Function at 0x100645a0
Capabilities:
Encode data using xor
Get disk information
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100d7010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [0x100d935c], 0
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x20]
movq qword [0x100d9354], xmm0
push eax
movq qword [ebp - 0x20], xmm0
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x24], 0xd
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movzx eax, byte [ebp - 0x20]
mov ecx, 0x78
cmp dword [ebp - 0x24], 0
cmove eax, ecx
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x20]
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10064620
sub eax, edx
cmp eax, 0xc
je 0x10064665
nop
mov ecx, 0xc
sub ecx, eax
cmp eax, ecx
cmovae eax, ecx
push eax
lea eax, [ebp - 0x20]
push eax
push 0xd
push eax
call fcn.10073a18
lea eax, [ebp - 0x20]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10064652
sub eax, edx
cmp eax, 0xc
jne 0x10064630
mov cl, byte [ebp - 0x20]
jmp 0x10064668
mov ecx, dword [ebp - 0x30]
xor dl, dl
mov byte [ebp - 0x29], dl
test cl, cl
je 0x1006469d
lea esi, [ebp - 0x20]
movsx eax, cl
mov ecx, eax
shl ecx, 4
sub ecx, eax
and ecx, 0x8000007f
jns 0x1006468b
dec ecx
or ecx, 0xffffff80
inc ecx
mov al, byte [esi + 1]
inc esi
add cl, 0x11
add dl, cl
mov cl, al
test al, al
jne 0x10064674
mov byte [ebp - 0x29], dl
mov eax, dword [ebp - 0x18]
movq xmm0, qword [ebp - 0x20]
mov dword [0x100d935c], eax
mov al, byte [ebp - 0x1b]
mov byte [0x100d935f], al
xor eax, eax
movq qword [0x100d9354], xmm0
nop dword [eax]
xor byte [eax + 0x100d9354], dl
inc eax
cmp eax, 0xc
jl 0x100646c0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
movd xmm0, eax
pshufd xmm2, xmm0, 0
movsx eax, al
movaps xmm1, xmm2
movd xmm0, eax
mov eax, 6
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movaps xmmword [ebp - 0x60], xmm0
movd xmm0, eax
mov eax, 4
psrld xmm1, xmm0
mov edi, dword [ebp - 0x60]
pshuflw xmm0, xmm1, 0xd8
movaps xmm1, xmm2
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100cf760]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x50], xmm0
movd xmm0, eax
mov eax, 2
psrld xmm1, xmm0
mov esi, dword [ebp - 0x50]
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100cf760]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x40], xmm0
mov edx, dword [ebp - 0x40]
movd xmm0, eax
psrld xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100cf760]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x20], xmm0
mov eax, dword [ebp - 0x20]
movd xmm0, dword [ecx + 0x100d9354]
movd xmm1, esi
pxor xmm1, xmm0
movd xmm0, edx
pxor xmm1, xmm0
movd xmm0, eax
pxor xmm1, xmm0
movd xmm0, edi
pxor xmm1, xmm0
movd dword [ecx + 0x100d9354], xmm1
add ecx, 4
cmp ecx, 0xc
jl 0x100647a0
xor edx, edx
nop word [eax + eax]
movsx eax, byte [ebp - 0x29]
movsx ecx, dl
imul ecx, eax
xor byte [edx + 0x100d9354], cl
inc edx
cmp edx, 0xc
jl 0x100647e0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10064b15
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret