Function at 0x401ad0
Capabilities:
Encode data using xor
Get common file path
Get disk information
Get hostname
Get session user name
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x11c]
push ecx
xor ebx, ebx
xor esi, esi
mov dword [ebp - 8], 0xfe
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x401b03
xor edi, edi
mov dword [ebp - 8], edi
jmp 0x401b06
mov edi, dword [ebp - 8]
mov dword [ebp - 0x14], edi
test edi, edi
je 0x401b41
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov esi, edi
test ebx, ebx
jne 0x401b29
xor esi, esi
jmp 0x401b41
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x11c]
sub edi, eax
push edx
add edi, ebx
push edi
call sub.ntdll.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x11c]
push ecx
mov dword [ebp - 8], 0xfe
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x401b62
mov dword [ebp - 8], eax
jmp 0x401b65
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x401bbf
lea edi, [esi + eax]
test edi, edi
je 0x401ba8
push edi
test esi, esi
jle 0x401b8a
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x401b99
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov esi, edi
test ebx, ebx
jne 0x401ba5
xor esi, esi
jmp 0x401bbf
mov eax, dword [ebp - 0x14]
push eax
mov ecx, ebx
lea edx, [ebp - 0x11c]
sub ecx, eax
push edx
add ecx, esi
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0xff
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
lea ecx, [ebp - 0x11c]
push ecx
mov byte [ebp - 0x119], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea edi, [esi + 4]
test edi, edi
je 0x401c35
push edi
test esi, esi
jle 0x401c1a
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x401c29
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov esi, edi
test ebx, ebx
jne 0x401c35
xor esi, esi
jmp 0x401c3c
mov edx, dword [ebp - 0x1c]
mov dword [ebx + esi - 4], edx
or eax, 0xffffffff
mov ecx, esi
mov edx, ebx
test esi, esi
je 0x401c69
jmp 0x401c50
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4061b0]
inc edx
dec ecx
jne 0x401c50
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 4
not eax
push 0
mov dword [ebp - 0x14], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x401c94
mov dword [ebp - 0xc], eax
jmp 0x401c99
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
push 0x10
call section..text
add esp, 8
cmp dword [ebp - 0xc], 0
jle 0x401cbf
mov eax, dword [ebp - 0x10]
push eax
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xff
test esi, esi
jle 0x401cd6
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x401ce1
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
xor esi, esi
mov dword [ebp - 0x14], 0xff
cmp edi, esi
jne 0x401cf3
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 8]
push edx
push edi
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x401d0f
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x401d12
mov ebx, dword [ebp - 8]
cmp edi, esi
je 0x401d2b
cmp ebx, esi
je 0x401d2b
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
push edi
lea esi, [ebp - 0x10]
call fcn.00403e90
xor esi, esi
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push 4
call section..text
add esp, 8
cmp dword [ebp - 0xc], esi
jle 0x401d53
mov ecx, dword [ebp - 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x401d6f
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x401d72
mov ebx, dword [ebp - 8]
cmp edi, esi
je 0x401d8b
cmp ebx, esi
je 0x401d8b
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
push edi
lea esi, [ebp - 0x10]
call fcn.00403e90
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 5
call section..text
add esp, 8
cmp dword [ebp - 0xc], esi
jle 0x401db3
mov edx, dword [ebp - 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x14], esi
jle 0x401dc7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret