Function at 0x410590
Capabilities:
Encode data using xor
Get session user name
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45065b
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x469090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, edx
xor edx, edx
push 0x110
mov dword [ebp - 0x464], eax
push edx
lea eax, [ebp - 0x444]
push eax
mov dword [ebp - 0x460], edi
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x468], ecx
mov word [ebp - 0x90], dx
mov dword [ebp - 0x448], 0x114
call fcn.0043c0c0
add esp, 0xc
lea ecx, [ebp - 0x448]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov edx, dword [ebp - 0x43c]
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 0x444]
push edx
push eax
push ecx
push str._d._d._d
lea edx, [ebp - 0x90]
push 0x40
push edx
call fcn.00437e0f
mov eax, dword [edi + 0x9938]
push eax
lea ecx, [ebp - 0x310]
call fcn.00408590
add esp, 0x1c
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov dword [ebp - 0x454], 0
or esi, 0xffffffff
mov dword [ebp - 0x458], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4106b1
mov eax, dword [ebp - 0x458]
dec eax
lea ecx, [ebp - 0x110]
je 0x4106a9
mov edi, edi
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
shr esi, 8
xor esi, dword [edx*4 + 0x459a48]
inc ecx
dec eax
jne 0x410690
not esi
mov dword [ebp - 0x454], esi
mov eax, dword [edi + 0x17ec]
mov dword [ebp - 0x450], 0
test eax, eax
je 0x410728
lea edx, [eax + 2]
jmp 0x4106d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4106d0
sub eax, edx
sar eax, 1
lea ebx, [eax + eax*2]
xor ecx, ecx
mov eax, ebx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043723a
mov ecx, dword [edi + 0x17ec]
mov esi, eax
add esp, 4
mov edi, esi
mov dword [ebp - 0x450], esi
call fcn.00408790
mov ebx, dword [ebp - 0x44c]
mov edi, dword [ebp - 0x460]
mov dword [ebp - 0x45c], esi
test esi, esi
jne 0x410732
mov dword [ebp - 0x45c], 0x4589c0
cmp word [edi + 0x22c], 0
lea esi, [edi + 0x22c]
jne 0x410750
mov eax, dword [edi]
mov edx, dword [eax + 0x2c]
mov ecx, edi
call edx
call fcn.00407fa0
mov eax, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x454]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x10]
push ecx
mov ecx, edi
call eax
push eax
lea ecx, [edi + 0xf44]
push ecx
lea edx, [ebp - 0x310]
push edx
lea eax, [edi + 0x9944]
push eax
lea ecx, [edi + 0x2ac]
push ecx
mov ecx, dword [ebp - 0x464]
lea edx, [edi + 0xb588]
push edx
lea eax, [ebp - 0x90]
push eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push ecx
lea edx, [edi + 0xd38]
push edx
lea eax, [edi + 0xb30]
push eax
lea ecx, [edi + 0x330]
push ecx
push str.guid_ss_user_id_si_user_id_smode_sversion_sos_sinstallId_spid_storrentHash_sserial_sdownloadDate_sappId_duserName_uua_s
push 0x40000
push ebx
call esi
mov eax, dword [ebp - 0x450]
add esp, 0x44
test eax, eax
je 0x4107d8
push eax
call fcn.00437245
add esp, 4
mov ecx, dword [ebp - 0x468]
test ecx, ecx
je 0x41080c
mov eax, dword [edi + 0x993c]
test eax, eax
je 0x4107f1
cmp eax, 1
jne 0x41080c
mov eax, dword [ecx]
lea edx, [eax + 0xa88]
push edx
push eax
push ebx
push str._spinstall_scampaign_id_s
push 0x40000
push ebx
call esi
add esp, 0x18
xor eax, eax
cmp dword [edi + 0xb57c], eax
jbe 0x4108ee
xor ecx, ecx
mov dword [ebp - 0x318], 7
mov dword [ebp - 0x31c], eax
mov word [ebp - 0x32c], cx
push eax
mov dword [ebp - 4], eax
add edi, 0xb56c
push edi
or eax, 0xffffffff
lea esi, [ebp - 0x32c]
call fcn.00402420
mov ecx, eax
push 0
mov eax, 0x45b344
call fcn.00402190
mov eax, dword [ebp - 0x31c]
xor ecx, ecx
add eax, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043723a
mov ecx, dword [ebp - 0x32c]
mov esi, 8
add esp, 4
mov edi, eax
cmp dword [ebp - 0x318], esi
jae 0x410896
lea ecx, [ebp - 0x32c]
mov ebx, dword [ebp - 0x31c]
lea ebx, [ebx + ebx - 1]
call fcn.00408790
mov ecx, dword [ebp - 0x31c]
xor eax, eax
push edi
mov word [edi + ecx*4 - 2], ax
mov eax, dword [ebp - 0x44c]
push eax
push str._serrors_s
push 0x40000
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push edi
call fcn.00437245
add esp, 4
cmp dword [ebp - 0x318], esi
jb 0x4108ee
mov edx, dword [ebp - 0x32c]
push edx
call fcn.00437245
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043722b
mov esp, ebp
pop ebp
ret 8