Function at 0x1000ae96
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0x480
call fcn.10006f84
pop ecx
mov ebx, eax
mov esi, 0x100
push esi
push ebx
mov dword [esp + 0x2c], ebx
call fcn.10007086
push esi
push ebx
mov dword [esp + 0x2c], eax
call fcn.10007086
push esi
push ebx
mov dword [esp + 0x38], eax
call fcn.10007086
lea edi, [esi - 0x80]
push edi
push ebx
mov dword [esp + 0x38], eax
call fcn.10007086
push edi
push ebx
call fcn.10007086
mov eax, dword [ebp + 8]
and dword [esp + 0x3c], 0
push edi
push ebx
mov dword [0x100417ec], eax
call fcn.10007086
push edi
push 0
push eax
mov dword [0x100417e8], eax
call fcn.1001ed20
add esp, 0x3c
call fcn.1000b1ce
mov ebx, 0x400
push ebx
call fcn.10017001
pop ecx
push ebx
mov edi, eax
push 0
push edi
mov dword [0x100417f0], edi
call fcn.1001ed20
add esp, 0xc
push 0
push 1
push 1
push ebx
push edi
call fcn.1000d265
add esp, 0x14
push 8
pop ecx
call fcn.1000b1c3
movzx edi, ax
test di, di
jbe 0x1000afae
push 0
call fcn.10002c13
pop ecx
push eax
call sub.WS2_32.dll_htonl
mov dword [esp + 0x10], eax
cmp di, 1
jne 0x1000af76
and dword [esp + 0x10], 0xff000000
jmp 0x1000af94
cmp di, 2
jne 0x1000af86
and dword [esp + 0x10], 0xffff0000
jmp 0x1000af94
cmp di, 3
jne 0x1000af94
and dword [esp + 0x10], 0xffffff00
lea eax, [esp + 0x10]
push eax
push 0x1000
push str.._._._.._._.__
push 4
pop edi
call fcn.1000ad98
add esp, 0xc
push 7
pop ecx
call fcn.1000b1b8
movzx edi, ax
test di, di
jbe 0x1000afe1
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push ebx
push 6
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push dword [esp + 0xc]
movzx eax, di
call fcn.1000ae3c
pop ecx
push 6
pop ecx
call fcn.1000b1b8
movzx edi, ax
test di, di
jbe 0x1000b012
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push dword [esp + 0xc]
movzx eax, di
call fcn.1000ae3c
pop ecx
push 5
pop ecx
call fcn.1000b1b8
movzx edi, ax
test di, di
jbe 0x1000b047
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
dec dword [esp + 0xc]
push dword [esp + 0xc]
movzx eax, di
call fcn.1000ae3c
pop ecx
xor eax, eax
mov edi, 0x1000
xor byte [eax + str.._._._.._._.__], 0x2e
inc eax
cmp eax, edi
jl 0x1000b04e
push 9
pop ecx
call fcn.1000b1c3
mov esi, eax
test esi, esi
je 0x1000b0a3
xor ecx, ecx
mov eax, ecx
cdq
push 3
pop ebx
idiv ebx
movsx edi, byte [ecx + str.._._._.._._.__]
and edi, 0xff
inc edx
imul edi, edx
add edi, dword [esp + 0x14]
xor edx, edx
mov eax, edi
mov edi, 0x5f5e0ff
div edi
inc ecx
mov edi, 0x1000
cmp ecx, edi
mov dword [esp + 0x14], edx
jl 0x1000b06a
dec esi
jmp 0x1000b0a9
xor esi, esi
and dword [esp + 0x14], esi
push edi
lea eax, [esp + 0x2c]
push str.._._._.._._.__
push eax
call fcn.10006fff
add esp, 0xc
cmp esi, dword [esp + 0x14]
jne 0x1000b183
jmp 0x1000b16c
lea eax, [esp + 0x28]
push eax
call fcn.1000705b
movzx edi, ax
pop ecx
lea eax, [esp + 0x28]
push eax
call fcn.1000705b
movsx ebx, si
pop ecx
movzx ecx, ax
mov eax, dword [0x100417f0]
shl ebx, 3
lea esi, [ebx + eax]
movsx eax, di
dec eax
mov word [esi], di
je 0x1000b156
dec eax
je 0x1000b13f
dec eax
jne 0x1000b16c
movsx edi, cx
push edi
call fcn.10017001
pop ecx
push edi
mov dword [esi + 4], eax
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.10007086
pop ecx
pop ecx
push eax
push dword [esi + 4]
call fcn.1001db30
add esp, 0xc
push 0
push 1
push 1
push edi
push dword [esi + 4]
call fcn.1000d265
add esp, 0x14
jmp 0x1000b16c
lea eax, [esp + 0x28]
push eax
call fcn.10007018
pop ecx
mov ecx, dword [0x100417f0]
mov dword [ebx + ecx + 4], eax
jmp 0x1000b16c
lea eax, [esp + 0x28]
push eax
call fcn.1000705b
pop ecx
mov ecx, dword [0x100417f0]
mov word [ebx + ecx + 4], ax
lea eax, [esp + 0x28]
push eax
call fcn.1000705b
movzx esi, ax
pop ecx
test si, si
jg 0x1000b0cb
push dword [esp + 0x24]
call fcn.10006fcf
mov dword [esp], 0x1000
push 0
push str.._._._.._._.__
call fcn.1001ed20
add esp, 0xc
push 0x11
pop ecx
call fcn.1000ae21
mov esi, eax
call fcn.1000c58f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret