Function at 0x4060f0
Capabilities:
Acquire debug privileges
Decode data using base64 via winapi
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x47c018]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
call fcn.004063c0
cmp dword [0x47cfe8], 0x10
mov eax, 0x47cfd4
cmovae eax, dword [0x47cfd4]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x4063a8
cmp dword [0x47cfe8], 0x10
mov eax, 0x47cfd4
cmovae eax, dword [0x47cfd4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, str.SeDebugPrivilege
call fcn.00409ca0
test eax, eax
je 0x406168
or byte [0x47ea68], 1
mov ecx, str.SeTcbPrivilege
call fcn.00409ca0
test eax, eax
je 0x40617d
or byte [0x47ea68], 2
mov ecx, 0x455b2c
call fcn.00409ca0
test eax, eax
je 0x406192
or byte [0x47ea68], 8
mov ecx, str.SeSecurityPrivilege
call fcn.00409ca0
test eax, eax
je 0x4061a7
or byte [0x47ea68], 0x10
cmp dword [0x47d194], 0x10
mov ecx, 0x47d180
mov edx, dword [0x47d018]
mov eax, edx
cmovae ecx, dword [0x47d180]
mov edi, dword [0x47d190]
mov ebx, dword [0x47d014]
sub eax, ebx
push edi
push ecx
cmp edi, eax
ja 0x406202
cmp edx, 0x10
lea eax, [ebx + edi]
mov esi, 0x47d004
mov dword [0x47d014], eax
cmovae esi, dword [0x47d004]
lea eax, [esi + ebx]
push eax
call fcn.00430ac0
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ebx], 0
jmp 0x406211
push dword [esp + 0x18]
mov ecx, 0x47d004
push edi
call fcn.00411070
mov edx, dword [0x47d018]
mov eax, edx
mov ecx, dword [0x47d014]
sub eax, ecx
cmp eax, 1
jb 0x406245
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [0x47d014], eax
mov eax, 0x47d004
cmovae eax, dword [0x47d004]
mov word [eax + ecx], 0x3b
jmp 0x40625c
push 1
push 0x455b88
push dword [esp + 0x18]
mov ecx, 0x47d004
push 1
call fcn.00411070
cmp dword [0x47cfe8], 0x10
mov ecx, 0x47cfd4
mov edx, dword [0x47d018]
mov eax, edx
cmovae ecx, dword [0x47cfd4]
mov edi, dword [0x47cfe4]
mov ebx, dword [0x47d014]
sub eax, ebx
push edi
push ecx
cmp edi, eax
ja 0x4062b7
cmp edx, 0x10
lea eax, [edi + ebx]
mov esi, 0x47d004
mov dword [0x47d014], eax
cmovae esi, dword [0x47d004]
lea eax, [esi + ebx]
push eax
call fcn.00430ac0
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ebx], 0
jmp 0x4062c6
push dword [esp + 0x18]
mov ecx, 0x47d004
push edi
call fcn.00411070
mov edx, dword [0x47d018]
mov eax, edx
mov ecx, dword [0x47d014]
sub eax, ecx
cmp eax, 1
jb 0x4062fa
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [0x47d014], eax
mov eax, 0x47d004
cmovae eax, dword [0x47d004]
mov word [eax + ecx], 0x3b
jmp 0x406311
push 1
push 0x455b8c
push dword [esp + 0x18]
mov ecx, 0x47d004
push 1
call fcn.00411070
cmp byte [0x4806de], 0
je 0x406383
cmp dword [0x47d1dc], 0x10
lea eax, [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, 0x47d1c8
cmovae esi, dword [0x47d1c8]
push 0
push 0
push eax
push 0
push 1
push esi
mov dword [esp + 0x28], 0
call edi
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push eax
push esi
call ebx
test eax, eax
je 0x40637b
cmp dword [esp + 0x10], 0x20
jne 0x40637b
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0x4806b8
push 1
push esi
call edi
push eax
push esi
call ebx
test eax, eax
jne 0x406394
push 0x65
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00406c90
test eax, eax
jne 0x406394
push 0x66
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x14]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042f19a
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]