Function at 0x10008f3d
Capabilities:
Encode data using xor
Get session user name

Disassembly:
mov eax, 0x1005939b
call fcn.10058c78
sub esp, 0xc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], 0x82062403
push esi
mov dword [ebp - 0x18], ebx
push edi
mov dword [ebp - 0x20], 0xb73
cmp dword [ebp - 0x20], 0xc44
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
jle 0x10008fb3
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov eax, edi
mov ecx, 0x10074f78
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10009792
inc ebx
cmp ebx, 0x23b3
jl 0x10008f7f
inc edi
push 0
pop ebx
cmp edi, 0x12a2
jl 0x10008f7c
inc esi
cmp esi, 0x4583
jl 0x10008f7a
mov dword [ebp - 0x24], 0xb2f67ab6
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x9c8
jge 0x10008fd5
mov edx, str.icjy_oyz_wncjw_wfdaiv_qyrkxb_jrk_ssxga
mov ecx, 0x10074f78
call fcn.1000cd04
or dword [ebp - 4], 0xffffffff
xor edi, edi
mov dword [ebp - 0x18], ebx
inc edi
jmp 0x10009011
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], 0xbf0a6441
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10009003
mov dword [ebp - 0x1c], ebx
jmp 0x1000902e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000902b
push ebx
call dword [sym.imp.GDI32.dll_GetObjectType]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jg 0x1000901b
mov dword [ebp - 0x18], 0xb590
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x1c]
test edx, edx
jne 0x10009053
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, 0x796a0b59
jne 0x10009060
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x1000907c
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1000907e
mov eax, ebx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
neg ecx
push 2
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
pop esi
setge dl
xor ecx, ecx
cmp eax, esi
setg cl
imul edx, ecx
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
je 0x100090b7
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0x100090e8
mov dword [ebp - 0x18], ebx
jmp 0x100090e2
mov dword [ebp - 0x1c], ebx
jmp 0x100090da
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100090d7
push ebx
push ebx
push 0xc1e
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100090c1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jle 0x100090bc
call fcn.1000692a
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.10009df7
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], 0x603e
cmp dword [ebp - 0x24], 0x641f
jle 0x10009165
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x20], ebx
and eax, esi
lea ecx, [ebp - 0xb4]
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000912b
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xb4]
call fcn.100015c8
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x51c4
jl 0x10009111
inc esi
cmp esi, 0x748
jl 0x1000910c
push ebx
push 0xeb3
call dword [sym.imp.GDI32.dll_SetTextColor]
push 2
pop esi
push 4
lea ecx, [ebp - 0x5c]
call fcn.1000995a
cmp dword [ebp - 0x24], 0x5cfb
jge 0x10009183
push str.adcej_etl_hxghq_mlpuaoqe_lrvtyrq_nepeqtole_rqxqebr_uyme_lwtr_tdgekrae
call fcn.100420be
pop ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x18], ebx
jmp 0x100091a1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], 0xfffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10009191
push 3
mov dword [ebp - 0x1c], ebx
pop esi
jmp 0x10009207
mov dword [ebp - 0x20], 0x1bd97a88
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x10009204
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100091d2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x18], ebx
jmp 0x100091fa
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x100091f7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x24]
jns 0x100091e6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x100091d7
dec dword [ebp - 0x20]
jns 0x100091be
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x100091af
lea ecx, [ebp - 0x5c]
call fcn.100099dd
mov edx, dword [ebp - 0x40]
mov ecx, edx
mov esi, dword [ebp - 0x2c]
add esi, 0xfffffc8a
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x10009250
cmp dword [eax + 0x10], esi
jge 0x10009235
mov eax, dword [eax + 8]
jmp 0x10009239
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1000922b
cmp ecx, edx
je 0x10009250
cmp esi, dword [ecx + 0x10]
jl 0x10009250
mov dword [ebp - 0x38], ecx
lea esi, [ebp - 0x38]
jmp 0x10009256
mov dword [ebp - 0x44], edx
lea esi, [ebp - 0x44]
mov esi, dword [esi]
mov dword [ebp - 0x24], 0xf6af1124
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0xffffffea
cmp dword [ebp - 0x24], 3
jge 0x10009406
push 4
lea ecx, [ebp - 0x78]
call fcn.1000995a
mov byte [ebp - 4], 5
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x18], ebx
jmp 0x100092a0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10009290
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x100093e3
push edi
lea ecx, [ebp - 0x50]
call fcn.1000995a
mov byte [ebp - 4], 6
mov dword [ebp - 0x18], ebx
jmp 0x100092d8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 0x29ea4144
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100092c8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100092f1
push 0x2703
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, dword [ebp - 0x50]
mov dword [eax], 3
cmp dword [eax], ebx
jl 0x100093cf
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009312
push ebx
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10009397
mov dword [ebp - 0x18], 0x4e17
cmp dword [ebp - 0x18], 0x5181
jle 0x10009368
push 0x5e3
push 0x1cde
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10074f78
or eax, esi
cdq
push edx
push eax
call fcn.10009792
inc edi
cmp edi, 0x6169
jl 0x1000933f
inc esi
cmp esi, 0x5fdd
jl 0x1000933d
mov esi, dword [ebp - 0x1c]
xor edi, edi
inc edi
push ebx
push 0x1639
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov byte [ebp - 4], 7
cmp dword [ebp - 0x18], 0x4d73
jge 0x10009390
mov edx, str.nsu_jmf_wknamz_idrvfuqm_kkdem_sisy_dpuyhtw_aeaofh_yctabgsla
mov ecx, 0x10074f78
call fcn.1000cd04
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x50]
dec dword [eax]
jmp 0x100092fa
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call fcn.100099dd
dec dword [ebp - 0x20]
jmp 0x100092ad
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100093f2
call dword [sym.imp.USER32.dll_DestroyCaret]
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 2
call fcn.100099dd
inc dword [ebp - 0x24]
jmp 0x1000926c
mov eax, dword [0x10151d0c]
test al, 1
jne 0x10009439
or eax, edi
mov dword [0x10151cfc], 7
mov dword [0x10151d0c], eax
xor eax, eax
push 0x1005a8ec
mov dword [0x10151cf8], ebx
mov word [0x10151ce8], ax
call fcn.10042094
pop ecx
push 4
lea ecx, [ebp - 0x68]
call fcn.1000995a
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
jmp 0x1000945e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10009452
mov dword [ebp - 0x1c], ebx
jmp 0x1000947a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x84], 0x2fdcba86
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10009469
mov ecx, dword [ebp - 0x68]
mov dword [ecx + 8], ebx
cmp dword [ebp - 0x18], ebx
jne 0x1000948e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ecx + 8]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x5fac
mov dword [ebp - 0x80], eax
sete cl
imul ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18]
sub ecx, 0x91f6
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x18]
jne 0x100094d2
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x100094d4
mov eax, edi
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x18], eax
call fcn.100099dd
cmp esi, dword [ebp - 0x40]
je 0x10009501
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [ebp - 0xcc]
call fcn.1000281b
pop ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x28]
or ecx, edi
jmp 0x1000951e
push 0x10151ce8
lea ecx, [ebp - 0x9c]
call fcn.10001442
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x28]
or ecx, 2
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ecx
mov ecx, esi
push eax
call fcn.10001442
mov eax, dword [ebp - 0x20]
or eax, 4
test al, 2
je 0x1000954f
push ebx
and eax, 0xfffffffd
lea ecx, [ebp - 0x9c]
push edi
mov dword [ebp - 0x20], eax
call fcn.10001734
mov eax, dword [ebp - 0x20]
test al, 1
je 0x10009560
push ebx
push edi
lea ecx, [ebp - 0xcc]
call fcn.10001734
lea ecx, [ebp - 0x40]
call fcn.10009a1f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret