Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x28], ebx
xor eax, eax
mov dword [ebp + eax*4 - 0x90], eax
inc eax
cmp eax, 3
jb 0x401013
xor esi, esi
push 0x40d304
call fcn.004018b0
dec eax
pop ecx
cmp esi, eax
je 0x401038
inc esi
cmp esi, 3
jl 0x401022
mov esi, dword [0x40d008]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
push ebx
push str.WTSEnumerateSessionsW
push str.Wtsapi32.dll
call esi
mov edi, dword [0x40d004]
push eax
call edi
call eax
mov dword [ebp - 0x1c], ebx
push 4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
lea eax, [ebp + eax*4 - 0xfc]
push eax
call fcn.00401520
add esp, 0xc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 5
jb 0x401064
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x38], ebx
jbe 0x401444
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x24]
push 5
push dword [eax]
mov dword [ebp - 0x5c], ebx
push ebx
push str.WTSQuerySessionInformationW
push str.Wtsapi32.dll
call esi
push eax
call edi
call eax
mov dword [ebp - 0x18], ebx
push 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x18]
lea eax, [ebp + eax*4 - 0x84]
push eax
call fcn.00401520
add esp, 0xc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jb 0x4010bf
cmp dword [ebp - 0x34], 2
jbe 0x40140f
mov dword [ebp - 4], ebx
push 0x40d2bc
call fcn.004018b0
dec eax
pop ecx
cmp dword [ebp - 4], eax
je 0x401108
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jl 0x4010ee
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp + eax*4 - 0x154], eax
inc eax
cmp eax, 9
jb 0x40110d
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x24]
push dword [eax]
mov dword [ebp - 0xc], ebx
push str.WTSQueryUserToken
push str.Wtsapi32.dll
call esi
push eax
call edi
call eax
lea eax, [ebp - 0xc]
push eax
push 1
push 1
push ebx
push 0x2000000
push dword [ebp - 0x14]
push str.DuplicateTokenEx
push str.Advapi32.dll
call esi
push eax
call edi
call eax
push dword [ebp - 0x14]
push str.CloseHandle
push str.Kernel32.dll
call esi
push eax
call edi
call eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x34]
push ecx
push 4
lea ecx, [ebp - 0x60]
push ecx
push 0x13
push eax
push str.GetTokenInformation
push str.Advapi32.dll
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], ebx
call esi
push eax
call edi
call eax
test eax, eax
je 0x40119d
mov eax, dword [ebp - 0x60]
jmp 0x4011a3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], ebx
push 4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x20]
lea eax, [ebp + eax*4 - 0x130]
push eax
call fcn.00401520
add esp, 0xc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jb 0x4011a9
push ebx
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
push str.CreateEnvironmentBlock
push str.Userenv.dll
mov dword [ebp - 0x10], ebx
call esi
push eax
call edi
call eax
test eax, eax
jne 0x4011ee
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
push 0x40d304
call fcn.004018b0
dec eax
pop ecx
cmp dword [ebp - 4], eax
je 0x40120b
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4011f1
push 0x44
lea eax, [ebp - 0xd4]
push ebx
push eax
call fcn.004014a0
add esp, 0xc
mov dword [ebp - 4], ebx
push 0x40d304
call fcn.004018b0
dec eax
pop ecx
cmp dword [ebp - 4], eax
je 0x40123a
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x401220
push 0x58
pop eax
push 0x46
mov word [ebp - 0x58], ax
pop eax
push 0x41
mov word [ebp - 0x56], ax
pop eax
push 0x5c
mov word [ebp - 0x54], ax
pop eax
push 0x5b
mov word [ebp - 0x52], ax
pop eax
push 0x4e
mov word [ebp - 0x50], ax
pop eax
push 0x1f
mov word [ebp - 0x4e], ax
pop eax
push 0x73
mov word [ebp - 0x4c], ax
pop eax
push 0x4b
mov word [ebp - 0x4a], ax
pop eax
push 0x4a
mov word [ebp - 0x48], ax
pop eax
push 0x49
mov word [ebp - 0x46], ax
pop eax
push 0x4e
mov word [ebp - 0x44], ax
pop eax
push 0x5a
mov word [ebp - 0x42], ax
pop eax
mov word [ebp - 0x40], ax
push 0x43
pop eax
mov word [ebp - 0x3e], ax
push 0x5b
pop eax
mov word [ebp - 0x3c], ax
xor eax, eax
mov word [ebp - 0x3a], ax
lea eax, [ebp - 0x58]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 4], ebx
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [ebp + eax*4 - 0xe8]
push eax
call fcn.00401520
add esp, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jb 0x4012b5
mov dword [ebp - 0x30], 0x44
mov ecx, dword [ebp - 0x30]
and ecx, 0x80000001
jns 0x4012ee
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, dword [ebp - 0x30]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [ebp - 0x30]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [ebp - 0xd4], ecx
xor eax, eax
xor word [ebp + eax*2 - 0x58], 0x2f
inc eax
cmp eax, 0xf
jb 0x40130a
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xd4]
push eax
push ebx
push dword [ebp - 0x10]
push 0x420
push 1
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 0xc]
push str.CreateProcessAsUserW
push str.Advapi32.dll
call esi
push eax
call edi
call eax
test eax, eax
jne 0x401385
push 0x4e20
call dword [section..rdata]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xd4]
push eax
push ebx
push dword [ebp - 0x10]
push 0x420
push 1
push ebx
push ebx
push dword [ebp + 8]
push ebx
push dword [ebp - 0xc]
push str.CreateProcessAsUserW
push str.Advapi32.dll
call esi
push eax
call edi
call eax
xor eax, eax
mov dword [ebp + eax*4 - 0x17c], eax
inc eax
cmp eax, 0xa
jb 0x401387
cmp dword [ebp - 0x10], ebx
je 0x4013ad
push dword [ebp - 0x10]
push str.DestroyEnvironmentBlock
push str.Userenv.dll
call esi
push eax
call edi
call eax
xor eax, eax
mov dword [ebp + eax*4 - 0x114], eax
inc eax
cmp eax, 6
jb 0x4013af
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x64], eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
push dword [ebp + eax*4 - 0x6c]
push str.CloseHandle
push str.Kernel32.dll
call esi
push eax
call edi
call eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jb 0x4013d1
mov dword [ebp - 8], ebx
push 0x40d1fc
call fcn.004018b0
dec eax
pop ecx
cmp dword [ebp - 8], eax
je 0x40140f
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jl 0x4013f5
add dword [ebp - 0x24], 0xc
mov dword [ebp - 8], ebx
push 4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
lea eax, [ebp + eax*4 - 0x80]
push eax
call fcn.00401520
add esp, 0xc
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jb 0x401416
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x38]
jb 0x401098
push dword [ebp - 0x28]
push str.WTSFreeMemory
push str.Wtsapi32.dll
call esi
push eax
call edi
call eax
pop edi
pop esi
pop ebx
leave
ret