Function at 0x100025c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x1004f054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 3
push 0x401fffff
lea eax, [ebp - 0x14]
mov dword [ebp - 0x244], 0xc20
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x228], 0
lea eax, [ebp - 0x244]
movq qword [ebp - 0x230], xmm0
push eax
movups xmmword [ebp - 0x240], xmm0
mov dword [ebp - 0x14], 0x52525543
mov dword [ebp - 0x10], 0x5f544e45
mov dword [ebp - 0xc], 0x52455355
mov byte [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push 0
lea eax, [ebp - 0x244]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
push 0
push dword [ebp - 0x21c]
push 0
push 0
push 0x20000004
push 6
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0xc
push eax
push 1
push str.D:P_D_OICI_GA___BG__D_OICI_GA___AN__D_OICI_GA___BG__D_OICI_GA___AN__D_OICI_GA___AU__D_OICI_GA___BA__D_OICI_GA___LA_
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
test eax, eax
je 0x100026bd
push dword [ebp - 0x10]
push 4
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
lea eax, [ebp - 0x224]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x100
push eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100027f5
lea eax, [ebp - 0x21c]
push eax
push 8
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100027f5
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 1
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x220]
cmp eax, 0x400
ja 0x100027f5
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x100027f5
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x220]
push esi
push 1
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x100027f5
push 2
push 0x200
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x100027f5
push dword [ebp - 0x224]
lea eax, [ebp - 0x218]
push 0xfa
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AddAccessDeniedAce]
test eax, eax
je 0x100027f5
push dword [esi]
lea eax, [ebp - 0x218]
push 0x100701
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x100027f5
push 0
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push SysStringLen
push 6
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x10002806
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x10002817
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10017373
mov esp, ebp
pop ebp
ret