Windows Analysis Report WmiPrvSE.exe

			E00F13422(void* __ebx) {
				int _v8;
				char _v16;
				signed int _v20;
				short _v24;
				struct _SID_IDENTIFIER_AUTHORITY _v28;
				void* _v32;
				void* _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr* _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr* _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr* _v72;
				char _v76;
				void* _v95;
				struct _SECURITY_DESCRIPTOR _v96;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t124;
				signed int _t125;
				signed int _t131;
				intOrPtr* _t133;
				int _t136;
				intOrPtr _t139;
				intOrPtr _t146;
				signed short _t152;
				intOrPtr _t153;
				signed int _t155;
				intOrPtr _t156;
				signed int _t159;
				signed short _t168;
				intOrPtr _t169;
				signed int _t173;
				intOrPtr _t174;
				signed int _t177;
				void* _t181;
				long _t182;
				intOrPtr _t184;
				intOrPtr _t191;
				intOrPtr _t196;
				intOrPtr _t203;
				void* _t224;
				void* _t253;
				void* _t262;
				void* _t263;
				struct _ACL* _t268;
				void* _t274;
				signed int _t275;
				void* _t276;
				long _t280;
				signed int _t286;

				_t224 = __ebx;
				_t124 =  *0xf4f1a4; // 0xbd26e8f
				_t125 = _t124 ^ _t286;
				_v20 = _t125;
				 *[fs:0x0] =  &_v16;
				_t275 =  *0xf53060(0, 0, _t125, _t262, _t274,  *[fs:0x0], E00F24F35, 0xffffffff);
				if(_t275 < 0) {
					L17:
					_v40 = 0;
					_push( &_v40);
					_push(E00F136C0);
					_push(1);
					_push(0);
					_push(E00F136D0);
					if( *0xf53048() < 0) {
						 *0xf53064();
						_t131 = 0xe;
						L22:
						 *[fs:0x0] = _v16;
						_pop(_t263);
						_pop(_t276);
						return E00F01CA0(_t131, _t224, _v20 ^ _t286, _t261, _t263, _t276);
					}
					_t133 = _v40;
					 *0xf512c4(_t133, 1, 1);
					 *((intOrPtr*)( *((intOrPtr*)( *_t133 + 0xc))))();
					_t136 = _v40;
					 *0xf512c4(_t136);
					 *((intOrPtr*)( *((intOrPtr*)( *_t136 + 8))))();
					if(_t275 < 0) {
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t275);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t139 =  *0xf4f014; // 0xf4f014
					if(_t139 == 0xf4f014 || ( *(_t139 + 0x1c) & 0x00000004) == 0) {
						L21:
						_t131 = _t275;
					} else {
						__eflags =  *((char*)(_t139 + 0x19)) - 2;
						if( *((char*)(_t139 + 0x19)) < 2) {
							goto L21;
						}
						_t121 = _t139 + 0x14; // 0x20000000
						_t261 = 0xf21274;
						_t122 = _t139 + 0x10; // 0x40000000
						E00F32A46(0x15, 0xf21274,  *_t122,  *_t121, _t275);
						_t131 = _t275;
					}
					goto L22;
				}
				_v96.Revision = 0;
				_v36 = 0;
				asm("stosd");
				_v32 = 0;
				_v28.Value = 0;
				asm("stosd");
				_v24 = 0x500;
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				if(InitializeSecurityDescriptor( &_v96, 1) == 0) {
					_t275 = GetLastError();
					__eflags = _t275;
					if(_t275 > 0) {
						_t275 = _t275 & 0x0000ffff | 0x80070000;
						__eflags = _t275;
					}
					 *0xf53064();
					__eflags = _t275;
					if(_t275 < 0) {
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t275);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t146 =  *0xf4f014; // 0xf4f014
					__eflags = _t146 - 0xf4f014;
					if(_t146 != 0xf4f014) {
						__eflags =  *(_t146 + 0x1c) & 0x00000004;
						if(( *(_t146 + 0x1c) & 0x00000004) != 0) {
							__eflags =  *((char*)(_t146 + 0x19)) - 2;
							if( *((char*)(_t146 + 0x19)) >= 2) {
								_t58 = _t146 + 0x14; // 0x20000000
								_t261 = 0xf21274;
								_t59 = _t146 + 0x10; // 0x40000000
								E00F32A46(0xa, 0xf21274,  *_t59,  *_t58, _t275);
							}
						}
					}
					goto L21;
				}
				if(AllocateAndInitializeSid( &_v28, 1, 0xb, 0, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
					 *0xf53064();
					_t152 = GetLastError();
					__eflags = _t152;
					if(__eflags > 0) {
						__eflags = _t152 & 0x0000ffff | 0x80070000;
					}
					if(__eflags < 0) {
						_t159 = GetLastError();
						__eflags = _t159;
						if(_t159 > 0) {
							_t159 = _t159 & 0x0000ffff | 0x80070000;
							__eflags = _t159;
						}
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t159);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t153 =  *0xf4f014; // 0xf4f014
					__eflags = _t153 - 0xf4f014;
					if(_t153 != 0xf4f014) {
						__eflags =  *(_t153 + 0x1c) & 0x00000004;
						if(( *(_t153 + 0x1c) & 0x00000004) != 0) {
							__eflags =  *((char*)(_t153 + 0x19)) - 2;
							if( *((char*)(_t153 + 0x19)) >= 2) {
								_t155 = GetLastError();
								__eflags = _t155;
								if(_t155 > 0) {
									__eflags = _t155;
								}
								_t156 =  *0xf4f014; // 0xf4f014
								_t261 = 0xf21274;
								_t64 = _t156 + 0x14; // 0x20000000
								_t65 = _t156 + 0x10; // 0x40000000
								E00F32A46(0xb, 0xf21274,  *_t65,  *_t64, _t155);
							}
						}
					}
					_t131 = GetLastError();
					__eflags = _t131;
					if(_t131 > 0) {
						_t131 = _t131 & 0x0000ffff | 0x80070000;
					}
					goto L22;
				}
				_t261 = FreeSid;
				E00F136E5( &_v64, FreeSid, _v32);
				_v8 = 0;
				if(AllocateAndInitializeSid( &_v28, 1, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v36) == 0) {
					 *0xf53064();
					_t168 = GetLastError();
					__eflags = _t168;
					if(__eflags > 0) {
						__eflags = _t168 & 0x0000ffff | 0x80070000;
					}
					if(__eflags < 0) {
						_t177 = GetLastError();
						__eflags = _t177;
						if(_t177 > 0) {
							_t177 = _t177 & 0x0000ffff | 0x80070000;
							__eflags = _t177;
						}
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t177);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t169 =  *0xf4f014; // 0xf4f014
					__eflags = _t169 - 0xf4f014;
					if(_t169 != 0xf4f014) {
						__eflags =  *(_t169 + 0x1c) & 0x00000004;
						if(( *(_t169 + 0x1c) & 0x00000004) != 0) {
							__eflags =  *((char*)(_t169 + 0x19)) - 2;
							if( *((char*)(_t169 + 0x19)) >= 2) {
								_t173 = GetLastError();
								__eflags = _t173;
								if(_t173 > 0) {
									__eflags = _t173;
								}
								_t174 =  *0xf4f014; // 0xf4f014
								_t261 = 0xf21274;
								_t70 = _t174 + 0x14; // 0x20000000
								_t71 = _t174 + 0x10; // 0x40000000
								E00F32A46(0xc, 0xf21274,  *_t71,  *_t70, _t173);
							}
						}
					}
					_t275 = GetLastError();
					__eflags = _t275;
					if(_t275 > 0) {
						_t275 = _t275 & 0x0000ffff | 0x80070000;
					}
					L113:
					_v8 = 0xffffffff;
					__eflags = _v64;
					if(_v64 != 0) {
						goto L21;
					}
					 *0xf512c4(_v56);
					 *_v60();
					_t131 = _t275;
					goto L22;
				}
				_t261 = FreeSid;
				_t181 = E00F136E5( &_v76, FreeSid, _v36);
				_v8 = 1;
				__imp__RtlLengthSid(_v32);
				_t21 = _t181 + 0x14; // 0x14
				_t280 = _t21;
				_t182 = LocalAlloc(0, _t280);
				_t268 = _t182;
				if(_t268 == 0) {
					 *0xf53064();
					__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(0x80070008);
					__imp__?Write@CMemoryLog@@QAEXJ@Z();
					_t184 =  *0xf4f014; // 0xf4f014
					__eflags = _t184 - 0xf4f014;
					if(_t184 != 0xf4f014) {
						__eflags =  *(_t184 + 0x1c) & 0x00000004;
						if(( *(_t184 + 0x1c) & 0x00000004) != 0) {
							__eflags =  *((char*)(_t184 + 0x19)) - 2;
							if( *((char*)(_t184 + 0x19)) >= 2) {
								_t76 = _t184 + 0x14; // 0x20000000
								_t261 = 0xf21274;
								_t77 = _t184 + 0x10; // 0x40000000
								E00F32A46(0xe, 0xf21274,  *_t77,  *_t76, 0x80070008);
							}
						}
					}
					_t275 = 0x80070008;
					L111:
					_v8 = 0;
					__eflags = _v76;
					if(_v76 == 0) {
						 *0xf512c4(_v68);
						 *_v72();
					}
					goto L113;
				}
				__imp__RtlCreateAcl(_t268, _t280, 2);
				if(_t182 < 0) {
					_t275 = RtlNtStatusToDosError(_t182);
					__eflags = _t275;
					if(_t275 > 0) {
						_t275 = _t275 & 0x0000ffff | 0x80070000;
						__eflags = _t275;
					}
					 *0xf53064();
					LocalFree(_t268);
					__eflags = _t275;
					if(_t275 < 0) {
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t275);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t191 =  *0xf4f014; // 0xf4f014
					__eflags = _t191 - 0xf4f014;
					if(_t191 != 0xf4f014) {
						__eflags =  *(_t191 + 0x1c) & 0x00000004;
						if(( *(_t191 + 0x1c) & 0x00000004) != 0) {
							__eflags =  *((char*)(_t191 + 0x19)) - 2;
							if( *((char*)(_t191 + 0x19)) >= 2) {
								_t82 = _t191 + 0x14; // 0x20000000
								_t261 = 0xf21274;
								_t83 = _t191 + 0x10; // 0x40000000
								E00F32A46(0xf, 0xf21274,  *_t83,  *_t82, _t275);
							}
						}
					}
					goto L111;
				}
				__imp__RtlAddAccessAllowedAce(_t268, 2, 1, _v32);
				if(_t182 < 0) {
					_t275 = RtlNtStatusToDosError(_t182);
					__eflags = _t275;
					if(_t275 > 0) {
						_t275 = _t275 & 0x0000ffff | 0x80070000;
						__eflags = _t275;
					}
					 *0xf53064();
					LocalFree(_t268);
					__eflags = _t275;
					if(_t275 < 0) {
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t275);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t196 =  *0xf4f014; // 0xf4f014
					__eflags = _t196 - 0xf4f014;
					if(_t196 != 0xf4f014) {
						__eflags =  *(_t196 + 0x1c) & 0x00000004;
						if(( *(_t196 + 0x1c) & 0x00000004) != 0) {
							__eflags =  *((char*)(_t196 + 0x19)) - 2;
							if( *((char*)(_t196 + 0x19)) >= 2) {
								_t88 = _t196 + 0x14; // 0x20000000
								_t261 = 0xf21274;
								_t89 = _t196 + 0x10; // 0x40000000
								E00F32A46(0x10, 0xf21274,  *_t89,  *_t88, _t275);
							}
						}
					}
					goto L111;
				}
				_t261 = LocalFree;
				E00F136E5( &_v52, LocalFree, _t268);
				_v8 = 2;
				if(SetSecurityDescriptorOwner( &_v96, _v36, 0) == 0) {
					_t275 = GetLastError();
					__eflags = _t275;
					if(_t275 > 0) {
						_t275 = _t275 & 0x0000ffff | 0x80070000;
						__eflags = _t275;
					}
					 *0xf53064();
					__eflags = _t275;
					if(_t275 < 0) {
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t275);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t203 =  *0xf4f014; // 0xf4f014
					__eflags = _t203 - 0xf4f014;
					if(_t203 == 0xf4f014) {
						L109:
						_v8 = 1;
						__eflags = _v52;
						if(_v52 == 0) {
							 *0xf512c4(_v44);
							 *_v48();
						}
						goto L111;
					} else {
						__eflags =  *(_t203 + 0x1c) & 0x00000004;
						if(( *(_t203 + 0x1c) & 0x00000004) == 0) {
							goto L109;
						}
						__eflags =  *((char*)(_t203 + 0x19)) - 2;
						if( *((char*)(_t203 + 0x19)) < 2) {
							goto L109;
						}
						_t253 = 0x11;
						L108:
						_t106 = _t203 + 0x14; // 0x20000000
						_t261 = 0xf21274;
						_t107 = _t203 + 0x10; // 0x40000000
						E00F32A46(_t253, 0xf21274,  *_t107,  *_t106, _t275);
						goto L109;
					}
				}
				if(SetSecurityDescriptorGroup( &_v96, _v36, 0) == 0) {
					_t275 = GetLastError();
					__eflags = _t275;
					if(_t275 > 0) {
						_t275 = _t275 & 0x0000ffff | 0x80070000;
						__eflags = _t275;
					}
					 *0xf53064();
					__eflags = _t275;
					if(_t275 < 0) {
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t275);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t203 =  *0xf4f014; // 0xf4f014
					__eflags = _t203 - 0xf4f014;
					if(_t203 == 0xf4f014) {
						goto L109;
					} else {
						__eflags =  *(_t203 + 0x1c) & 0x00000004;
						if(( *(_t203 + 0x1c) & 0x00000004) == 0) {
							goto L109;
						}
						__eflags =  *((char*)(_t203 + 0x19)) - 2;
						if( *((char*)(_t203 + 0x19)) < 2) {
							goto L109;
						}
						_t253 = 0x12;
						goto L108;
					}
				}
				if(SetSecurityDescriptorDacl( &_v96, 1, _t268, 0) == 0) {
					_t275 = GetLastError();
					__eflags = _t275;
					if(_t275 > 0) {
						_t275 = _t275 & 0x0000ffff | 0x80070000;
						__eflags = _t275;
					}
					 *0xf53064();
					__eflags = _t275;
					if(_t275 < 0) {
						__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t275);
						__imp__?Write@CMemoryLog@@QAEXJ@Z();
					}
					_t203 =  *0xf4f014; // 0xf4f014
					__eflags = _t203 - 0xf4f014;
					if(_t203 == 0xf4f014) {
						goto L109;
					} else {
						__eflags =  *(_t203 + 0x1c) & 0x00000004;
						if(( *(_t203 + 0x1c) & 0x00000004) == 0) {
							goto L109;
						}
						__eflags =  *((char*)(_t203 + 0x19)) - 2;
						if( *((char*)(_t203 + 0x19)) < 2) {
							goto L109;
						}
						_t253 = 0x13;
						goto L108;
					}
				}
				_t275 =  *0xf5304c( &_v96, 0xffffffff, 0, 0, 2, 3, 0, 0x40, 0);
				if(_t275 < 0) {
					 *0xf53064();
					__imp__?GetMemLogObject@@YGPAVCMemoryLog@@XZ(_t275);
					__imp__?Write@CMemoryLog@@QAEXJ@Z();
					_t203 =  *0xf4f014; // 0xf4f014
					__eflags = _t203 - 0xf4f014;
					if(_t203 == 0xf4f014) {
						goto L109;
					}
					__eflags =  *(_t203 + 0x1c) & 0x00000004;
					if(( *(_t203 + 0x1c) & 0x00000004) == 0) {
						goto L109;
					}
					__eflags =  *((char*)(_t203 + 0x19)) - 2;
					if( *((char*)(_t203 + 0x19)) < 2) {
						goto L109;
					}
					_t253 = 0x14;
					goto L108;
				} else {
					_v8 = 1;
					if(_v52 == 0) {
						 *0xf512c4(_v44);
						 *_v48();
					}
					_v8 = 0;
					if(_v76 == 0) {
						 *0xf512c4(_v68);
						 *_v72();
					}
					_v8 = 0xffffffff;
					if(_v64 == 0) {
						 *0xf512c4(_v56);
						 *_v60();
					}
					goto L17;
				}
			}