Function at 0x5a0ad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7a774a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2b0
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x174], esi
mov dword [ebp - 0x13c], esi
push edx
push 0
mov dword [ebp - 0x13c], esi
push 0x400
mov dword [ebp - 0x170], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x5a0b4d
mov ecx, esi
call fcn.0041f450
jmp 0x5a0e52
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x24], 0x7d76e0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], 0
push ecx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x5a0ba0
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call dword [eax + 4]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x20], eax
push 0x60
lea eax, [ebp - 0x138]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x138]
call fcn.0041f450
lea eax, [ebp - 0x138]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x24]
call fcn.0041fd10
test al, al
jne 0x5a0df3
push 0xb0
lea eax, [ebp - 0xd8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xd8], 0x7d6f90
lea ecx, [ebp - 0x70]
mov dword [ebp - 0xc8], 0x7d7228
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void_]
push 0
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x170], 2
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t____]
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xd8], 0x7c81a4
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xdc], eax
lea ecx, [ebp - 0xc0]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void_]
mov dword [ebp - 0xc0], 0x7c8164
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x16c], 0x15
mov dword [ebp - 0x168], 0xc500dd
mov dword [ebp - 0x164], 0xc900c0
mov dword [ebp - 0x160], 0x8000c3
mov dword [ebp - 0x15c], 0xd500e8
mov dword [ebp - 0x158], 0xe700c5
mov dword [ebp - 0x154], 0xd100c0
mov dword [ebp - 0x150], 0x9a00c7
mov dword [ebp - 0x14c], 0xdd0097
mov dword [ebp - 0x148], 0xc800cb
mov dword [ebp - 0x144], 0xce00d4
mov dword [ebp - 0x140], 0xbe009d
nop word [eax + eax]
lea ecx, [eax + 0xa9]
xor word [ebp + eax*2 - 0x168], cx
inc eax
mov ecx, dword [ebp - 0x16c]
cmp eax, ecx
jb 0x5a0d10
xor eax, eax
mov word [ebp + ecx*2 - 0x168], ax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00404740
add esp, 8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
call fcn.004345f0
mov edi, eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.005a0fc0
mov ecx, eax
call fcn.00403e20
mov esi, eax
lea eax, [ebp - 0x218]
push eax
call fcn.005a0e80
mov ecx, eax
call fcn.00403e20
lea ecx, [ebp - 0xd8]
push ecx
push esi
push 0x1d
push eax
push 0
mov ecx, edi
call fcn.00469f50
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xd8], 0x7c81a4
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xdc], eax
lea ecx, [ebp - 0xc0]
call fcn.004073e0
lea ecx, [ebp - 0xb8]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov esi, dword [ebp - 0x174]
mov ecx, esi
call fcn.0041f450
jmp 0x5a0e01
lea eax, [ebp - 0x138]
mov ecx, esi
push eax
call fcn.00416320
lea ecx, [ebp - 0x138]
call fcn.00416250
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0x7d76e0
test ecx, ecx
je 0x5a0e33
test eax, eax
je 0x5a0e2c
push ecx
push eax
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x5a0e45
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
push 4
push dword [ebp - 0x18]
call fcn.0076e8f3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret