Function at 0x413ec0
Capabilities:
Contain obfuscated stackstrings
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x4d3dfb
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x54d158]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push ebp
push esi
mov eax, dword [0x54d158]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov dword [esp + 0x48], edi
push fcn.00414c70
push 0x413920
push 2
push 0x30
lea esi, [edi + 4]
mov dword [esp + 0x274], 1
push esi
mov dword [edi], vtable.Cy_MipConfiguration.0
call fcn.004adf3d
push fcn.00414d50
push 0x413b60
push 0x1f
push 0x2c
lea ebp, [edi + 0x64]
push ebp
mov byte [esp + 0x278], 2
call fcn.004adf3d
lea ecx, [edi + 0x5bc]
mov byte [esp + 0x264], 3
call fcn.00474bb0
lea ecx, [edi + 0x5c8]
mov byte [esp + 0x264], 4
call fcn.00474bb0
lea ecx, [edi + 0x5d0]
mov byte [esp + 0x264], 5
call fcn.00474bb0
lea eax, [edi + 0x5d4]
push eax
mov byte [esp + 0x268], 6
call fcn.00414e10
lea ecx, [edi + 0x5e4]
mov byte [esp + 0x264], 7
call fcn.00474bb0
lea ecx, [edi + 0x5e8]
mov byte [esp + 0x264], 8
call fcn.00474bb0
lea ecx, [edi + 0x5ec]
mov byte [esp + 0x264], 9
call fcn.00474bb0
lea ecx, [edi + 0x5f0]
mov byte [esp + 0x264], 0xa
call fcn.00474bb0
lea ecx, [edi + 0x5f4]
mov byte [esp + 0x264], 0xb
call fcn.00474bb0
lea ecx, [edi + 0x5f8]
mov byte [esp + 0x264], 0xc
call fcn.00474bb0
lea ecx, [edi + 0x5fc]
mov byte [esp + 0x264], 0xd
call fcn.00474bb0
lea ecx, [edi + 0x600]
mov byte [esp + 0x264], 0xe
call fcn.00474bb0
mov bl, 0xf
mov byte [esp + 0x264], bl
mov dword [edi + 0x5b8], 0
call fcn.00413e00
test eax, eax
je 0x414085
push str.C:Users_User_AppDataLocalLow_
push str.C:Users_User_AppDataLocal_
push str.C:Users_User_AppDataRoaming_
push str.C:Program_Files_
push str.C:WindowsSysWOW64_
push str.C:Windows_
push 0x51d59c
push str.WIN32
lea ecx, [esp + 0x30]
push ecx
call fcn.00413a00
mov byte [esp + 0x264], 0x10
jmp 0x414149
call fcn.0042f480
test eax, eax
je 0x4140ca
push str.C:Users_User_AppDataLocalLow_
push str.C:Users_User_AppDataLocal_
push str.C:Users_User_AppDataRoaming_
push str.C:Program_Files_
push str.C:WindowsSystem32_
push str.C:Windows_
push 0x51d59c
push str.WIN32
lea edx, [esp + 0x30]
push edx
call fcn.00413a00
mov byte [esp + 0x264], 0x11
jmp 0x414149
call fcn.0042f580
test eax, eax
je 0x41410f
push str.C:Documents_and_Settings_User_LocalLow_
push str.C:Documents_and_Settings_User_Local_SettingsApplication_Data_
push str.C:Documents_and_Settings_User_Application_Data_
push str.C:Program_Files_
push str.C:WindowsSystem32_
push str.C:Windows_
push 0x51d59c
push str.WIN32
lea eax, [esp + 0x30]
push eax
call fcn.00413a00
mov byte [esp + 0x264], 0x12
jmp 0x414149
push str._Windows_LocalLow_
push str._Windows_Local_SettingsApplication_Data
push str._Windows_Application_Data_
push str.C:Program_Files_
push str.C:WindowsSystem_
push str.C:Windows_
push 0x51d59c
push str.WIN32
lea ecx, [esp + 0x30]
push ecx
call fcn.00413a00
mov byte [esp + 0x264], 0x13
call fcn.00414f00
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414c70
push str.LocalLow
push 0x51d808
push 0x51d84c
push str.Program_Files_
push str.Windows_
push str.Windows_
push 0x51cb10
push 0x51d8a8
lea edx, [esp + 0x30]
push edx
call fcn.00413a00
lea esi, [edi + 0x34]
mov byte [esp + 0x264], 0x14
call fcn.00414f00
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414c70
push str.MiPlatform3
push str._INSTALL_
push str.MiPlatform3.exe
push str.MiPlatform3
push 1
push 0x51d8e8
push 0x51d8a8
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
mov esi, ebp
mov byte [esp + 0x264], 0x15
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310
push str._INSTALL_
push str.MiPlatform310.exe
push str.MiPlatform310
push 1
push 0x51d930
push 0x51d8a8
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x90]
mov byte [esp + 0x264], 0x16
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform320
push str._INSTALL_
push str.MiPlatform320.exe
push str.MiPlatform320
push 1
push 0x51d978
push 0x51d8a8
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0xbc]
mov byte [esp + 0x264], 0x17
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform3
push str._SYSTEM_
push str.MiPlatform3.exe
push str.MiPlatform3
push 0
push 0x51d8e8
push str.WIN32
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0xe8]
mov byte [esp + 0x264], 0x18
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform3U
push str._SYSTEM_
push str.MiPlatform3U.exe
push str.MiPlatform3U
push 0
push 0x51d8e8
push str.WIN32U
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x114]
mov byte [esp + 0x264], 0x19
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform3
push str._INSTALL_
push str.MiSimulator3.exe
push str.MiPlatform3
push 0
push 0x51d8e8
push 0x51d9f4
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0x140]
mov byte [esp + 0x264], 0x1a
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform3U
push str._INSTALL_
push str.MiSimulator3U.exe
push str.MiPlatform3U
push 0
push 0x51d8e8
push str.SIMU
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x16c]
mov byte [esp + 0x264], 0x1b
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310
push str._WINDOW_
push str.MiPlatform310.exe
push str.MiPlatform310
push 0
push 0x51d930
push str.WIN32
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x198]
mov byte [esp + 0x264], 0x1c
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310U
push str._WINDOW_
push str.MiPlatform310U.exe
push str.MiPlatform310U
push 0
push 0x51d930
push str.WIN32U
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0x1c4]
mov byte [esp + 0x264], 0x1d
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310
push str._WINDOW_
push str.MiSimulator310.exe
push str.MiPlatform310
push 0
push 0x51d930
push 0x51d9f4
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x1f0]
mov byte [esp + 0x264], 0x1e
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310U
push str._WINDOW_
push str.MiSimulator310U.exe
push str.MiPlatform310U
push 0
push 0x51d930
push str.SIMU
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x21c]
mov byte [esp + 0x264], 0x1f
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310L
push str._WINDOW_
push str.MiPlatform310L.exe
push str.MiPlatform310L
push 0
push str.3.1L
push str.WIN32
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0x248]
mov byte [esp + 0x264], 0x20
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310LU
push str._WINDOW_
push str.MiPlatform310LU.exe
push str.MiPlatform310LU
push 0
push str.3.1L
push str.WIN32U
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x274]
mov byte [esp + 0x264], 0x21
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310L
push str._WINDOW_
push str.MiSimulator310L.exe
push str.MiPlatform310L
push 0
push str.3.1L
push 0x51d9f4
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x2a0]
mov byte [esp + 0x264], 0x22
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310LU
push str._WINDOW_
push str.MiSimulator310LU.exe
push str.MiPlatform310LU
push 0
push str.3.1L
push str.SIMU
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0x2cc]
mov byte [esp + 0x264], 0x23
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310P
push str._WINDOW_
push str.MiPlatform310p.exe
push str.MiPlatform310p
push 0
push str.3.1P
push str.WIN32
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x2f8]
mov byte [esp + 0x264], 0x24
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform310PU
push str._WINDOW_
push str.MiPlatform310pU.exe
push str.MiPlatform310pU
push 0
push str.3.1P
push str.WIN32U
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x324]
mov byte [esp + 0x264], 0x25
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform311
push str._WINDOW_
push str.MiPlatform311.exe
push str.MiPlatform311
push 0
push str.3.11
push str.WIN32
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
mov byte [esp + 0x264], 0x26
lea esi, [edi + 0x350]
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform311U
push str._WINDOW_
push str.MiPlatform311U.exe
push str.MiPlatform311U
push 0
push str.3.11
push str.WIN32U
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x37c]
mov byte [esp + 0x264], 0x27
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform311
push str._WINDOW_
push str.MiSimulator311.exe
push str.MiPlatform311
push 0
push str.3.11
push 0x51d9f4
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x3a8]
mov byte [esp + 0x264], 0x28
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform311U
push str._WINDOW_
push str.MiSimulator311U.exe
push str.MiPlatform311U
push 0
push str.3.11
push str.SIMU
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0x3d4]
mov byte [esp + 0x264], 0x29
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform320
push str._INSTALL_
push str.MiPlatform320.exe
push str.MiPlatform320
push 0
push 0x51d978
push str.WIN32
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x400]
mov byte [esp + 0x264], 0x2a
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform320U
push str._INSTALL_
push str.MiPlatform320U.exe
push str.MiPlatform320U
push 0
push 0x51d978
push str.WIN32U
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x42c]
mov byte [esp + 0x264], 0x2b
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform320
push str._INSTALL_
push str.MiSimulator320.exe
push str.MiPlatform320
push 0
push 0x51d978
push 0x51d9f4
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0x458]
mov byte [esp + 0x264], 0x2c
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform320U
push str._INSTALL_
push str.MiSimulator320U.exe
push str.MiPlatform320U
push 0
push 0x51d978
push str.SIMU
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x484]
mov byte [esp + 0x264], 0x2d
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform330
push str._INSTALL_
push str.MiPlatform330.exe
push str.MiPlatform330
push 0
push 0x51de4c
push str.WIN32
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x4b0]
mov byte [esp + 0x264], 0x2e
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform330U
push str._INSTALL_
push str.MiPlatform330U.exe
push str.MiPlatform330U
push 0
push 0x51de4c
push str.WIN32U
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0x4dc]
mov byte [esp + 0x264], 0x2f
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform330
push str._INSTALL_
push str.MiSimulator330.exe
push str.MiPlatform330
push 0
push 0x51de4c
push 0x51d9f4
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x508]
mov byte [esp + 0x264], 0x30
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform330U
push str._INSTALL_
push str.MiSimulator330U.exe
push str.MiPlatform330U
push 0
push 0x51de4c
push str.SIMU
lea ecx, [esp + 0x2c]
push ecx
call fcn.00413c20
lea esi, [edi + 0x534]
mov byte [esp + 0x264], 0x31
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform
push str._INSTALL_
push str.MiPlatform.exe
push str.MiPlatform
push 1
push 0x51cd44
push 0x51d8a8
lea edx, [esp + 0x2c]
push edx
call fcn.00413c20
lea esi, [edi + 0x560]
mov byte [esp + 0x264], 0x32
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push str.MiPlatform
push str._INSTALL_
push str.MiPlatform.exe
push str.MiPlatform
push 0
push 0x51cd44
push str.WIN32
lea eax, [esp + 0x2c]
push eax
call fcn.00413c20
lea esi, [edi + 0x58c]
mov byte [esp + 0x264], 0x33
call fcn.00414fa0
lea ecx, [esp + 0x10]
mov byte [esp + 0x264], bl
call fcn.00414d50
push 0xffffffffffffffff
push 0x51d8e8
lea ecx, [edi + 0x5c8]
call fcn.00473ec0
push 0xffffffffffffffff
push str.WIN32
lea ecx, [edi + 0x5bc]
call fcn.00473ec0
push 0xffffffffffffffff
push str.Demo
lea ecx, [edi + 0x5d0]
call fcn.00473ec0
mov esi, dword [esp + 0x26c]
cmp dword [esi - 0xc], 0
jle 0x414b47
push 0xffffffffffffffff
push esi
jmp 0x414b66
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x50]
push edx
mov dword [esp + 0x48], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0xffffffffffffffff
lea eax, [esp + 0x50]
push eax
lea ecx, [edi + 0x5fc]
call fcn.00473ec0
mov ecx, dword [esp + 0x270]
mov ebp, dword [esp + 0x274]
push 0xffffffffffffffff
mov dword [edi + 0x604], ecx
lea ebx, [edi + 0x600]
push ebp
mov ecx, ebx
call fcn.00473ec0
cmp dword [edi + 0x5b8], 0
mov dword [edi + 0x5cc], 3
mov dword [edi + 0x5c0], 0
jne 0x414bcc
push ecx
mov ecx, esp
mov dword [esp + 0x48], esp
push ebx
call fcn.004755e0
mov edx, dword [edi + 0x604]
push edx
push edi
call fcn.004177d0
lea eax, [esi - 0x10]
mov byte [esp + 0x264], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414bf0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x264], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414c17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004ac89d
add esp, 0x258
ret 0xc