Function at 0x415ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x669e68
push 0x480890
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x67432c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
call fcn.004524ef
test al, al
je 0x415b09
scasd eax, dword es:[edi]
or byte [esi], dl
mov al, 0x3a
ror dword [eax], 1
inc ebx
loopne 0x415b39
pop esi
test edx, esp
and dword [eax - 0x20], esp
call fcn.004521f8
test al, al
je 0x415b31
fcom dword [edx + 0x6c]
jns 0x415b89
or eax, 0x5541299c
cmp byte ss:[esi - 0x7f], cl
cmpsb byte fs:[esi], byte es:[edi]
in eax, dx
and dword [eax - 0x28], 0xe
fmul dword [esi]
push esi
mov al, 0x18
aas
outsd dx, dword [esi]
add al, 0x81
shl byte [eax + ebp*8 - 0x21], 1
les eax, [ebx]
add byte [eax + eax*8 + 0x186b1674], al
movsb byte es:[edi], byte [esi]
call fcn.00452015
test al, al
je 0x415b50
push ss
imul ebx, dword [eax], 0xffffffa4
push ebx
insd dword es:[edi], dx
sub esi, edx
cwde
cmp bl, byte [eax + ebx + 0x75]
mov dh, 0x31
or al, 0x13
aad 0x98
mov ebp, 0xc7b9be93
inc ebp
test al, 0
add byte [eax], al
add bh, al
inc ebp
mov ah, 0
add byte [eax], al
add bh, al
inc ebp
aam 0
add byte [eax], al
add bh, al
inc ebp
mov al, 0
add byte [eax], al
add al, ch
lds eax, cs:[ebx]
add byte [eax + eax*8 - 0x5dc6e08c], al
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x4c], 0
add byte [eax], al
add byte [eax], al
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x50], 0
call fcn.0045209f
test al, al
je 0x415b94
cmp dword [edx + 0x30ceb007], esp
scasd eax, dword es:[edi]
push eax
std
pushfd
invalid
pop es
mov al, 0xce
xor byte [edi - 0x236302b0], ch
fadd dword [ebx + 0x56]
inc esp
stc
out dx, eax
shr esi, cl
jbe 0x415b26
pushfd
lcall 0x19a6, 0xdfb6ccba
shl dword [ebp - 0x5bba387f], cl
add byte [eax], al
sbb ebx, edx
movsd dword es:[edi], dword [esi]
add edi, 0xa445
mov dword [ebp - 0x5c], 0
add byte [eax], al
add bh, al
inc ebp
mov eax, 0
add byte [eax], al
mov dword [ebp - 0x48], 0
call fcn.00452351
test al, al
je 0x415bc2
dec esp
scasd eax, dword es:[edi]
jle 0x415b5a
inc ecx
add dl, ch
mov byte [0xbf47667b], al
mov edi, 0x9cd6f740
sub byte [esi - 0x18], al
jp 0x415c38
mov eax, dword [0x3c51de8]
add byte [eax + eax*8 - 0x3043e78c], al
das
cmc
call fcn.004520e4
test al, al
je 0x415be3
mov esp, 0xf52ff2cf
dec eax
inc esi
in al, dx
stosb byte es:[edi], al
int 0xf
inc ebp
push es
mov esp, 0xa783bd59
jbe 0x415b77
inc esp
aad 0x52
call fcn.0045216e
test al, al
je 0x415c04
push ecx
call 0xbe98dc62
and eax, 0xe5462eb7
je 0x415b90
adc ecx, dword [ebp + 0x62764656]
hlt
call fcn.0045230c
test al, al
je 0x415c1f
mov ah, 0x6e
add al, byte [eax - 0x61594fc7]
jg 0x415b98
sbb ebp, 0x8f39086d
and byte [ecx + 0xc445c7], al
add byte [eax], al
add bh, al
inc ebp
int3
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
call fcn.00452579
test al, al
je 0x415c46
or eax, 0x2b64e654
popfd
retf 0x393d
out 0x64, al
sub ebx, dword [ebp - 0x71c6c236]
invalid
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
call fcn.004524aa
test al, al
je 0x415c6f
fcmovb st(0), st(5)
stosb byte es:[edi], al
cli
push edi
add bl, byte [esi + 0x66]
nop
and al, 0xe6
xchg ecx, eax
mov bl, byte [ebx]
invalid
mov dword [ebp - 0x60], 0
call fcn.004523db
test al, al
je 0x415c9a
invalid
call fcn.0045223d
test al, al
je 0x415cb8
sal byte [ebp + edx - 0x2c], 0x5c
aam 0x5c
mov ebx, 0x9d2530e8
cmpsb byte [esi], byte es:[edi]
jb 0x415ca0
pop edi
int3
call fcn.00452396
test al, al
je 0x415cd3
xlatb
rcl byte [ecx], cl
xchg dword [edx - 0x32ac1e97], edi
push edi
mov esp, 0x1b99996c
invalid
insb byte es:[edi], dx
cdq
cdq
sbb eax, esp
invalid
mov dword [ebp - 4], 0
call fcn.004522c7
test al, al
je 0x415cf7
stc
rcl byte [edx], 0x9f
xchg ebx, eax
jge 0x415d49
pushfd
push cs
dec ecx
pop esp
push cs
fsub dword [ecx - 0x4f0a8ca6]
xchg ecx, eax
call fcn.004520e4
test al, al
je 0x415d1e
cld
ja 0x415d14
insb byte es:[edi], dx
or dword [edi - 0x377407a5], edi
shl byte [esi - 0x1b], 0xb4
sbb ch, bh
add ah, byte [ebp + 0x63]
sal byte [eax - 0x6e735fc6], cl
iretd
mov al, 0x3a
mov al, byte [0x3cf918c]
pop es
mov dword [ebp - 0x18], eax
nop
les eax, [ebx]
add byte [eax + eax*8 - 0x23fee08c], al
call fcn.004521b3
test al, al
je 0x415d46
add esp, ebx
jle 0x415d37
enter 0x209a, 0x53
mov ebx, 0x88447da4
cdq
jb 0x415ccc
leave
pop ds
out dx, eax
lcall 0xd08, 0x74c0d318
pop ss
adc dword [eax + 0x458d0094], ebx
cwde
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
lea eax, [ebp - 0x50]
push eax
push 0
push dword [ebp - 0x30]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x4164fe
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
je 0x415d8b
call ebx
push eax
push str.LookupAccountName___failed._Error__d_n
call fcn.00416600
add esp, 8
jmp 0x4164fe
call fcn.00451f46
test al, al
je 0x415da4
or dword [ebx], esp
imul esi, dword [edx + 0x40], 0xcbe0af3d
test eax, 0x8819b6a7
xchg edx, eax
push dword [ebp - 0x50]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x415dd2
inc ebp
aam 0x85
sal byte [ebp + 0x15], 0xff
rcl dword [eax + 0x68], cl
add al, 0x7f
pop esi
add al, ch
or byte ss:[eax], al
add byte [ebx + 0x2ce908c4], al
pop es
add byte [eax], al
call ebx
push eax
push str.HeapAlloc___failed._Error__d_n
call fcn.00416600
add esp, 8
jmp 0x4164fe
call fcn.004523db
test al, al
je 0x415df8
xor byte [edi + 0x4bbc6dfc], bh
stosb byte es:[edi], al
imul ecx, dword [esi], 0x8e012205
xor byte [edi + ebp*8 + 0x74], bh
int 0x34
cmp byte [ebx - 0x60], cl
les eax, [edi + 0x61144907]
pop esi
call fcn.004524ef
test al, al
je 0x415e1f
cmp ecx, dword [ecx + edx*8 - 0x66]
push esp
jle 0x415db7
pop edx
xchg edx, eax
jp 0x415e6a
add al, 0xe5
cwde
sbb edx, eax
aad 0x38
inc ecx
jns 0xa96e3d6e
insd dword es:[edi], dx
mov dword [0x8b53cc7b], eax
inc ebp
mov ah, 3
rcl byte [eax + 0x6a], 8
mov eax, dword [ebp - 0x4c]
add eax, eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x415e56
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.HeapAlloc___failed._Error__d_n
call fcn.00416600
add esp, 8
jmp 0x4164fe
call fcn.004521f8
test al, al
je 0x415e7a
or al, 0x16
imul ecx, ebp, 0xffffffb5
jg 0x415ee5
dec esi
imul esp, dword [esi + 0x711bcfb8], 0xffffffd2
mov ss, word [ebx + esi*4]
iretd
mov eax, dword [0x6ae36d1d]
pop ds
pop ds
pop ecx
shr eax, 1
and dl, al
add eax, dword [eax]
call fcn.0045209f
test al, al
je 0x415ea1
pushfd
jle 0x415eec
imul edx, dword [ecx], 0x8b1c56e7
cmpsb byte [esi], byte es:[edi]
jbe 0x415f0f
ja 0x415e9b
outsd dx, dword [esi]
loope 0x415ee8
push 0xffffffffffffffe9
pop ds
adc dword [eax], eax
salc
jbe 0x415e61
and bh, byte [ecx - 0x67ba729e]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x415edd
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.LookupAccountName___failed._Error__d_n
call fcn.00416600
add esp, 8
jmp 0x4164fe
add al, ch
mov ebp, 0x840003c1
sal byte [edi + ebx - 0x7c], 0x76
call fcn.0045209f
test al, al
je 0x415f05
pop ds
test byte [esi + 0x71], dh
xchg ecx, eax
push edi
jno 0x415e71
rcl dword [edi - 0x6c], 0x85
or byte [edi - 0x15c26d63], bh
xchg esp, eax
test dword [eax], ecx
mov edi, 0xea3d929d
dec edx
wait
and ebx, esi
jg 0x415edc
scasb al, byte es:[edi]
sbb eax, 0x64bc864
push esp
in eax, 0x47
and eax, 0xb8458d45
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 4
push dword [ebp - 0x54]
mov esi, dword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
call esi
test eax, eax
jne 0x4164fe
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x7a
je 0x415f44
call ebx
push eax
push str.GetFileSecurity___failed._Error__d_n
call fcn.00416600
add esp, 8
jmp 0x4164fe
call fcn.0045230c
test al, al
je 0x415f65
push ebp
xchg edx, eax
mov bl, 0x46
fmul st(6)
scasd eax, dword es:[edi]
sub al, 0xb
invalid
push dword [ebp - 0x48]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x5c], edi
pop esi
add byte [ebx - 0x5b827608], cl
test edi, edi
je 0x415dbd
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
push edi
push 4
push dword [ebp - 0x54]
call esi
test eax, eax
jne 0x415fa4
call ebx
push eax
push str.GetFileSecurity___failed._Error__d_n
jmp 0x415dc5
call fcn.00452579
test al, al
je 0x415fc3
ja 0x415f75
shr byte [ebp + 0x6a2e85dd], 0x5f
aam 0x20
dec edx
mov edx, 0x8b44ddd5
sbb eax, sym.imp.KERNEL32.dll_GetLastError
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x415fe3
call ebx
push eax
push str.InitializeSecurityDescriptor___failed.Error__d_n
jmp 0x415dc5
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
adc eax, sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl
test eax, eax
jne 0x416007
call ebx
push eax
push str.GetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x415dc5
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp dword [ebp - 0x3c], ecx
cmove eax, ecx
mov dword [ebp - 0x38], eax
call fcn.004523db
test al, al
je 0x41604e
dec esi
mov ebp, dword [eax]
jmp 0x415ff1
call fcn.0045223d
test al, al
je 0x41606c
add byte [eax + eax*8 + 0xcf31574], al
pop es
or al, 7
sbb ah, 0xca
sbb byte [esp - 0x4e], cl
dec esi
add dword [edi - 0x4c], eax
add eax, 0xebddc9c7
cwde
xor eax, 0x3c325e8
add byte [eax + eax*8 - 0x2ea0ed8c], al
iretd
call fcn.00452396
test al, al
je 0x416087
pop edi
ror edi, 1
aas
add byte [ebp + 0x29d8805d], al
lodsb al, byte [esi]
push eax
int1
push esi
shl ecx, cl
dec esi
mov eax, dword [0xc87d83]
cmp dword [ebp - 0x38], 0
jge 0x416052
add byte [edx + 0x6a], dh
add ch, byte [edx + 0xc]
je 0x4160af
push 2
push 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x4160af
call ebx
push eax
push str.GetAclInformation___failed._Error__d_n
jmp 0x415dc5
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [ebp - 0x24]
add ecx, 8
add eax, ecx
mov dword [ebp - 0x30], eax
call fcn.004522c7
test al, al
je 0x4160e0
cmp byte [esi], ah
cmp byte [edi], 0x65
repne lodsb al, byte [esi]
jle 0x416091
mov esp, 0x87ae3f14
push edi
push ds
adc al, 0x3f
scasb al, byte es:[edi]
xchg dword [edi + 0x1e], edx
sbb dword [edx + edi*4], esi
push ecx
push ebx
call fcn.004520e4
test al, al
je 0x416107
salc
push ecx
add edx, dword [ebp - 0x22]
fnsave dword [edi]
jg 0x4160d4
test eax, 0x553f208a
inc eax
jp 0x416088
jl 0x41610d
out dx, al
pop ebp
mov dword [0xcd748e4b], eax
xor dl, ch
call fcn.004521b3
test al, al
je 0x41612f
sal byte [edi + ebx + 0x6f], 0x56
outsd dx, dword [esi]
push esi
stosb byte es:[edi], al
or eax, 0xae11c411
ljmp 0x51b
mov esi, dword [ebp - 0x30]
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x34], edi
test edi, edi
jne 0x416158
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
jmp 0x415dbf
push 2
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x416179
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.InitializeAcl___failed._Error__d_n
jmp 0x415dc5
call fcn.00451f46
test al, al
je 0x416192
test byte [edx + 0x25b8836f], 0x5d
mov eax, 0x6b1f758e
add dword [eax - 0x9cc4a87], edi
xor esi, esi
mov dword [ebp - 0x6c], esi
cmp dword [ebp - 0x38], esi
je 0x416232
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x416232
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x44], ebx
cmp ebx, eax
jae 0x416232
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x4161e2
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.GetAce___failed._Error__d_n
jmp 0x415dc5
mov eax, dword [ebp - 0x40]
test byte [eax + 1], 0x10
jne 0x416232
add eax, 8
push eax
push dword [ebp - 0x2c]
call edi
test eax, eax
jne 0x416229
mov ecx, dword [ebp - 0x40]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x416225
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.AddAce___failed._Error__d_n
jmp 0x415dc5
inc esi
mov dword [ebp - 0x6c], esi
inc ebx
mov dword [ebp - 0x64], ebx
mov eax, dword [ebp - 0x28]
jmp 0x4161b6
call fcn.004523db
test al, al
je 0x416258
add byte [eax + eax*8 - 0x6d60e28c], al
lahf
xchg edx, eax
test eax, 0x12df441c
adc al, 4
or ebx, ecx
scasb al, byte es:[edi]
int 0xe
add dword [edi - 0x7b8d983], 0xffffffa7
popfd
dec eax
jle 0x416236
mov dl, 0x7c
inc ebx
mov ch, 0xe8
xchg edx, eax
ret 3
call fcn.004524ef
test al, al
je 0x41627f
int1
mov ch, 0x51
mov byte [0xd8f88925], al
xchg ebx, eax
push ebp
lcall 0x8334, 0x4c63e3d8
cmc
imul esi, dword [edx + 0x1a], 0xffffffb9
dec ebp
sub dh, byte [ebx + 0x28]
pop eax
xor eax, 0x4c683909
sbb dword [esi], 0x5e816468
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleW
push str.AddAccessAllowedAceEx
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
push dword [ebp + 0x10]
test eax, eax
je 0x4162c1
push 3
push 2
push edi
call eax
test eax, eax
jne 0x4162e1
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.AddAccessAllowedAceEx___failed._Error__d_n
jmp 0x415dc5
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
jne 0x4162e1
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.AddAccessAllowedAce___failed._Error__d_n
jmp 0x415dc5
cmp dword [ebp - 0x38], 0
je 0x41634e
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41634e
mov ebx, dword [ebp - 0x44]
cmp ebx, eax
jae 0x41634e
lea eax, [ebp - 0x40]
push eax
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x41631a
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.GetAce___failed._Error__d_n
jmp 0x415dc5
mov ecx, dword [ebp - 0x40]
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_AddAce]
test eax, eax
jne 0x416345
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.AddAce___failed._Error__d_n
jmp 0x415dc5
inc ebx
mov dword [ebp - 0x64], ebx
mov eax, dword [ebp - 0x28]
jmp 0x4162f1
mov dword [0x3bffee8], eax
add byte [eax + eax*8 - 0x6b2e88c], al
call fcn.00452351
test al, al
je 0x41636e
dec ebp
stc
jae 0x41634d
mov bh, 0x49
scasd eax, dword es:[edi]
ror dword [esi], 0x6e
adc eax, 0x89629a7d
mov cl, 0xa8
sub bl, byte [ebx + 0x1d9b1ec8]
call fcn.004520e4
test al, al
je 0x41638f
lds esp, [ecx]
sub byte [eax + 0x1c], ch
loop 0x4163a8
lodsd eax, dword [esi]
adc eax, 0x531e4625
sti
mov ebx, dword [edx - 0x79]
and esi, dword [eax - 0x6346eb98]
shr eax, 1
fidivr dword [ebp - 0x3f7bfffd]
call fcn.0045216e
test al, al
je 0x4163b0
xchg edi, eax
mov esi, 0x1a067350
sub byte [esi - 0x37c38a56], ch
xchg esi, eax
unpckhps xmm7, xmm4
cld
adc dword [0xc298b945], edi
invalid
push 0
push dword [ebp - 0x34]
push 1
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x4163db
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.SetSecurityDescriptorDacl___failed._Error__d_n
jmp 0x415dc5
push str.SetSecurityDescriptorControl
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x41646d
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
jne 0x41642e
sal byte [ebp + 0x13], 0x8b
or eax, sym.imp.KERNEL32.dll_GetLastError
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.GetSecurityDescriptorControl___failed.Error__d_n
jmp 0x415dc5
mov eax, dword [ebp - 0x30]
test eax, 0x400
je 0x41643f
mov eax, 0x500
jmp 0x41644b
test eax, 0x1000
je 0x41646d
mov eax, 0x1000
push eax
push eax
lea eax, [ebp - 0x84]
push eax
call esi
test eax, eax
jne 0x41646d
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.SetSecurityDescriptorControl___failed.Error__d_n
jmp 0x415dc5
xor al, 0x61
pop esi
add bh, bh
rcl dword [eax + 0x68]
or byte [ebx + 0x58e9005e], al
stc
invalid
call fcn.004524ef
test al, al
je 0x416487
jno 0x41645f
test dword [edi], esp
mov cl, 0x65
out 0xb4, al
jmp 0x416418
cmp ebp, eax
insb byte es:[edi], dx
mov ebp, 0xc0840003
call fcn.004521f8
test al, al
je 0x4164af
mov cl, 0x36
invalid
call fcn.00452015
test al, al
je 0x4164ce
call fcn.0041db82
adc eax, 0x61c15807
dec ecx
xchg eax, esi
pop ebx
int 0x23
test eax, 0xf31616b9
into
jae 0x41645c
lea eax, [ebp - 0x84]
push eax
push 4
push dword [ebp - 0x54]
test dword [edi + edi*8 - 1], edi
call dword [eax + 0x6a]
add al, 0xff
jne 0x416486
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x4164f7
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ecx
push eax
push str.SetFileSecurity___failed._Error__d_n
jmp 0x415dc5
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.00416578
call fcn.004523db
test al, al
je 0x416530
cld
invalid
into
jg 0x416527
pop edi
stosb byte es:[edi], al
jl 0x416535
sub eax, 0x3c73ab4a
cli
push esi
dec esi
scasb al, byte es:[edi]
jo 0x416500
pop edi
pop eax
add byte [esi], 0xcd
mov bl, 0x8d
rcr ecx, 1
fistp word [edx]
call fcn.004524ef
test al, al
je 0x416557
invalid
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 0xc