Function at 0x8455ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x84f8da6
mov eax, dword fs:[0]
push eax
sub esp, 0x6cc
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x434], esi
mov eax, dword [eax]
test eax, eax
je 0x84563a6
lea ecx, [ebp - 0x434]
push ecx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x8456395
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x84563a6
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x438], esi
push ecx
push esi
push esi
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x8455b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x8456395
push dword [ebp - 0x438]
call fcn.0847e6ac
mov edi, eax
add esp, 4
test edi, edi
je 0x8456395
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 0x438]
push edi
push 1
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x845638c
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jne 0x8455be9
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], esi
push eax
push dword [edi]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov ecx, ebx
mov esi, eax
call fcn.0840e1d0
push dword [ebp - 0x430]
mov ecx, ebx
call fcn.08448b70
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x845638c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.0849dde0
xor eax, eax
mov dword [ebp - 0x428], 0x104
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0849dde0
add esp, 0x18
mov dword [ebp - 0x424], 0x104
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [edi]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x845638c
mov dword [ebp - 0x574], 0x514d4242
lea esi, [ebp - 0x574]
mov dword [ebp - 0x570], 0x6763514a
lea edx, [ebp - 0x43c]
mov dword [ebp - 0x56c], 0x55595443
mov dword [ebp - 0x568], 0x466f435a
mov dword [ebp - 0x564], 0x6841584d
mov dword [ebp - 0x560], 0x41494363
mov dword [ebp - 0x55c], 0x59736849
mov dword [ebp - 0x558], 0x6e73794f
mov dword [ebp - 0x554], 0x476b7965
mov dword [ebp - 0x550], 0x61497945
mov dword [ebp - 0x54c], 0x576f334b
mov dword [ebp - 0x548], 0x5059534d
mov dword [ebp - 0x544], 0x7546774f
mov dword [ebp - 0x540], 0x684a4359
mov dword [ebp - 0x53c], 0x32674249
mov dword [ebp - 0x538], 0x42554362
mov dword [ebp - 0x534], 0x3870514e
mov dword [ebp - 0x530], 0x66415442
mov dword [ebp - 0x52c], 0x536f7a59
mov dword [ebp - 0x528], 0x756f5845
mov dword [ebp - 0x524], 0x38557762
mov dword [ebp - 0x520], 0x74413341
mov dword [ebp - 0x51c], 0x6c685345
mov dword [ebp - 0x518], 0x30516d45
mov dword [ebp - 0x514], 0x685a534d
mov dword [ebp - 0x510], 0x4e6f6a4a
mov dword [ebp - 0x50c], 0x4e59684a
mov dword [ebp - 0x508], 0x3030334e
mov dword [ebp - 0x504], 0x4c675748
mov dword [ebp - 0x500], 0x35684346
mov dword [ebp - 0x4fc], 0x6e45414d
mov dword [ebp - 0x4f8], 0x77524147
mov dword [ebp - 0x4f4], 0x51457942
mov dword [ebp - 0x4f0], 0x39596849
mov dword [ebp - 0x4ec], 0x5077424e
mov dword [ebp - 0x4e8], 0x7873424f
mov dword [ebp - 0x4e4], 0x35635142
mov dword [ebp - 0x4e0], 0x3852434b
mov dword [ebp - 0x4dc], 0x6d6f5343
mov dword [ebp - 0x4d8], 0x65595143
mov dword [ebp - 0x4d4], 0x69493250
mov dword [ebp - 0x4d0], 0x546f4250
mov dword [ebp - 0x4cc], 0x596f6a49
mov dword [ebp - 0x4c8], 0x41304242
mov dword [ebp - 0x4c4], 0x7a415443
mov dword [ebp - 0x4c0], 0x2b774247
mov dword [ebp - 0x4bc], 0x46596866
mov dword [ebp - 0x4b8], 0x45306a4a
mov dword [ebp - 0x4b4], 0x416f675a
mov dword [ebp - 0x4b0], 0x75386e5a
mov dword [ebp - 0x4ac], 0x6d674148
mov dword [ebp - 0x4a8], 0x41455466
mov dword [ebp - 0x4a4], 0x616b5765
mov dword [ebp - 0x4a0], 0x43774447
mov dword [ebp - 0x49c], 0x50305846
mov dword [ebp - 0x498], 0x6e307a4e
mov dword [ebp - 0x494], 0x6d556947
mov dword [ebp - 0x490], 0x39673247
mov dword [ebp - 0x48c], 0x566b774e
mov dword [ebp - 0x488], 0x364e694b
mov dword [ebp - 0x484], 0x664d6943
mov dword [ebp - 0x480], 0x4b734448
mov dword [ebp - 0x47c], 0x44387865
mov dword [ebp - 0x478], 0x77345148
mov dword [ebp - 0x474], 0x57637749
mov dword [ebp - 0x470], 0x36467944
mov dword [ebp - 0x46c], 0x766f5342
mov dword [ebp - 0x468], 0x68566a4d
mov dword [ebp - 0x464], 0x49557a45
mov dword [ebp - 0x460], 0x38777742
mov dword [ebp - 0x45c], 0x77464149
mov dword [ebp - 0x458], 0x4134535a
mov dword [ebp - 0x454], 0x646b324f
mov dword [ebp - 0x450], 0x4c6b585a
mov dword [ebp - 0x44c], 0x51494444
mov dword [ebp - 0x448], 0x395a3243
mov dword [ebp - 0x444], 0x4159334a
mov dword [ebp - 0x440], 0x6b444141
push 0
sub esp, 0xc
lea eax, [ebp - 0x439]
mov ecx, esp
push eax
push edx
push esi
call fcn.08409550
lea eax, [ebp - 0x6d8]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.08417430
push eax
mov ecx, ebx
call fcn.0840b790
lea ecx, [ebp - 0x6d8]
mov dword [ebp - 4], 0xffffffff
call fcn.0840b0f0
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.08446420
mov dword [ebp - 0x6c0], 0x61554442
mov dword [ebp - 0x6bc], 0x416f5450
mov dword [ebp - 0x6b8], 0x6e386847
mov dword [ebp - 0x6b4], 0x6e39434e
mov dword [ebp - 0x6b0], 0x54416947
mov dword [ebp - 0x6ac], 0x44417764
mov dword [ebp - 0x6a8], 0x366f514d
mov dword [ebp - 0x6a4], 0x68394141
mov dword [ebp - 0x6a0], 0x76636a5a
mov dword [ebp - 0x69c], 0x4a386741
mov dword [ebp - 0x698], 0x72383348
mov dword [ebp - 0x694], 0x32314342
mov dword [ebp - 0x690], 0x6868324c
mov dword [ebp - 0x68c], 0x57346846
mov dword [ebp - 0x688], 0x67557961
mov dword [ebp - 0x684], 0x39384462
mov dword [ebp - 0x680], 0x2b52544f
mov dword [ebp - 0x67c], 0x42515849
mov dword [ebp - 0x678], 0x6f497847
mov dword [ebp - 0x674], 0x6f6b4441
mov dword [ebp - 0x670], 0x52634446
mov dword [ebp - 0x66c], 0x3738514d
mov dword [ebp - 0x668], 0x7a346d42
mov dword [ebp - 0x664], 0x34306850
mov dword [ebp - 0x660], 0x45344442
mov dword [ebp - 0x65c], 0x4841674a
mov dword [ebp - 0x658], 0x57597961
mov dword [ebp - 0x654], 0x55384146
mov dword [ebp - 0x650], 0x4a59674f
mov dword [ebp - 0x64c], 0x47675448
mov dword [ebp - 0x648], 0x39353345
mov dword [ebp - 0x644], 0x64597a49
mov dword [ebp - 0x640], 0x30307a66
mov dword [ebp - 0x63c], 0x36775159
mov dword [ebp - 0x638], 0x3341434d
mov dword [ebp - 0x634], 0x7951544b
mov dword [ebp - 0x630], 0x45306749
mov dword [ebp - 0x62c], 0x32384446
mov dword [ebp - 0x628], 0x67414149
mov dword [ebp - 0x624], 0x4e514161
mov dword [ebp - 0x620], 0x7530544d
mov dword [ebp - 0x61c], 0x77393248
mov dword [ebp - 0x618], 0x6c4e6848
mov dword [ebp - 0x614], 0x6c55674d
mov dword [ebp - 0x610], 0x376b524d
mov dword [ebp - 0x60c], 0x35416a4a
mov dword [ebp - 0x608], 0x365a684f
mov dword [ebp - 0x604], 0x62557843
mov dword [ebp - 0x600], 0x466b774a
mov dword [ebp - 0x5fc], 0x656b5261
mov dword [ebp - 0x5f8], 0x79745161
mov dword [ebp - 0x5f4], 0x785a5361
mov dword [ebp - 0x5f0], 0x37385741
mov dword [ebp - 0x5ec], 0x72687945
mov dword [ebp - 0x5e8], 0x5977434a
mov dword [ebp - 0x5e4], 0x50495463
push 0
sub esp, 0xc
mov dword [ebp - 0x5e0], 0x38385359
mov ecx, esp
mov dword [ebp - 0x5dc], 0x44517946
lea eax, [ebp - 0x439]
mov dword [ebp - 0x5d8], 0x77347846
lea edx, [ebp - 0x575]
mov dword [ebp - 0x5d4], 0x356c7a4e
push eax
push edx
lea esi, [ebp - 0x6c0]
mov dword [ebp - 0x5d0], 0x7677544e
push esi
mov dword [ebp - 0x5cc], 0x75557949
mov dword [ebp - 0x5c8], 0x514d6a4b
mov dword [ebp - 0x5c4], 0x59384242
mov dword [ebp - 0x5c0], 0x6e64414e
mov dword [ebp - 0x5bc], 0x5263574e
mov dword [ebp - 0x5b8], 0x6e556743
mov dword [ebp - 0x5b4], 0x374d694b
mov dword [ebp - 0x5b0], 0x634d474c
mov dword [ebp - 0x5ac], 0x4441435a
mov dword [ebp - 0x5a8], 0x54595347
mov dword [ebp - 0x5a4], 0x334a4242
mov dword [ebp - 0x5a0], 0x2f6b6941
mov dword [ebp - 0x59c], 0x616f794c
mov dword [ebp - 0x598], 0x6c6b5859
mov dword [ebp - 0x594], 0x39633247
mov dword [ebp - 0x590], 0x4e775148
mov dword [ebp - 0x58c], 0x6b42414b
mov dword [ebp - 0x588], 0x32674141
mov dword [ebp - 0x584], 0x464d6747
mov dword [ebp - 0x580], 0x7a784849
mov dword [ebp - 0x57c], 0x41415141
mov word [ebp - 0x578], 0x5041
mov byte [ebp - 0x576], 0x4d
call fcn.08409550
lea eax, [ebp - 0x6cc]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.08417430
push eax
mov ecx, ebx
call fcn.08446420
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 4], 0xffffffff
call fcn.0840b0f0
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.08446420
mov esi, 1
push edi
call fcn.0849b460
add esp, 4
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x84563a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret