0x44
adc ah, ah
cmc
jmp 0x5554978e
cmp dword [ebp - 0x38], 0
je 0x416643
push 2
push 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x416643
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.GetAclInformation___failed._Error__d_n
jmp 0x416345
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [ebp - 0x24]
add esi, 8
add esi, eax
mov dword [ebp - 0x30], esi
call fcn.00473925
test al, al
je 0x41667c
pop esi
add byte [ebx - 0x397c238b], cl
or byte [ebx], al
invalid
rol byte [0x74c08400], cl
sbb al, 0x1c
jnp 0x416692
sbb al, 0x7b
das
dec eax
add ecx, dword [esi]
jb 0x416659
jno 0x41664a
int 0x42
xchg ebx, eax
mov byte [edx + 0x5bd32f72], bl
invalid
call fcn.004736fd
test al, al
je 0x41669e
sub esi, dword [edi]
aaa
sub byte [edx - 0x553244fd], 0x1d
xchg ecx, eax
dec ebx
nop
sub bl, dl
sbb al, ch
jp 0x416686
rcr dword [edx], cl
lds edi, [edx - 0x11]
mov eax, 0xa466886c
or eax, 0x86a568f
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x34], edi
add byte [ebx - 0x33827608], cl
test edi, edi
je 0x416338
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x4166db
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.InitializeAcl___failed._Error__d_n
jmp 0x416345
call fcn.004732ad
test al, al
je 0x4166fd
push es
in eax, dx
imul ecx, dword [ecx + 0xa], 0x70
cmp al, 0x6d
js 0x4166d6
push ebx
inc ebx
outsb dx, byte [esi]
fistp word [0x1190c09f]
retf
call fcn.00473742
test al, al
je 0x41671d
jns 0x416749
in al, dx
pushal
push edx
xchg dword [eax], edx
and dword [ebx], ecx
add byte [edi + ebp*8 + 0x185da5ee], cl
jecxz 0x4166ad
invalid
call fcn.004732ad
test al, al
je 0x41673d
mov ecx, 0xa6b7cf3
out 0x26, eax
mov esp, 0x2da0713
mov cl, 0xae
push eax
ror dword [ebp - 0x4f], cl
mov esi, 0xab872d74
xor esi, esi
mov dword [ebp - 0x6c], esi
cmp dword [ebp - 0x38], esi
je 0x4167db
add byte [eax], al
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4167db
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x44], ebx
cmp ebx, eax
jae 0x4167db
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x41678c
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.GetAce___failed._Error__d_n
jmp 0x416345
mov eax, dword [ebp - 0x40]
test byte [eax + 1], 0x10
jne 0x4167db
add eax, 8
push eax
push dword [ebp - 0x2c]
call edi
test eax, eax
jne 0x4167d2
mov ecx, dword [ebp - 0x40]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x4167ce
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.AddAce___failed._Error__d_n
jmp 0x416345
inc esi
mov dword [ebp - 0x6c], esi
inc ebx
mov dword [ebp - 0x64], ebx
mov eax, dword [ebp - 0x28]
jmp 0x416761
call fcn.0047362e
test al, al
je 0x416804
jmp 0xb8f01fd9
call fcn.0047351a
test al, al
je 0x416824
rcr esi, cl
inc eax
xor bh, byte [ebp + 0x37]
push ecx
in eax, dx
pop ebp
ret
call fcn.004733c1
test al, al
je 0x416844
test eax, 0xe6a41cb8
int 0xb1
retf 0xaa60
push str.AddAccessAllowedAceEx
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
push dword [ebp + 0x10]
test eax, eax
je 0x416885
push 3
push 2
push edi
call eax
test eax, eax
jne 0x4168a4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.AddAccessAllowedAceEx___failed._Error__d_n
jmp 0x416345
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x4168a4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.AddAccessAllowedAce___failed._Error__d_n
jmp 0x416345
cmp dword [ebp - 0x38], 0
je 0x41690f
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41690f
mov ebx, dword [ebp - 0x44]
cmp ebx, eax
jae 0x41690f
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x4168dc
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.GetAce___failed._Error__d_n
jmp 0x416345
mov ecx, dword [ebp - 0x40]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x416906
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.AddAce___failed._Error__d_n
jmp 0x416345
invalid
inc dword [ebx - 0x77]
pop ebp
pushfd
inc ebx
mov dword [ebp - 0x64], ebx
mov eax, dword [ebp - 0x28]
jmp 0x4168b4
call fcn.00473337
test al, al
je 0x416935
daa
inc ebp
push cs
cwde
out 0x5e, al
sub dword [edi - 0x31], edx
sti
cld
inc ebx
jge 0x416916
cmp al, 0x7b
jb 0x416905
aam 0xb8
inc ebx
jae 0x416904
invalid
call fcn.00473673
test al, al
je 0x416957
mov cl, 0x83
sub dword [esi], ebp
xchg ebp, eax
cmp ch, bh
add eax, eax
adc dword [ecx], eax
loop 0x4169aa
sub eax, 0x7aef6d46
pop ds
ror dword [edi], 0x15
invalid
call fcn.00473490
test al, al
je 0x416978
test edx, edx
add al, 0xa1
retf 0x8972
push 0
push dword [ebp - 0x34]
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x4169a2
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.SetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x416345
push str.SetSecurityDescriptorControl
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
pop esi
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x416a32
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x4169f4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.GetSecurityDescriptorControl___failed.Error__d_n
jmp 0x416345
invalid
mov eax, dword [ebp - 0x30]
test eax, 0x400
je 0x416a05
mov eax, 0x500
jmp 0x416a11
test eax, 0x1000
je 0x416a32
mov eax, 0x1000
push eax
push eax
lea eax, [ebp - 0x84]
push eax
call esi
test eax, eax
jne 0x416a32
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.SetSecurityDescriptorControl___failed.Error__d_n
jmp 0x416345
call fcn.0047337c
test al, al
je 0x416a55
add byte [edi], ch
xor ecx, edi
wait
jge 0x416a12
lss esi, [bx + si]
inc ebx
leave
push 0x9ad4097e
add eax, 0xd76067d4
retf 0x9dc
call fcn.0047355f
test al, al
je 0x416a74
sub bl, byte [eax]
adc edi, dword [ebx + 0x34ecc71]
push ds
into
in eax, 0xf7
mov al, byte [0x2312ab9a]
jmp 0x4169f2
call fcn.004734d5
test al, al
je 0x416a95
pop eax
mov cl, 0x81
ror byte [ebx + 0x79fe5519], 0xd4
sahf
push ebx
rcr dword [ecx + 0x3c], 1
ret 0xcfd4
call fcn.00473925
test al, al
je 0x416ab8
mov dh, 0x15
fdivrp st(5)
inc esi
out 0xdf, eax
dec ecx
hlt
lea eax, [ebp - 0x84]
push eax
push 4
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x416ae0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str.SetFileSecurity___failed._Error__d_n
jmp 0x416345
clc
invalid
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.00416b7d
call fcn.0047362e
test al, al
je 0x416b1c
mov esp, 0x1eaf95e0
insb byte es:[edi], dx
adc eax, dword [ebx + edx*4]
and eax, ecx
mov eax, dword [0x97425e93]
jmp 0x416b62
call fcn.0047351a
test al, al
je 0x416b3c
invalid
call fcn.004733c1
test al, al
je 0x416b5c
jg 0x416adc
wait
mov esp, 0x2fddaf4f
cdq
pop ss
in al, 0x55
ret
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 0xc