Function at 0x433f00
Capabilities:
Encode data using xor
Get session user name

Disassembly:
sub esp, 0x32c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x340]
push edi
push 0x1b00
mov ecx, 5
lea edi, [esp + 0x28]
push 0x40
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xfc]
push ecx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor edi, edi
xor esi, esi
mov dword [esp + 0x68], 0x473234
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x340]
mov eax, dword [ebp + esi*4 + 0x28]
mov edx, eax
and edx, 0xff0000
mov ebx, eax
shr ebx, 0x10
or edx, ebx
mov ebx, eax
shl ebx, 0x10
and eax, 0xff00
or ebx, eax
shr edx, 8
shl ebx, 8
lea ecx, [esi*4]
or edx, ebx
cmp ecx, 0x10
mov dword [esp + ecx + 0x1fc], edx
jge 0x433fa0
mov eax, 3
jmp 0x433fc7
cmp ecx, 0x20
jge 0x433fac
mov eax, 2
jmp 0x433fc7
cmp ecx, 0x30
jge 0x433fb8
mov eax, 0xfffffffc
jmp 0x433fc7
xor eax, eax
cmp ecx, 0x40
setge al
dec eax
and eax, 4
add eax, 0xfffffffd
mov dword [esp + ecx + 0x78], eax
xor eax, eax
mov ah, byte [esp + esi + 0xfb]
xor edx, edx
mov dl, byte [esp + esi + 0xf8]
mov al, byte [esp + esi + 0xf9]
shl eax, 8
or eax, edx
inc esi
cmp esi, 0x10
mov dword [esp + ecx + 0xb8], eax
mov dword [esp + 0x10], esi
jl 0x433f58
cmp esi, 0x50
mov eax, 0x30
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
jge 0x434049
mov edx, 0x50
lea ecx, [esp + esi*4 + 0x1c4]
sub edx, esi
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x2c]
mov ebx, dword [ecx - 8]
xor eax, esi
mov esi, dword [ecx]
xor eax, ebx
xor eax, esi
mov esi, eax
shr esi, 0x1f
add eax, eax
or esi, eax
mov dword [ecx + 0x38], esi
add ecx, 4
dec edx
jne 0x434026
mov edx, dword [esp + 0xb8]
mov ecx, dword [esp + 0x24]
and edx, 0x3f
push edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov dword [esp + ecx*4 + 0x78], eax
mov eax, dword [esp + 0xbc]
and eax, 1
inc ecx
push eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x78], eax
inc ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0xc0]
and ecx, 0xf
push ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x28]
mov edi, dword [esp + 0x30]
mov dword [esp + ecx*4 + 0x78], eax
mov eax, dword [esp + 0x34]
or edx, 0x80000000
inc ecx
mov dword [esp + ecx*4 + 0x78], edx
mov edx, dword [ebp + 0x2c]
and edx, 0xffffff
mov dword [esp + 0x18], eax
mov dword [esp + ecx*4 + 0x7c], edx
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
fild qword [esp + 0x1c]
call sub.MSVCRT.dll__CIacos
call sub.MSVCRT.dll__ftol
mov ebp, eax
cmp ebp, 0x50
mov dword [esp + 0x10], ebp
jge 0x4341eb
lea ecx, [esp + ebp*4 + 0x1fc]
mov dword [esp + 0x1c], ecx
cmp ebp, 0x10
jge 0x43411f
mov edx, edi
xor edx, ebx
jmp 0x434156
cmp ebp, 0x20
jge 0x434132
mov edx, esi
not edx
mov eax, ebx
and edx, edi
and eax, esi
or edx, eax
jmp 0x434158
cmp ebp, 0x30
jge 0x434141
mov edx, ebx
not edx
or edx, esi
xor edx, edi
jmp 0x434158
cmp ebp, 0x40
mov edx, edi
not edx
jge 0x434154
mov ecx, edi
and edx, ebx
and ecx, esi
or edx, ecx
jmp 0x434158
or edx, ebx
xor edx, esi
cmp ebp, 0x10
jge 0x434167
mov dword [esp + 0x10], 0
jmp 0x43419c
cmp ebp, 0x20
jge 0x434176
mov dword [esp + 0x10], 0x5a827999
jmp 0x43419c
cmp ebp, 0x30
jge 0x434185
mov dword [esp + 0x10], 0x6ed9eba1
jmp 0x43419c
xor eax, eax
cmp ebp, 0x40
setge al
dec eax
and eax, 0xe5c7bf8e
add eax, 0xa953fd4e
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x1b
shl eax, 5
or ecx, eax
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add ecx, edx
add ecx, eax
mov eax, dword [esp + 0x1c]
add ecx, dword [eax]
mov edx, esi
shr esi, 2
shl edx, 0x1e
or edx, esi
mov esi, dword [esp + 0x14]
inc ebp
add eax, 4
cmp ebp, 0x50
mov dword [esp + 0x18], edi
mov edi, ebx
mov ebx, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jl 0x434114
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x84]
test eax, 0x78000000
jne 0x4341fe
or eax, 0x98000000
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
add edx, ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x24], edx
add dword [esp + 0x2c], ebx
lea edx, [esp + 0x58]
push edx
push ecx
push eax
push 0x90
push 0
add ebp, esi
mov esi, dword [esp + 0x60]
push 0
lea edx, [esp + 0x80]
push esi
push edx
mov dword [esp + 0x48], ebp
call fcn.0040aa40
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x50]
add ecx, eax
add edx, edi
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x48]
add esp, 0x20
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x38]
mov dword [esp + 0x50], ecx
push eax
lea ecx, [esp + 0x54]
and edx, 0x7fffffff
push ecx
mov dword [esp + 0x5c], edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x1b00
push esi
call fcn.00434c10
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x38]
imul dword [esp + 0x34]
add esp, 8
mov ecx, 8
call fcn.004571c0
mov dword [esp + 0x48], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov edx, dword [esp + eax*4 + 0x24]
mov ecx, dword [esp + 0x340]
xor dword [ecx + eax*4], edx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jl 0x4342b2
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x32c
ret