Function at 0x4755f0
Capabilities:
Encode data using xor
Get session user name

Disassembly:
sub esp, 0x330
push ebx
push ebp
push esi
mov esi, dword [esp + 0x344]
push edi
push 0x1b00
mov ecx, 5
lea edi, [esp + 0x28]
push 0x40
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x100]
push ecx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor edi, edi
xor esi, esi
mov dword [esp + 0x6c], 0x4e6d48
mov dword [esp + 0x4c], edi
mov dword [esp + 0x10], esi
mov ebp, dword [esp + 0x344]
mov eax, dword [ebp + esi*4 + 0x28]
mov edx, eax
and edx, 0xff0000
mov ebx, eax
shr ebx, 0x10
or edx, ebx
mov ebx, eax
shl ebx, 0x10
and eax, 0xff00
or ebx, eax
shr edx, 8
shl ebx, 8
lea ecx, [esi*4]
or edx, ebx
cmp ecx, 0x10
mov dword [esp + ecx + 0x200], edx
jge 0x475694
mov eax, 3
jmp 0x4756bb
cmp ecx, 0x20
jge 0x4756a0
mov eax, 2
jmp 0x4756bb
cmp ecx, 0x30
jge 0x4756ac
mov eax, 0xfffffffc
jmp 0x4756bb
xor eax, eax
cmp ecx, 0x40
setge al
dec eax
and eax, 4
add eax, 0xfffffffd
mov dword [esp + ecx + 0x7c], eax
xor eax, eax
mov ah, byte [esp + esi + 0xff]
xor edx, edx
mov dl, byte [esp + esi + 0xfc]
mov al, byte [esp + esi + 0xfd]
shl eax, 8
or eax, edx
inc esi
cmp esi, 0x10
mov dword [esp + ecx + 0xbc], eax
mov dword [esp + 0x10], esi
jl 0x47564c
cmp esi, 0x50
mov eax, 0x30
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
jge 0x47573d
mov edx, 0x50
lea ecx, [esp + esi*4 + 0x1c8]
sub edx, esi
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x2c]
mov ebx, dword [ecx - 8]
xor eax, esi
mov esi, dword [ecx]
xor eax, ebx
xor eax, esi
mov esi, eax
shr esi, 0x1f
add eax, eax
or esi, eax
mov dword [ecx + 0x38], esi
add ecx, 4
dec edx
jne 0x47571a
mov edx, dword [esp + 0xbc]
mov ecx, dword [esp + 0x24]
and edx, 0x3f
push edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x10]
push 2
mov dword [esp + ecx*4 + 0x80], eax
inc ecx
lea eax, [esp + 0x50]
push eax
push 2
mov dword [esp + 0x1c], ecx
lea ecx, [ebp + 0x38]
push ecx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0x28]
and edx, 1
push edx
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x7c], eax
mov eax, dword [esp + 0xc4]
and eax, 0xf
inc ecx
push eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x28]
mov edi, dword [esp + 0x30]
mov dword [esp + ecx*4 + 0x7c], eax
mov eax, dword [esp + 0x34]
or edx, 0x80000000
inc ecx
mov dword [esp + ecx*4 + 0x7c], edx
mov edx, dword [ebp + 0x2c]
and edx, 0xffffff
mov dword [esp + 0x18], eax
mov dword [esp + ecx*4 + 0x80], edx
mov eax, dword [esp + 0xac]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
fild qword [esp + 0x1c]
call fcn.0044f130
call fcn.00408160
mov ebp, eax
cmp ebp, 0x50
mov dword [esp + 0x10], ebp
jge 0x4758f8
lea ecx, [esp + ebp*4 + 0x200]
mov dword [esp + 0x1c], ecx
cmp ebp, 0x10
jge 0x47582e
mov edx, edi
xor edx, ebx
jmp 0x475865
cmp ebp, 0x20
jge 0x475841
mov edx, esi
not edx
mov eax, ebx
and edx, edi
and eax, esi
or edx, eax
jmp 0x475867
cmp ebp, 0x30
jge 0x475850
mov edx, ebx
not edx
or edx, esi
xor edx, edi
jmp 0x475867
cmp ebp, 0x40
mov edx, edi
not edx
jge 0x475863
mov ecx, edi
and edx, ebx
and ecx, esi
or edx, ecx
jmp 0x475867
or edx, ebx
xor edx, esi
cmp ebp, 0x10
jge 0x475876
mov dword [esp + 0x10], 0
jmp 0x4758ab
cmp ebp, 0x20
jge 0x475885
mov dword [esp + 0x10], 0x5a827999
jmp 0x4758ab
cmp ebp, 0x30
jge 0x475894
mov dword [esp + 0x10], 0x6ed9eba1
jmp 0x4758ab
xor eax, eax
cmp ebp, 0x40
setge al
dec eax
and eax, 0xe5c7bf8e
add eax, 0xa953fd4e
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x1b
shl eax, 5
or ecx, eax
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
add ecx, edx
add ecx, dword [eax]
add ecx, dword [esp + 0x18]
mov edx, esi
shr esi, 2
shl edx, 0x1e
or edx, esi
mov esi, dword [esp + 0x14]
inc ebp
add eax, 4
cmp ebp, 0x50
mov dword [esp + 0x18], edi
mov edi, ebx
mov ebx, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jl 0x475823
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x88]
test eax, 0x78000000
jne 0x47590b
or eax, 0x98000000
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x2c]
add edx, ecx
mov ecx, dword [esp + 0x28]
add ecx, esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0x24], edx
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x90]
push ecx
push eax
push 0x90
push 0
push 0
lea edx, [esp + 0x84]
push esi
add ebp, ebx
push edx
mov dword [esp + 0x4c], ebp
call fcn.0040f5b0
mov ebx, dword [esp + 0x54]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x48]
mov ebp, dword [esp + 0x50]
mov edx, dword [esp + 0x44]
add ebx, eax
add esp, 0x20
lea eax, [esp + 0x38]
mov dword [esp + 0x54], ecx
push eax
lea ecx, [esp + 0x58]
and edx, 0x7fffffff
add ebp, edi
push ecx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov edx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x44]
mov eax, dword [esp + 0x30]
add ebp, edx
imul dword [esp + 0x2c]
mov ecx, 8
mov dword [esp + 0x44], ebp
call fcn.0049f9b0
push 0x1b00
push esi
mov dword [esp + 0x50], eax
call fcn.00474180
add eax, dword [esp + 0x50]
add esp, 8
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov edx, dword [esp + eax*4 + 0x24]
mov ecx, dword [esp + 0x344]
xor dword [ecx + eax*4], edx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jl 0x4759df
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x330
ret