Function at 0x10009947
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0x480
call fcn.100072b2
pop ecx
mov ebx, eax
mov esi, 0x100
push esi
push ebx
mov dword [esp + 0x2c], ebx
call fcn.1000746f
push esi
push ebx
mov dword [esp + 0x2c], eax
call fcn.1000746f
push esi
push ebx
mov dword [esp + 0x38], eax
call fcn.1000746f
lea edi, [esi - 0x80]
push edi
push ebx
mov dword [esp + 0x38], eax
call fcn.1000746f
push edi
push ebx
call fcn.1000746f
mov eax, dword [ebp + 8]
and dword [esp + 0x3c], 0
push edi
push ebx
mov dword [0x10040a10], eax
call fcn.1000746f
push edi
push 0
push eax
mov dword [0x10040a0c], eax
call fcn.1001d4e0
add esp, 0x3c
call fcn.10009da2
mov ebx, 0x400
push ebx
call fcn.100158ef
pop ecx
push ebx
mov edi, eax
push 0
push edi
mov dword [0x10040a14], edi
call fcn.1001d4e0
add esp, 0xc
push 0
push 1
push 1
push ebx
push edi
call fcn.1000bc38
add esp, 0x14
push 8
pop ecx
call fcn.10009d97
movzx edi, ax
test di, di
jbe 0x10009a5f
push 0
call fcn.1000239f
pop ecx
push eax
call sub.WS2_32.dll_htonl
mov dword [esp + 0x10], eax
cmp di, 1
jne 0x10009a27
and dword [esp + 0x10], 0xff000000
jmp 0x10009a45
cmp di, 2
jne 0x10009a37
and dword [esp + 0x10], 0xffff0000
jmp 0x10009a45
cmp di, 3
jne 0x10009a45
and dword [esp + 0x10], 0xffffff00
lea eax, [esp + 0x10]
push eax
push 0x1800
push str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR
push 4
pop edi
call fcn.10009866
add esp, 0xc
push 7
pop ecx
call fcn.10009d8c
movzx edi, ax
test di, di
jbe 0x10009a92
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push ebx
push 6
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push dword [esp + 0xc]
movzx eax, di
call fcn.100098ed
pop ecx
push 6
pop ecx
call fcn.10009d8c
movzx edi, ax
test di, di
jbe 0x10009ac3
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push dword [esp + 0xc]
movzx eax, di
call fcn.100098ed
pop ecx
push 5
pop ecx
call fcn.10009d8c
movzx edi, ax
test di, di
jbe 0x10009af8
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
dec dword [esp + 0xc]
push dword [esp + 0xc]
movzx eax, di
call fcn.100098ed
pop ecx
xor eax, eax
mov edi, 0x1800
xor byte [eax + str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR], 0x2e
inc eax
cmp eax, edi
jl 0x10009aff
push 9
pop ecx
call fcn.10009d97
mov esi, eax
test esi, esi
je 0x10009b54
xor ecx, ecx
mov eax, ecx
cdq
push 3
pop ebx
idiv ebx
movsx edi, byte [ecx + str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR]
and edi, 0xff
inc edx
imul edi, edx
add edi, dword [esp + 0x14]
xor edx, edx
mov eax, edi
mov edi, 0x5f5e0ff
div edi
inc ecx
mov edi, 0x1800
cmp ecx, edi
mov dword [esp + 0x14], edx
jl 0x10009b1b
dec esi
jmp 0x10009b5a
xor esi, esi
and dword [esp + 0x14], esi
push edi
lea eax, [esp + 0x2c]
push str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR
push eax
call fcn.10007324
add esp, 0xc
cmp esi, dword [esp + 0x14]
jne 0x10009c34
jmp 0x10009c1d
lea eax, [esp + 0x28]
push eax
call fcn.10007380
movzx edi, ax
pop ecx
lea eax, [esp + 0x28]
push eax
call fcn.10007380
movsx ebx, si
pop ecx
movzx ecx, ax
mov eax, dword [0x10040a14]
shl ebx, 3
lea esi, [ebx + eax]
movsx eax, di
dec eax
mov word [esi], di
je 0x10009c07
dec eax
je 0x10009bf0
dec eax
jne 0x10009c1d
movsx edi, cx
push edi
call fcn.100158ef
pop ecx
push edi
mov dword [esi + 4], eax
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.1000746f
pop ecx
pop ecx
push eax
push dword [esi + 4]
call fcn.1001c2f0
add esp, 0xc
push 0
push 1
push 1
push edi
push dword [esi + 4]
call fcn.1000bc38
add esp, 0x14
jmp 0x10009c1d
lea eax, [esp + 0x28]
push eax
call fcn.1000733d
pop ecx
mov ecx, dword [0x10040a14]
mov dword [ebx + ecx + 4], eax
jmp 0x10009c1d
lea eax, [esp + 0x28]
push eax
call fcn.10007380
pop ecx
mov ecx, dword [0x10040a14]
mov word [ebx + ecx + 4], ax
lea eax, [esp + 0x28]
push eax
call fcn.10007380
movzx esi, ax
pop ecx
test si, si
jg 0x10009b7c
mov esi, dword [esp + 0x24]
call fcn.100072fd
push 0x1800
push 0
push str.AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRR
call fcn.1001d4e0
add esp, 0xc
push 0x11
pop ecx
call fcn.100098dd
mov esi, eax
call fcn.1000af30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret