Function at 0x4d07c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe5be
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x55a064]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x290], ecx
lea ecx, [ebp - 0x2b0]
push ecx
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov dword [ebp - 0x29c], eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4d0b2f
lea edx, [ebp - 0x29c]
lea ecx, [ebp - 0x2c]
call fcn.004d6f10
mov esi, 0x56b700
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x29c], esi
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x4d0856
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov edi, 0x811c9dc5
mov ebx, dword [ebp - 0x1c]
cmovae edx, dword [ebp - 0x2c]
xor ecx, ecx
test ebx, ebx
je 0x4d0884
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4d0873
push edi
lea eax, [ebp - 0x2c]
mov ecx, 0x56b6e0
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.0047a830
mov eax, dword [ebp - 0x294]
test eax, eax
je 0x4d08ab
xor dl, dl
jmp 0x4d0995
cmp dword [0x56b6e8], 0x71c71c7
jne 0x4d08c2
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x2a8], 0x56b6e4
mov byte [ebp - 4], 2
push 0x24
mov dword [ebp - 0x2a4], 0
call fcn.004e9270
add esp, 4
lea ecx, [ebp - 0x2c]
mov ebx, eax
mov dword [ebp - 0x2a4], ebx
push ecx
lea ecx, [ebx + 8]
call fcn.00415750
mov dword [ebx + 0x20], 0
mov byte [ebp - 4], 3
mov eax, dword [0x56b6e8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5286e0]
mov eax, dword [0x56b6fc]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5286e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x56b6e0]
seta al
test al, al
je 0x4d097d
mov ecx, 0x56b6e0
call fcn.00485fa0
push edi
lea eax, [ebx + 8]
mov ecx, 0x56b6e0
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.0047a830
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x294], eax
jmp 0x4d0983
mov ecx, dword [ebp - 0x298]
push ebx
push ecx
push edi
mov ecx, 0x56b6e0
call fcn.00486000
mov dl, 1
mov byte [ebp - 4], dl
mov ebx, dword [ebp - 0x290]
lea edi, [eax + 0x20]
xor ecx, ecx
mov dword [ebp - 0x298], eax
test ebx, ebx
mov byte [ebp - 0x294], dl
setne cl
lea ecx, [ecx*2 - 1]
add ecx, dword [edi]
mov dword [edi], ecx
test dl, dl
jne 0x4d0a05
test ecx, ecx
je 0x4d0a05
mov edx, str.disabled
lea ecx, [ebp - 0x2c]
mov eax, str.enabled
cmovle eax, edx
sub esp, 8
mov dword [ebp - 0x290], eax
lea edx, [ebp - 0x290]
mov eax, esp
push edi
mov dword [eax], str.Keeping_process_token_privilege____enabled_count:__.
mov dword [eax + 4], 0x3c
call fcn.004d1840
add esp, 0xc
push 0x56b700
jmp 0x4d0b00
mov ecx, str.Disabling
lea edx, [ebp - 0x2c]
test ebx, ebx
mov eax, str.Enabling
cmove eax, ecx
sub esp, 8
mov dword [ebp - 0x290], eax
lea ecx, [ebp - 0x290]
mov eax, esp
push edi
mov dword [eax], str._process_token_privilege_._Emplaced:___enabled_count:_.
mov dword [eax + 4], 0x41
lea eax, [ebp - 0x294]
push eax
call fcn.004d1ac0
push dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0x2a0]
mov edx, ebx
push dword [ebp - 0x2b0]
call fcn.004d0b80
add esp, 0x18
cmp dword [edi], 0
jne 0x4d0aff
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov ebx, dword [ebp - 0x1c]
mov edi, 0x811c9dc5
cmovae ecx, dword [ebp - 0x2c]
xor edx, edx
test ebx, ebx
je 0x4d0a91
movzx eax, byte [edx + ecx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ebx
jb 0x4d0a80
push edi
lea eax, [ebp - 0x2c]
mov ecx, 0x56b6e0
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.0047a830
mov edx, dword [eax + 4]
test edx, edx
je 0x4d0aff
and edi, dword [0x56b6f8]
mov ecx, dword [0x56b6ec]
mov eax, dword [ecx + edi*8]
cmp dword [ecx + edi*8 + 4], edx
jne 0x4d0ade
cmp eax, edx
jne 0x4d0ad5
mov eax, dword [0x56b6e4]
mov dword [ecx + edi*8], eax
mov dword [ecx + edi*8 + 4], eax
jmp 0x4d0ae7
mov eax, dword [edx + 4]
mov dword [ecx + edi*8 + 4], eax
jmp 0x4d0ae7
cmp eax, edx
jne 0x4d0ae7
mov eax, dword [edx]
mov dword [ecx + edi*8], eax
mov ecx, dword [edx]
dec dword [0x56b6e8]
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.004865f0
push esi
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 4
lea ecx, [ebp - 0x2c]
call fcn.00411450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e9056
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x18
mov dword [ebp - 0x29c], eax
mov esi, esp
sub esp, 8
mov ecx, esp
push str.Failed_to_look_up_privilege_value:_
call fcn.004276c0
lea edx, [ebp - 0x29c]
mov ecx, esi
call fcn.00428230
add esp, 8
lea ecx, [ebp - 0x28c]
call fcn.004de810
push 0x54b6b4
lea eax, [ebp - 0x28c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3