Function at 0x40783a
Capabilities:
Contain obfuscated stackstrings
Get hostname
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
push ebx
push esi
push edi
mov byte [ebp - 0x36], 0x5f
mov byte [ebp - 0x35], 0xc
mov byte [ebp - 0x34], 0x71
mov byte [ebp - 0x33], 0xc
mov byte [ebp - 0x32], 0x60
mov byte [ebp - 0x31], 0xc
mov byte [ebp - 0x30], 0x6d
mov byte [ebp - 0x2f], 0xc
mov byte [ebp - 0x2e], 0x77
mov byte [ebp - 0x2d], 0xc
mov byte [ebp - 0x2c], 0x71
mov byte [ebp - 0x2b], 0xc
mov byte [ebp - 0x2a], 0x5b
mov byte [ebp - 0x29], 0xc
mov byte [ebp - 0x28], 0x83
mov byte [ebp - 0x27], 0xc
mov byte [ebp - 0x26], 0x7a
mov byte [ebp - 0x25], 0xc
mov byte [ebp - 0x24], 0x71
mov byte [ebp - 0x23], 0xc
mov byte [ebp - 0x22], 0x7e
mov byte [ebp - 0x21], 0xc
mov byte [ebp - 0x20], 0x7f
mov byte [ebp - 0x1f], 0xc
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0xc
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0xc
mov byte [ebp - 0x1a], 0x7c
mov byte [ebp - 0x19], 0xc
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0xc
mov byte [ebp - 0x16], 0x7e
mov byte [ebp - 0x15], 0xc
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0xc
mov byte [ebp - 0x12], 0x82
mov byte [ebp - 0x11], 0xc
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0xc
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0xc
mov byte [ebp - 0xc], 0x71
mov byte [ebp - 0xb], 0xc
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0xc
mov byte [ebp - 8], 0x71
mov byte [ebp - 7], 0xc
xor ebx, ebx
mov byte [ebp - 6], 0xc
mov byte [ebp - 5], bl
mov al, byte [ebp - 0x36]
mov eax, ebx
sub byte [ebp + eax - 0x36], 0xc
inc eax
cmp eax, 0x31
jb 0x407914
xor esi, esi
lea ecx, [ebp - 0x36]
inc esi
mov edx, esi
call fcn.004077c6
test eax, eax
je 0x407a97
lea eax, [ebp - 0x3c]
mov edi, 0x100
push eax
lea eax, [ebp - 0x860]
mov dword [ebp - 0x3c], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x407a97
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 8
mov byte [ebp - 2], 8
mov byte [ebp - 1], bl
mov al, byte [ebp - 4]
mov eax, ebx
sub byte [ebp + eax - 4], 8
inc eax
cmp eax, 3
jb 0x407969
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x860]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
lea eax, [ebp - 0x860]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x860]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x407a97
mov ecx, edi
call fcn.004067f9
mov dword [0x419530], eax
test eax, eax
je 0x407a97
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x44], edi
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
push ecx
lea ecx, [ebp - 0xa60]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push eax
lea eax, [ebp - 0x860]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x407a82
push esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x407a82
push ebx
push ebx
push esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x407a82
push ebx
push dword [0x419530]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
test eax, eax
je 0x407a82
push 0x20
pop ecx
mov eax, 0x419534
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x407a32
push dword [0x419530]
push 0x419540
call dword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
push 0x419518
mov dword [0x419534], 0x10000000
mov dword [0x419538], 2
mov dword [0x41953c], 3
mov dword [0x419548], ebx
mov dword [0x41954c], esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x407a97
mov ecx, dword [0x419530]
test ecx, ecx
je 0x407a97
call fcn.0040689e
mov dword [0x419530], ebx
pop edi
pop esi
pop ebx
leave
ret