Function at 0x10067b30
Capabilities:
Encode data using xor
Get disk information
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x100a7010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push str.RevLimiter
push str.CalculateHashstart
push 0
call edi
push 0x101
lea eax, [ebp - 0x110]
mov dword [0x100a7d70], 0
xorps xmm0, xmm0
push 0
push eax
movq qword [0x100a7d68], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x114], 0x101
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [ebp - 0x114]
mov edx, 0x78
movzx ecx, byte [ebp - 0x110]
test eax, eax
cmove ecx, edx
xor edx, edx
push edx
dec eax
mov byte [ebp - 0x110], cl
movzx ecx, byte [ebp - 0x104]
cmp eax, 0xc
push str.RevLimiter
push str.CalculateHash1
cmova ecx, edx
push edx
mov byte [ebp - 0x104], cl
call edi
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10067c01
sub ecx, edx
cmp ecx, 0xc
jae 0x10067c70
nop
xor eax, eax
xor esi, esi
cmp byte [ebp - 0x110], al
je 0x10067c4f
nop dword [eax]
inc esi
cmp byte [ebp + esi - 0x110], al
jne 0x10067c20
mov edx, esi
nop dword [eax]
cmp edx, 0xc
jae 0x10067c4f
mov cl, byte [ebp + eax - 0x110]
inc eax
mov byte [ebp + edx - 0x110], cl
inc edx
cmp byte [ebp + eax - 0x110], 0
jne 0x10067c30
add eax, esi
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov byte [ebp + eax - 0x110], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10067c62
sub ecx, edx
cmp ecx, 0xc
jb 0x10067c10
push 0
push str.RevLimiter
push str.CalculateHash2
push 0
call edi
mov al, byte [ebp - 0x110]
xor dl, dl
mov byte [ebp - 0x119], dl
test al, al
je 0x10067cc2
lea esi, [ebp - 0x110]
movsx eax, al
mov ecx, eax
shl ecx, 4
sub ecx, eax
and ecx, 0x8000007f
jns 0x10067caf
dec ecx
or ecx, 0xffffff80
inc ecx
mov al, byte [esi + 1]
inc esi
add cl, 0x11
add dl, cl
test al, al
jne 0x10067c98
mov byte [ebp - 0x119], dl
mov eax, dword [ebp - 0x108]
movq xmm0, qword [ebp - 0x110]
mov dword [0x100a7d70], eax
mov al, byte [ebp - 0x10b]
mov byte [0x100a7d73], al
xor eax, eax
movq qword [0x100a7d68], xmm0
nop word [eax + eax]
xor byte [eax + 0x100a7d68], dl
inc eax
cmp eax, 0xc
jl 0x10067cf0
push 0
push str.RevLimiter
push str.CalculateHash3
push 0
call edi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x118]
xor ecx, ecx
movd xmm0, eax
pshufd xmm2, xmm0, 0
movsx eax, al
movaps xmm1, xmm2
movd xmm0, eax
mov eax, 6
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movaps xmmword [ebp - 0x160], xmm0
movd xmm0, eax
mov eax, 4
psrld xmm1, xmm0
mov edi, dword [ebp - 0x160]
pshuflw xmm0, xmm1, 0xd8
movaps xmm1, xmm2
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100a2e40]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x150], xmm0
movd xmm0, eax
mov eax, 2
psrld xmm1, xmm0
mov esi, dword [ebp - 0x150]
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100a2e40]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x140], xmm0
mov edx, dword [ebp - 0x140]
movd xmm0, eax
psrld xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100a2e40]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x130], xmm0
mov eax, dword [ebp - 0x130]
nop
movd xmm1, dword [ecx + 0x100a7d68]
movd xmm0, esi
pxor xmm1, xmm0
movd xmm0, edx
pxor xmm1, xmm0
movd xmm0, eax
pxor xmm1, xmm0
movd xmm0, edi
pxor xmm1, xmm0
movd dword [ecx + 0x100a7d68], xmm1
add ecx, 4
cmp ecx, 0xc
jl 0x10067e00
xor edx, edx
nop word [eax + eax]
movsx eax, byte [ebp - 0x119]
movsx ecx, dl
imul ecx, eax
xor byte [edx + 0x100a7d68], cl
inc edx
cmp edx, 0xc
jl 0x10067e40
push 0
push str.RevLimiter
push str.CalculateHashend
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10068185
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret