Function at 0x1000c35d
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0x480
call fcn.100081bc
pop ecx
mov ebx, eax
mov esi, 0x100
push esi
push ebx
mov dword [esp + 0x2c], ebx
call fcn.10008382
push esi
push ebx
mov dword [esp + 0x2c], eax
call fcn.10008382
push esi
push ebx
mov dword [esp + 0x38], eax
call fcn.10008382
lea edi, [esi - 0x80]
push edi
push ebx
mov dword [esp + 0x38], eax
call fcn.10008382
push edi
push ebx
call fcn.10008382
mov eax, dword [ebp + 8]
and dword [esp + 0x3c], 0
push edi
push ebx
mov dword [0x10043a10], eax
call fcn.10008382
push edi
push 0
push eax
mov dword [0x10043a0c], eax
call fcn.10020520
add esp, 0x3c
call fcn.1000c7ba
mov ebx, 0x400
push ebx
call fcn.100187ff
pop ecx
push ebx
mov edi, eax
push 0
push edi
mov dword [0x10043a14], edi
call fcn.10020520
add esp, 0xc
push 0
push 1
push 1
push ebx
push edi
call fcn.1000ea37
add esp, 0x14
push 8
pop ecx
call fcn.1000c7af
movzx edi, ax
test di, di
jbe 0x1000c475
push 0
call fcn.10002f1b
pop ecx
push eax
call sub.WS2_32.dll_htonl
mov dword [esp + 0x10], eax
cmp di, 1
jne 0x1000c43d
and dword [esp + 0x10], 0xff000000
jmp 0x1000c45b
cmp di, 2
jne 0x1000c44d
and dword [esp + 0x10], 0xffff0000
jmp 0x1000c45b
cmp di, 3
jne 0x1000c45b
and dword [esp + 0x10], 0xffffff00
lea eax, [esp + 0x10]
push eax
push 0x1800
push str.._._._..._._._.U._._...
push 4
pop edi
call fcn.1000c25f
add esp, 0xc
push 7
pop ecx
call fcn.1000c7a4
movzx edi, ax
test di, di
jbe 0x1000c4a8
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push ebx
push 6
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push dword [esp + 0xc]
movzx eax, di
call fcn.1000c303
pop ecx
push 6
pop ecx
call fcn.1000c7a4
movzx edi, ax
test di, di
jbe 0x1000c4d9
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push dword [esp + 0xc]
movzx eax, di
call fcn.1000c303
pop ecx
push 5
pop ecx
call fcn.1000c7a4
movzx edi, ax
test di, di
jbe 0x1000c50e
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
dec dword [esp + 0xc]
push dword [esp + 0xc]
movzx eax, di
call fcn.1000c303
pop ecx
xor eax, eax
mov edi, 0x1800
xor byte [eax + str.._._._..._._._.U._._...], 0x2e
inc eax
cmp eax, edi
jl 0x1000c515
push 9
pop ecx
call fcn.1000c7af
mov esi, eax
test esi, esi
je 0x1000c56a
xor ecx, ecx
mov eax, ecx
cdq
push 3
pop ebx
idiv ebx
movsx edi, byte [ecx + str.._._._..._._._.U._._...]
and edi, 0xff
inc edx
imul edi, edx
add edi, dword [esp + 0x14]
xor edx, edx
mov eax, edi
mov edi, 0x5f5e0ff
div edi
inc ecx
mov edi, 0x1800
cmp ecx, edi
mov dword [esp + 0x14], edx
jl 0x1000c531
dec esi
jmp 0x1000c570
xor esi, esi
and dword [esp + 0x14], esi
push edi
lea eax, [esp + 0x2c]
push str.._._._..._._._.U._._...
push eax
call fcn.10008237
add esp, 0xc
cmp esi, dword [esp + 0x14]
jne 0x1000c64a
jmp 0x1000c633
lea eax, [esp + 0x28]
push eax
call fcn.10008293
movzx edi, ax
pop ecx
lea eax, [esp + 0x28]
push eax
call fcn.10008293
movsx ebx, si
pop ecx
movzx ecx, ax
mov eax, dword [0x10043a14]
shl ebx, 3
lea esi, [ebx + eax]
movsx eax, di
dec eax
mov word [esi], di
je 0x1000c61d
dec eax
je 0x1000c606
dec eax
jne 0x1000c633
movsx edi, cx
push edi
call fcn.100187ff
pop ecx
push edi
mov dword [esi + 4], eax
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.10008382
pop ecx
pop ecx
push eax
push dword [esi + 4]
call fcn.1001f330
add esp, 0xc
push 0
push 1
push 1
push edi
push dword [esi + 4]
call fcn.1000ea37
add esp, 0x14
jmp 0x1000c633
lea eax, [esp + 0x28]
push eax
call fcn.10008250
pop ecx
mov ecx, dword [0x10043a14]
mov dword [ebx + ecx + 4], eax
jmp 0x1000c633
lea eax, [esp + 0x28]
push eax
call fcn.10008293
pop ecx
mov ecx, dword [0x10043a14]
mov word [ebx + ecx + 4], ax
lea eax, [esp + 0x28]
push eax
call fcn.10008293
movzx esi, ax
pop ecx
test si, si
jg 0x1000c592
push dword [esp + 0x24]
call fcn.10008207
mov dword [esp], 0x1800
push 0
push str.._._._..._._._.U._._...
call fcn.10020520
add esp, 0xc
push 0x11
pop ecx
call fcn.1000c2e8
mov esi, eax
call fcn.1000dd2b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret