Function at 0x406cb5
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get hostname
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
cmp dword [0x519840], 0
push ebx
push esi
push edi
jne 0x406f31
mov byte [ebp - 0x3a], 0x58
xor ebx, ebx
mov byte [ebp - 0x39], 5
mov byte [ebp - 0x38], 0x6a
mov byte [ebp - 0x37], 5
mov byte [ebp - 0x36], 0x59
mov byte [ebp - 0x35], 5
mov byte [ebp - 0x34], 0x66
mov byte [ebp - 0x33], 5
mov byte [ebp - 0x32], 0x70
mov byte [ebp - 0x31], 5
mov byte [ebp - 0x30], 0x6a
mov byte [ebp - 0x2f], 5
mov byte [ebp - 0x2e], 0x54
mov byte [ebp - 0x2d], 5
mov byte [ebp - 0x2c], 0x7c
mov byte [ebp - 0x2b], 5
mov byte [ebp - 0x2a], 0x73
mov byte [ebp - 0x29], 5
mov byte [ebp - 0x28], 0x6a
mov byte [ebp - 0x27], 5
mov byte [ebp - 0x26], 0x77
mov byte [ebp - 0x25], 5
mov byte [ebp - 0x24], 0x78
mov byte [ebp - 0x23], 5
mov byte [ebp - 0x22], 0x6d
mov byte [ebp - 0x21], 5
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1f], 5
mov byte [ebp - 0x1e], 0x75
mov byte [ebp - 0x1d], 5
mov byte [ebp - 0x1c], 0x55
mov byte [ebp - 0x1b], 5
mov byte [ebp - 0x1a], 0x77
mov byte [ebp - 0x19], 5
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 5
mov byte [ebp - 0x16], 0x7b
mov byte [ebp - 0x15], 5
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 5
mov byte [ebp - 0x12], 0x71
mov byte [ebp - 0x11], 5
mov byte [ebp - 0x10], 0x6a
mov byte [ebp - 0xf], 5
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 5
mov byte [ebp - 0xc], 0x6a
mov byte [ebp - 0xb], 5
mov byte [ebp - 0xa], 5
mov byte [ebp - 9], bl
mov al, byte [ebp - 0x3a]
mov eax, ebx
sub byte [ebp + eax - 0x3a], 5
inc eax
cmp eax, 0x31
jb 0x406d9c
xor esi, esi
lea ecx, [ebp - 0x3a]
inc esi
mov edx, esi
call fcn.00406c41
test eax, eax
je 0x406f31
lea eax, [ebp - 0x40]
mov edi, 0x100
push eax
lea eax, [ebp - 0x860]
mov dword [ebp - 0x40], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x406f31
mov dword [ebp - 8], 0x6d
mov edx, ebx
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x6d
mov byte [ebp - 2], 0x6d
mov al, byte [ebp - 4]
mov byte [ebp - 1], bl
mov al, byte [ebp + edx - 4]
mov ecx, dword [ebp - 8]
xor cl, al
mov byte [ebp + edx - 4], cl
inc edx
cmp edx, 3
jb 0x406df8
lea eax, [ebp - 4]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0x860]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], edi
push eax
lea eax, [ebp - 0x860]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x860]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x406f31
mov ecx, edi
call fcn.00405c2d
mov dword [0x519840], eax
test eax, eax
je 0x406f31
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x48], edi
push ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], edi
push ecx
lea ecx, [ebp - 0xa60]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
lea eax, [ebp - 0x860]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x406f1c
push esi
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x406f1c
push ebx
push ebx
push esi
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x406f1c
push ebx
push dword [0x519840]
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
test eax, eax
je 0x406f1c
push 0x20
pop ecx
mov eax, 0x519844
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x406ecc
push dword [0x519840]
push 0x519850
call dword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
push 0x519828
mov dword [0x519844], 0x10000000
mov dword [0x519848], 2
mov dword [0x51984c], 3
mov dword [0x519858], ebx
mov dword [0x51985c], esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x406f31
mov ecx, dword [0x519840]
test ecx, ecx
je 0x406f31
call fcn.00405cd2
mov dword [0x519840], ebx
pop edi
pop esi
pop ebx
leave
ret