Function at 0x495b6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
sub esp, 0x5c
mov eax, 0x4a1dd0
call fcn.0045797c
sub esp, 0x39c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x20], ebx
and dword [ebp - 4], ebx
xor eax, eax
inc eax
push eax
push str.SeRestorePrivilege
call fcn.004b4052
xor eax, eax
mov ecx, esi
inc eax
push eax
push str.SeBackupPrivilege
call fcn.004b4052
push 0x48
call sub.mfc140u.dll_operator_2
mov esi, eax
pop ecx
mov dword [ebp + 0x24], esi
xor eax, eax
inc eax
mov byte [ebp - 4], al
test esi, esi
je 0x495bfc
push 0xfde9
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.0041b707
add esp, 0xc
inc ebx
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
mov dword [ebp + 0x20], ebx
jb 0x495bed
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.00440f2d
mov edi, eax
mov dword [ebp + 0x20], eax
jmp 0x495c01
xor edi, edi
mov dword [ebp + 0x20], edi
and dword [ebp - 4], 0
test bl, 1
je 0x495c15
lea ecx, [ebp - 0x1a8]
call fcn.004445cb
xor ebx, ebx
mov ecx, edi
push ebx
call fcn.00440ffc
test al, al
je 0x496a17
lea eax, [ebp + 0x5c]
push 0x4ca410
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, edi
call fcn.00440823
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], bl
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test esi, esi
je 0x496a09
lea eax, [ebp - 0x64]
push 0x4ca420
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 5
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, esi
call fcn.00440823
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
mov edi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test edi, edi
je 0x496a06
push 0xf
pop eax
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], eax
mov byte [ebp - 0x178], bl
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], eax
mov byte [ebp - 0x160], bl
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x148], bl
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x130], bl
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], eax
mov byte [ebp - 0x118], bl
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], eax
mov byte [ebp - 0x100], bl
mov byte [ebp - 4], 0xb
push ebx
push 0x4dcd90
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], eax
mov byte [ebp - 0xb8], bl
call fcn.0044538a
push 0xf
pop esi
push ebx
push 0x4dcd90
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x30], bl
call fcn.0044538a
push ebx
push 0x4dcd90
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], esi
mov byte [ebp - 0xd0], bl
call fcn.0044538a
mov dword [ebp - 0x8c], esi
lea ecx, [ebp - 0xa0]
push ebx
mov esi, 0x4dcd90
mov byte [ebp - 4], 0xe
push esi
mov dword [ebp - 0x90], ebx
mov byte [ebp - 0xa0], bl
call fcn.0044538a
push ebx
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], bl
call fcn.0044538a
push ebx
push esi
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], bl
call fcn.0044538a
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 0x11
push 0x4ca42c
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x12
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, edi
call fcn.004409ff
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x11
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test esi, esi
je 0x495e67
lea eax, [ebp - 0x60]
push 0x4ca42c
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x13
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, edi
call fcn.004409ff
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x495e44
sub edx, esi
lea ecx, [ebp - 0xb8]
push edx
push eax
call fcn.0044538a
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea eax, [ebp - 0x6c]
push 0x4ca438
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x14
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, edi
call fcn.004409ff
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x11
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test esi, esi
je 0x495ee7
lea eax, [ebp - 0x70]
push 0x4ca438
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x15
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, edi
call fcn.004409ff
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x495ec7
sub edx, esi
lea ecx, [ebp - 0x30]
push edx
push eax
call fcn.0044538a
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea eax, [ebp - 0x74]
push 0x4c33a8
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x16
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
mov edx, eax
mov dword [ebp + 0x3c], ebx
mov ecx, edx
mov dword [ebp + 0x40], 0xf
mov byte [ebp + 0x2c], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x495f17
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x2c]
call fcn.0044538a
cmp dword [ebp + 0x40], 0x10
lea eax, [ebp + 0x2c]
mov ecx, edi
mov byte [ebp - 4], 0x17
cmovae eax, dword [ebp + 0x2c]
push eax
call fcn.004409ff
lea ecx, [ebp + 0x2c]
mov esi, eax
call fcn.004445cb
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test esi, esi
je 0x496032
lea eax, [ebp - 0x7c]
push 0x4c33a8
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x18
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
mov edx, eax
mov dword [ebp + 0x3c], ebx
mov ecx, edx
mov dword [ebp + 0x40], 0xf
mov byte [ebp + 0x2c], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x495f90
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x2c]
call fcn.0044538a
cmp dword [ebp + 0x40], 0x10
lea eax, [ebp + 0x2c]
mov ecx, edi
mov byte [ebp - 4], 0x19
cmovae eax, dword [ebp + 0x2c]
push eax
call fcn.004409ff
mov edx, eax
mov dword [ebp + 0x54], ebx
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x495fce
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
push ebx
push 0xfde9
lea eax, [ebp + 0x44]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00403e4c
add esp, 0x10
lea ecx, [ebp - 0xd0]
push eax
call fcn.00447121
lea ecx, [ebp - 0x190]
call fcn.004445cb
lea ecx, [ebp + 0x44]
call fcn.004445cb
lea ecx, [ebp + 0x2c]
call fcn.004445cb
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea eax, [ebp - 0x80]
push 0x4ca444
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x1b
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, edi
call fcn.004409ff
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x11
mov esi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test esi, esi
je 0x496107
lea eax, [ebp - 0x84]
push 0x4ca444
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x1c
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, edi
call fcn.004409ff
mov edx, eax
mov dword [ebp + 0x54], ebx
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4960a8
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
push ebx
push 0xfde9
lea eax, [ebp + 0x44]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00403e4c
add esp, 0x10
lea ecx, [ebp - 0xa0]
push eax
call fcn.00447121
lea ecx, [ebp - 0x190]
call fcn.004445cb
lea ecx, [ebp + 0x44]
call fcn.004445cb
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea eax, [ebp - 0x88]
push 0x4c967c
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x1e
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
mov edx, eax
mov dword [ebp + 0x3c], ebx
mov ecx, edx
mov dword [ebp + 0x40], 0xf
mov byte [ebp + 0x2c], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49613a
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x2c]
call fcn.0044538a
cmp dword [ebp + 0x40], 0x10
lea eax, [ebp + 0x2c]
mov ecx, edi
mov byte [ebp - 4], 0x1f
cmovae eax, dword [ebp + 0x2c]
push eax
call fcn.004409ff
lea ecx, [ebp + 0x2c]
mov esi, eax
call fcn.004445cb
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test esi, esi
je 0x49620d
lea eax, [ebp - 0x4c]
push 0x4c967c
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x20
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
mov edx, eax
mov dword [ebp + 0x3c], ebx
mov ecx, edx
mov dword [ebp + 0x40], 0xf
mov byte [ebp + 0x2c], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4961b6
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x2c]
call fcn.0044538a
cmp dword [ebp + 0x40], 0x10
lea eax, [ebp + 0x2c]
mov ecx, edi
mov byte [ebp - 4], 0x21
cmovae eax, dword [ebp + 0x2c]
push eax
call fcn.004409ff
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4961e5
sub edx, esi
lea ecx, [ebp - 0x48]
push edx
push eax
call fcn.0044538a
lea ecx, [ebp + 0x2c]
call fcn.004445cb
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea eax, [ebp - 0x50]
push 0x4ca454
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x22
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
mov edx, eax
mov dword [ebp + 0x3c], ebx
mov ecx, edx
mov dword [ebp + 0x40], 0xf
mov byte [ebp + 0x2c], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49623d
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x2c]
call fcn.0044538a
cmp dword [ebp + 0x40], 0x10
lea eax, [ebp + 0x2c]
mov ecx, edi
mov byte [ebp - 4], 0x23
cmovae eax, dword [ebp + 0x2c]
push eax
call fcn.004409ff
lea ecx, [ebp + 0x2c]
mov esi, eax
call fcn.004445cb
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test esi, esi
je 0x496310
lea eax, [ebp - 0x54]
push 0x4ca454
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x24
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
mov edx, eax
mov dword [ebp + 0x3c], ebx
mov ecx, edx
mov dword [ebp + 0x40], 0xf
mov byte [ebp + 0x2c], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4962b6
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x2c]
call fcn.0044538a
cmp dword [ebp + 0x40], 0x10
lea eax, [ebp + 0x2c]
mov ecx, edi
mov byte [ebp - 4], 0x25
cmovae eax, dword [ebp + 0x2c]
push eax
call fcn.004409ff
mov edx, eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4962e5
sub edx, esi
lea ecx, [ebp - 0xe8]
push edx
push eax
call fcn.0044538a
lea ecx, [ebp + 0x2c]
call fcn.004445cb
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
push 0x4dcdb8
lea ecx, [ebp - 0xe8]
call fcn.00452833
mov bh, al
lea eax, [ebp - 0x58]
push 0x4ca460
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x26
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x496354
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0xb8]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x49639b
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x496488
lea eax, [ebp - 0x78]
push 0x4ca46c
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x27
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4963cd
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0xb8]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x496411
mov esi, SysReAllocString
jmp 0x496488
lea eax, [ebp - 0x5c]
push 0x4ca478
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x28
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x496443
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0xb8]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
xor esi, esi
mov eax, SysReAllocString
test bl, bl
cmovne esi, eax
lea ecx, [ebp + 0x5c]
lea eax, [ebp - 0x30]
push ecx
cmp bh, 1
jne 0x49649b
push 0xf013f
jmp 0x4964a0
push 0xf003f
cmp dword [ebp - 0x1c], 0x10
cmovae eax, dword [ebp - 0x30]
xor ebx, ebx
push ebx
push eax
push esi
call fcn.00435cea
add esp, 0x14
cmp eax, 2
jne 0x4964f0
xor eax, eax
lea ecx, [ebp + 0x5c]
push ebx
inc eax
cmp dword [0x5010f0], eax
lea eax, [ebp - 0x30]
push ecx
push ebx
jne 0x4964d5
push 0xf013f
jmp 0x4964da
push 0xf003f
cmp dword [ebp - 0x1c], 0x10
push 4
cmovae eax, dword [ebp - 0x30]
push ebx
push ebx
push eax
push esi
call fcn.004982a8
add esp, 0x24
test eax, eax
jne 0x496947
lea eax, [ebp + 0x1c]
push 0x4ca484
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x29
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
mov edx, eax
mov dword [ebp + 0x54], ebx
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], bl
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x496528
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x49656a
push 3
pop edx
jmp 0x496900
lea eax, [ebp + 0x18]
push 0x4ca49c
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x2a
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49659c
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x4965da
push 4
jmp 0x496564
lea eax, [ebp + 0x10]
push 0x4ca4b4
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x2b
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49660c
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x49664d
push 5
jmp 0x496564
lea eax, [ebp + 0xc]
push 0x4ca4e0
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x2c
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49667f
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x4966c0
push 2
jmp 0x496564
lea eax, [ebp + 0x14]
push 0x4ca500
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x2d
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4966f2
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x496733
push 6
jmp 0x496564
lea eax, [ebp + 8]
push 0x4ca514
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x2e
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x496765
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x4967a6
push 7
jmp 0x496564
lea eax, [ebp + 4]
push 0x4ca530
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x2f
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4967d8
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp + 4]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x49681b
xor ebx, ebx
mov edx, ebx
jmp 0x496902
lea eax, [ebp]
push 0x4ca544
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x30
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x49684d
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
test bl, bl
je 0x49688e
push 0xb
jmp 0x496564
lea eax, [ebp - 0x10]
push 0x4ca55c
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x31
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
and dword [ebp + 0x54], 0
mov edx, eax
mov ecx, edx
mov dword [ebp + 0x58], 0xf
mov byte [ebp + 0x44], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4968c0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x44]
call fcn.0044538a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x48]
call fcn.00452806
lea ecx, [ebp + 0x44]
mov bl, al
call fcn.004445cb
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x11
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
xor edx, edx
test bl, bl
push 1
pop eax
cmovne edx, eax
xor ebx, ebx
push dword [ebp - 0x90]
cmp dword [ebp - 0x8c], 0x10
lea ecx, [ebp - 0xa0]
lea eax, [ebp - 0xd0]
cmovae ecx, dword [ebp - 0xa0]
cmp dword [ebp - 0xbc], 0x10
push ecx
cmovae eax, dword [ebp - 0xd0]
push edx
push ebx
push eax
push dword [ebp + 0x5c]
call fcn.0040adfe
push dword [ebp + 0x5c]
call fcn.00434130
add esp, 0x1c
lea eax, [ebp + 0x24]
push 0x4ca420
push eax
call fcn.00434880
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0x32
call dword [sym.imp.mfc140u.dll_Ordinal_1665]
push eax
mov ecx, edi
call fcn.0044087b
lea ecx, [ebp + 0x24]
mov edi, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea ecx, [ebp - 0xe8]
call fcn.004445cb
lea ecx, [ebp - 0x48]
call fcn.004445cb
lea ecx, [ebp - 0xa0]
call fcn.004445cb
lea ecx, [ebp - 0xd0]
call fcn.004445cb
lea ecx, [ebp - 0x30]
call fcn.004445cb
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xb
call fcn.004445cb
push 0xf
pop eax
test edi, edi
jne 0x495d0e
lea ecx, [ebp - 0x100]
call fcn.004445cb
lea ecx, [ebp - 0x118]
call fcn.004445cb
lea ecx, [ebp - 0x130]
call fcn.004445cb
lea ecx, [ebp - 0x148]
call fcn.004445cb
lea ecx, [ebp - 0x160]
call fcn.004445cb
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], bl
call fcn.004445cb
mov edi, dword [ebp + 0x20]
test edi, edi
je 0x496a17
mov eax, dword [edi]
xor ecx, ecx
inc ecx
push ecx
mov ecx, edi
call dword [eax]
mov ecx, dword [ebp + 0x28]
push ebx
push str.SeRestorePrivilege
call fcn.004b4052
mov ecx, dword [ebp + 0x28]
push ebx
push str.SeBackupPrivilege
call fcn.004b4052
push 0x200
lea eax, [ebp - 0x3a8]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp + 0x28]
push 0x4ca56c
push eax
call fcn.0043fa6b
add esp, 0x14
mov edi, pe_nt_image_headers32
mov byte [ebp - 4], 0x33
push edi
lea ecx, [ebp - 0x3a8]
push ecx
mov ecx, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
mov esi, 0x500f8c
push eax
mov ecx, esi
call fcn.0043b25a
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0x3a8]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
lea eax, [ebp + 0x24]
mov byte [ebp - 4], 0x34
push 0x4ca58c
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push edi
lea edx, [ebp - 0x3a8]
mov byte [ebp - 4], 0x35
push edx
mov ecx, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
mov ecx, esi
call fcn.0043b25a
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], 0x34
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0x3a8]
push eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push 0x1040
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x36
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push ebx
call fcn.0045e5f2
add esp, 0x10
mov ecx, 0x5009b8
call fcn.0041d1cb
test al, al
jne 0x496dc8
mov edi, 0x500e68
mov ecx, edi
call fcn.00473301
push eax
lea ecx, [ebp + 0x44]
call fcn.00443c24
cmp dword [ebp + 0x58], 8
lea eax, [ebp + 0x44]
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0x37
cmovae eax, dword [ebp + 0x44]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
lea eax, [ebp + 0x28]
mov byte [ebp - 4], 0x38
push 0x4ca000
push eax
call fcn.0043fa6b
pop ecx
pop ecx
mov esi, 0x4bbd30
mov byte [ebp - 4], 0x39
push esi
mov ecx, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp + 0x24]
push 0x4ca040
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x3a
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0x10]
push 0x4ca08c
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x3b
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp]
push 0x4ca0c8
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x3c
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp + 4]
push 0x4ca110
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x3d
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 4]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp + 8]
push 0x4ca15c
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x3e
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp + 0x14]
push 0x4ca188
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x3f
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp + 0xc]
push 0x4ca1ac
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x40
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp + 0x10]
push 0x4ca1e4
push eax
call fcn.0043fa6b
pop ecx
pop ecx
mov byte [ebp - 4], 0x41
push esi
mov ecx, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp + 0x18]
push 0x4c9e8c
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x42
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp + 0x1c]
push 0x4c9ec4
push eax
call fcn.0043fa6b
pop ecx
pop ecx
push esi
mov ecx, eax
mov byte [ebp - 4], 0x43
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__24]
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0x38
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
sub esp, 0x18
lea ecx, [ebp + 0x5c]
mov esi, esp
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
mov ecx, esi
call fcn.00443c24
mov ecx, edi
call fcn.00483975
mov ecx, 0x500ac0
call fcn.00429929
lea ecx, [ebp + 0x5c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0x44]
call fcn.00443e59
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0x68]
call fcn.00443e59
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add ebp, 0x60
leave
ret 0x18