Function at 0x406130
Capabilities:
Acquire debug privileges
Decode data using base64 via winapi
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x47c018]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
call fcn.00406400
cmp dword [0x47cfe8], 0x10
mov eax, 0x47cfd4
cmovae eax, dword [0x47cfd4]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x4063e8
cmp dword [0x47cfe8], 0x10
mov eax, 0x47cfd4
cmovae eax, dword [0x47cfd4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, str.SeDebugPrivilege
call fcn.00409d30
test eax, eax
je 0x4061a8
or byte [0x47ea68], 1
mov ecx, str.SeTcbPrivilege
call fcn.00409d30
test eax, eax
je 0x4061bd
or byte [0x47ea68], 2
mov ecx, 0x455b2c
call fcn.00409d30
test eax, eax
je 0x4061d2
or byte [0x47ea68], 8
mov ecx, str.SeSecurityPrivilege
call fcn.00409d30
test eax, eax
je 0x4061e7
or byte [0x47ea68], 0x10
cmp dword [0x47d194], 0x10
mov ecx, 0x47d180
mov edx, dword [0x47d018]
mov eax, edx
cmovae ecx, dword [0x47d180]
mov edi, dword [0x47d190]
mov ebx, dword [0x47d014]
sub eax, ebx
push edi
push ecx
cmp edi, eax
ja 0x406242
cmp edx, 0x10
lea eax, [ebx + edi]
mov esi, 0x47d004
mov dword [0x47d014], eax
cmovae esi, dword [0x47d004]
lea eax, [esi + ebx]
push eax
call fcn.00430b60
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ebx], 0
jmp 0x406251
push dword [esp + 0x18]
mov ecx, 0x47d004
push edi
call fcn.00411110
mov edx, dword [0x47d018]
mov eax, edx
mov ecx, dword [0x47d014]
sub eax, ecx
cmp eax, 1
jb 0x406285
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [0x47d014], eax
mov eax, 0x47d004
cmovae eax, dword [0x47d004]
mov word [eax + ecx], 0x3b
jmp 0x40629c
push 1
push 0x455b88
push dword [esp + 0x18]
mov ecx, 0x47d004
push 1
call fcn.00411110
cmp dword [0x47cfe8], 0x10
mov ecx, 0x47cfd4
mov edx, dword [0x47d018]
mov eax, edx
cmovae ecx, dword [0x47cfd4]
mov edi, dword [0x47cfe4]
mov ebx, dword [0x47d014]
sub eax, ebx
push edi
push ecx
cmp edi, eax
ja 0x4062f7
cmp edx, 0x10
lea eax, [edi + ebx]
mov esi, 0x47d004
mov dword [0x47d014], eax
cmovae esi, dword [0x47d004]
lea eax, [esi + ebx]
push eax
call fcn.00430b60
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ebx], 0
jmp 0x406306
push dword [esp + 0x18]
mov ecx, 0x47d004
push edi
call fcn.00411110
mov edx, dword [0x47d018]
mov eax, edx
mov ecx, dword [0x47d014]
sub eax, ecx
cmp eax, 1
jb 0x40633a
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [0x47d014], eax
mov eax, 0x47d004
cmovae eax, dword [0x47d004]
mov word [eax + ecx], 0x3b
jmp 0x406351
push 1
push 0x455b8c
push dword [esp + 0x18]
mov ecx, 0x47d004
push 1
call fcn.00411110
cmp byte [0x4806de], 0
je 0x4063c3
cmp dword [0x47d1dc], 0x10
lea eax, [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, 0x47d1c8
cmovae esi, dword [0x47d1c8]
push 0
push 0
push eax
push 0
push 1
push esi
mov dword [esp + 0x28], 0
call edi
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push eax
push esi
call ebx
test eax, eax
je 0x4063bb
cmp dword [esp + 0x10], 0x20
jne 0x4063bb
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0x4806b8
push 1
push esi
call edi
push eax
push esi
call ebx
test eax, eax
jne 0x4063d4
push 0x65
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00406cd0
test eax, eax
jne 0x4063d4
push 0x66
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x14]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042f23c
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]