Function at 0x1000ec20
Capabilities:
Check os version
Encode data using xor
Get graphical window text
Get hostname
Get session user name
Get system information on windows
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2a6c
call fcn.10074200
mov eax, dword [0x1009900c]
xor eax, esp
mov dword [esp + 0x2a68], eax
mov edx, dword [0x1009fc1c]
push ebx
push esi
push edi
cmp edx, dword [0x1009c5a4]
jb 0x1000f3c0
mov esi, dword [0x1009fc18]
ja 0x1000ec67
cmp esi, dword [0x1009c5a0]
jbe 0x1000f3c0
mov ecx, esi
mov eax, edx
add ecx, 0x9c4
mov dword [0x1009c5a0], ecx
adc eax, 0
cmp byte [0x10167a4b], 0
mov dword [0x1009c5a4], eax
jne 0x1000f355
lea eax, [esp + 0x20]
mov dword [0x100a1070], 0x3f
push eax
push 0x100a1070
mov dword [esp + 0x28], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0x24]
mov dword [0x1009c8b8], 0x3f
push eax
push 0x1009c8b8
mov dword [esp + 0x2c], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.1000bf30
lea ecx, [esp + 0x1a]
mov byte [esp + 0x1a], 0
call fcn.1000e660
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x1000ed1d
lea ecx, [esp + 0x1b]
mov byte [esp + 0x1b], 0
call fcn.1000e750
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1000f027
mov dword [0x100a0e64], 0x1000193
call fcn.10050570
xor eax, eax
lea edi, [esp + 0x1c8]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x1c8], eax
jle 0x1000ed86
cmp eax, 0x200
jge 0x1000ed86
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], esi
inc eax
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
add edi, 0x10
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x1c8]
jl 0x1000ed57
push 0x40
xorps xmm0, xmm0
mov dword [esp + 0x21ec], 0
lea eax, [esp + 0x21f4]
movlpd qword [esp + 0x21dc], xmm0
push 0
push eax
movlpd qword [esp + 0x21ec], xmm0
call fcn.10052980
mov eax, dword [esp + 0x1d8]
lea edi, [esp + 0x1d4]
mov dword [esp + 0x21d8], eax
add esp, 0xc
mov eax, dword [esp + 0x1d4]
xor ecx, ecx
mov dword [esp + 0x21d0], eax
mov eax, dword [esp + 0x1d0]
mov dword [esp + 0x21d4], eax
mov eax, 0x80000000
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edi, 0x80000000
mov eax, dword [esp + 0x1c8]
mov dword [esp + 0x14], eax
cmp eax, edi
jb 0x1000ee86
mov eax, edi
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, [esp + 0x1c8]
mov dword [ebx], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
cmp edi, 0x80000002
jne 0x1000ee4d
movups xmm0, xmmword [esp + 0x1c8]
movups xmmword [esp + 0x21f0], xmm0
jmp 0x1000ee7f
cmp edi, 0x80000003
jne 0x1000ee67
movups xmm0, xmmword [esp + 0x1c8]
movups xmmword [esp + 0x2200], xmm0
jmp 0x1000ee7f
cmp edi, 0x80000004
jne 0x1000ee7f
movups xmm0, xmmword [esp + 0x1c8]
movups xmmword [esp + 0x2210], xmm0
inc edi
cmp edi, dword [esp + 0x14]
jbe 0x1000ee17
call fcn.1005058a
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x20
push eax
lea edx, [esp + 0x21d4]
lea ecx, [esp + 0x2238]
call fcn.10010530
add esp, 4
mov dword [esp + 0x18], 0x40
lea eax, [esp + 0x18]
lea edx, [esp + 0x21f4]
lea ecx, [esp + 0x34]
push eax
call fcn.10010530
push 0x800
lea eax, [esp + 0x227c]
push 0
push eax
call fcn.10052980
add esp, 0x14
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x2234]
push eax
push 0x10083460
lea eax, [esp + 0x227c]
push 0x400
push eax
call fcn.10009b70
add esp, 0x14
mov byte [esp + 0x13], 0
lea ecx, [esp + 0x13]
call fcn.1000e840
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword fs:[0x2c]
mov esi, eax
mov edx, dword [0x1009b0e8]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x1016b7f8]
cmp ecx, dword [edx + 4]
jle 0x1000ef6c
push 0x1016b7f8
call fcn.10050e1c
add esp, 4
cmp dword [0x1016b7f8], 0xffffffff
jne 0x1000ef6c
push 0x1016b7f8
mov dword [0x1016d104], esi
call fcn.10050dd2
add esp, 4
test esi, esi
je 0x1000efcf
lea eax, [esp + 0xd0]
push eax
call dword [0x1016d104]
test eax, eax
je 0x1000efcf
lea ecx, [esp + 0x2270]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000ef90
lea eax, [esp + 0x122]
sub ecx, edx
push eax
lea eax, [esp + 0xd8]
sar ecx, 1
push eax
mov eax, 0x800
sub eax, ecx
push 0x10083460
push eax
lea eax, [esp + 0x2280]
lea eax, [eax + ecx*2]
push eax
call fcn.10009b70
add esp, 0x14
lea ecx, [esp + 0x2270]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000efe0
sub ecx, edx
xor edx, edx
sar ecx, 1
je 0x1000f01b
mov esi, dword [0x100a0e64]
nop dword [eax]
movzx eax, word [esp + edx*2 + 0x2270]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x1000f000
mov dword [0x100a0e64], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call fcn.1000bd20
lea ecx, [esp + 0x13]
mov dword [0x1009c7b0], 0x3f
mov byte [esp + 0x13], 0
call fcn.1000e940
push eax
push str.kernel32.dll
call ebx
push eax
call esi
mov dword [0x10166994], eax
test eax, eax
je 0x1000f342
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], 0
call fcn.1000ea30
push eax
push str.kernel32.dll
call ebx
push eax
call esi
mov dword [0x10168aa8], eax
test eax, eax
je 0x1000f342
xorps xmm0, xmm0
mov dword [esp + 0x30], 0x9c
lea ecx, [esp + 0x13]
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0xd4], xmm0
movlpd qword [esp + 0xdc], xmm0
movlpd qword [esp + 0xe4], xmm0
movlpd qword [esp + 0xec], xmm0
mov dword [esp + 0xd0], 0x9c
mov byte [esp + 0x13], 0
call fcn.1000eb30
push eax
push str.ntdll.dll
call ebx
push eax
call esi
mov dword [0x1016698c], eax
test eax, eax
je 0x1000f100
lea ecx, [esp + 0xd0]
push ecx
call eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0x10168aa8]
test eax, eax
je 0x1000f120
lea ecx, [esp + 0x21cc]
push ecx
call eax
jmp 0x1000f12e
lea eax, [esp + 0x21cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x40], 2
mov esi, 0x80
jne case.0x1000f252.5
mov eax, dword [esp + 0x34]
cmp eax, 4
jbe case.0x1000f252.5
cmp eax, 6
jne 0x1000f5f0
cmp dword [esp + 0x38], 0
jne 0x1000f183
cmp byte [esp + 0xca], 1
jne 0x1000f16c
push str.Vista
jmp 0x1000f171
push str.Server_2008
push 0x80
push 0x1009c7b0
call fcn.10009b70
add esp, 0xc
cmp dword [esp + 0x38], 1
jne 0x1000f1b2
cmp byte [esp + 0xca], 1
jne 0x1000f19b
push 0x100834ac
jmp 0x1000f1a0
push str.Server_2008_R2
push 0x80
push 0x1009c7b0
call fcn.10009b70
add esp, 0xc
cmp dword [esp + 0x38], 2
jne 0x1000f216
mov ecx, dword [esp + 0xdc]
cmp ecx, 0x295a
jb 0x1000f1ee
cmp ecx, 0x3ad7
jb 0x1000f1d8
mov eax, str.10_CU
push eax
jmp 0x1000f204
cmp ecx, 0x3839
mov eax, str.10_AU
mov edx, 0x100834f0
cmovb eax, edx
push eax
jmp 0x1000f204
cmp byte [esp + 0xca], 1
jne 0x1000f1ff
push 0x100834f8
jmp 0x1000f204
push str.Server_2012
push 0x80
push 0x1009c7b0
call fcn.10009b70
add esp, 0xc
mov ecx, dword [0x10166994]
test ecx, ecx
je 0x1000f241
lea eax, [esp + 0x1c]
push eax
movzx eax, word [esp + 0xca]
push eax
movzx eax, word [esp + 0xcc]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
call ecx
mov eax, dword [esp + 0x1c]
dec eax
cmp eax, 0x2f
ja case.0x1000f252.5
movzx eax, byte [eax + 0x1000f874]
jmp dword [eax*4 + 0x1000f828]
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f261
sub ecx, edx
sar ecx, 1
push str.Ultimate
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f280
sub ecx, edx
sar ecx, 1
push str.Professional
mov eax, esi
sub eax, ecx
push eax
lea eax, [ecx*2 + 0x1009c7b0]
push eax
call fcn.10009b70
add esp, 0xc
lea ecx, [esp + 0x44]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000f2b0
sub ecx, edx
je 0x1000f2f8
mov edi, 0x1009c7b0
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x1000f2c3
sub edi, ecx
xor edx, edx
lea ecx, [esp + 0x44]
sar edi, 1
call fcn.10010590
push eax
mov eax, esi
sub eax, edi
push str.__ws
push eax
lea eax, [edi*2 + 0x1009c7b0]
push eax
call fcn.10009b70
add esp, 0x10
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f300
push dword [esp + 0x3c]
sub ecx, edx
sar ecx, 1
push str.___i_
sub esi, ecx
push esi
lea eax, [ecx*2 + 0x1009c7b0]
push eax
call fcn.10009b70
add esp, 0x10
cmp dword [esp + 0x34], 6
jb 0x1000f342
cmp word [esp + 0x21cc], 0
setne byte [0x1009cdb2]
mov edx, dword [0x1009fc1c]
mov esi, dword [0x1009fc18]
mov byte [0x10167a4b], 1
cmp edx, dword [0x101658fc]
jb 0x1000f3af
ja 0x1000f367
cmp esi, dword [0x101658f8]
jbe 0x1000f3af
add esi, 0x3e8
mov dword [0x1009ea18], 0x3f
mov dword [0x101658f8], esi
adc edx, 0
mov dword [0x101658fc], edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1000f3af
push 0xff
push 0x1009ea18
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1000f3af
mov dword [0x1009ea18], 0x3f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x2a74]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10050cdb
mov esp, ebp
pop ebp
ret
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f3e0
sub ecx, edx
sar ecx, 1
push str.Home_Premium
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f401
sub ecx, edx
sar ecx, 1
push str.Home_Basic
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f422
sub ecx, edx
sar ecx, 1
push str.Enterprise
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f443
sub ecx, edx
sar ecx, 1
push str.Business
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f464
sub ecx, edx
sar ecx, 1
push str.Starter
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f485
sub ecx, edx
sar ecx, 1
push str.Cluster_Server
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f4a6
sub ecx, edx
sar ecx, 1
push str.Datacenter
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f4c7
sub ecx, edx
sar ecx, 1
push str.Datacenter__core_installation_
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f4f0
sub ecx, edx
sar ecx, 1
push str.Enterprise
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f511
sub ecx, edx
sar ecx, 1
push str.Enterprise__core_installation_
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f532
sub ecx, edx
sar ecx, 1
push str.Enterprise_Itanium_based_Systems
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f553
sub ecx, edx
sar ecx, 1
push str.Small_Business_Server
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f574
sub ecx, edx
sar ecx, 1
push str.Small_Business_Server_Premium
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f595
sub ecx, edx
sar ecx, 1
push str.Standard
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f5b6
sub ecx, edx
sar ecx, 1
push str.Standard__core_installation_
jmp 0x1000f294
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f5d7
sub ecx, edx
sar ecx, 1
push str.Web_Server
jmp 0x1000f294
cmp dword [esp + 0x34], 5
jne case.0x1000f252.5
mov eax, dword [esp + 0x38]
cmp eax, 2
jne 0x1000f7cf
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1000f61b
mov eax, str.Server_2003_R2
jmp 0x1000f65d
mov eax, dword [esp + 0xc8]
test eax, 0x2000
je 0x1000f630
mov eax, str.Storage_Server_2003
jmp 0x1000f65d
test eax, 0x8000
je 0x1000f63e
mov eax, str.Home_Server
jmp 0x1000f65d
cmp byte [esp + 0xca], 1
jne 0x1000f658
cmp word [esp + 0x21cc], 9
mov eax, str.XP_Professional_x64
je 0x1000f65d
mov eax, str.Server_2003
push eax
push 0x80
push 0x1009c7b0
call fcn.10009b70
add esp, 0xc
cmp byte [esp + 0xca], 1
je case.0x1000f252.5
mov ax, word [esp + 0x21cc]
cmp ax, 6
jne 0x1000f6e9
mov al, byte [esp + 0xc8]
test al, al
jns 0x1000f6b9
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f6a0
sub ecx, edx
sar ecx, 1
push str.Datacenter_Itanium_based_Systems
jmp 0x1000f294
test al, 2
je case.0x1000f252.5
mov ecx, 0x1009c7b0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f6d0
sub ecx, edx
sar ecx, 1
push str.Enterprise_Itanium_based_Systems
jmp 0x1000f294
mov edx, dword [esp + 0xc8]
mov ecx, 0x1009c7b0
cmp ax, 9
jne 0x1000f739
and edx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f700
sub ecx, edi
sar ecx, 1
test dx, dx
je 0x1000f71f
mov edx, str.Datacenter_x64
push edx
jmp 0x1000f294
test byte [esp + 0xc8], 2
mov edx, str.Enterprise_x64
jne 0x1000f733
mov edx, str.Standard_x64
push edx
jmp 0x1000f294
test edx, 0x4000
je 0x1000f75d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f744
sub ecx, edx
sar ecx, 1
push str.Compute_Cluster
jmp 0x1000f294
test byte [esp + 0xc8], 0x80
je 0x1000f789
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f770
sub ecx, edx
sar ecx, 1
push str.Datacenter
jmp 0x1000f294
mov edi, edx
lea ebx, [ecx + 2]
and edi, 2
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f791
sub ecx, ebx
sar ecx, 1
test di, di
je 0x1000f7af
push str.Enterprise
jmp 0x1000f294
mov eax, esi
sub eax, ecx
test edx, 0x400
je 0x1000f7c5
push 0x10083900
jmp 0x1000f298
push str.Standard
jmp 0x1000f298
cmp eax, 1
jne case.0x1000f252.5
push 0x10083908
push 0x80
push 0x1009c7b0
call fcn.10009b70
mov edx, dword [esp + 0xd4]
mov ecx, 0x1009c7b0
add esp, 0xc
and edx, 0x200
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f804
sub ecx, edi
sar ecx, 1
test dx, dx
je 0x1000f28f
push str.Home
jmp 0x1000f294