Function at 0x1006d050
Capabilities:
Encode data using xor
Get disk information
Get session user name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x100af010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x101
lea eax, [ebp - 0x110]
mov dword [0x100b0404], 0
xorps xmm0, xmm0
push 0
push eax
movq qword [0x100b03fc], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x114], 0x101
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [ebp - 0x114]
mov ecx, 0x78
movzx edx, byte [ebp - 0x110]
test eax, eax
cmove edx, ecx
movzx ecx, byte [ebp - 0x104]
xor esi, esi
mov byte [ebp - 0x110], dl
dec eax
cmp eax, 0xc
cmova ecx, esi
mov byte [ebp - 0x104], cl
lea ecx, [ebp - 0x110]
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006d100
sub ecx, esi
cmp ecx, 0xc
jae 0x1006d176
nop
xor esi, esi
xor eax, eax
test dl, dl
je 0x1006d14f
nop dword [eax + eax]
inc esi
cmp byte [ebp + esi - 0x110], al
jne 0x1006d120
mov edx, esi
nop dword [eax]
cmp edx, 0xc
jae 0x1006d14f
mov cl, byte [ebp + eax - 0x110]
inc eax
mov byte [ebp + edx - 0x110], cl
inc edx
cmp byte [ebp + eax - 0x110], 0
jne 0x1006d130
add eax, esi
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov byte [ebp + eax - 0x110], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006d162
sub ecx, edx
mov dl, byte [ebp - 0x110]
cmp ecx, 0xc
jb 0x1006d110
xor cl, cl
mov byte [ebp - 0x119], cl
test dl, dl
je 0x1006d1b8
lea esi, [ebp - 0x110]
movsx eax, dl
mov ecx, eax
shl ecx, 4
sub ecx, eax
and ecx, 0x8000007f
jns 0x1006d19f
dec ecx
or ecx, 0xffffff80
inc ecx
mov al, byte [esi + 1]
inc esi
add cl, 0x11
mov dl, al
add byte [ebp - 0x119], cl
test al, al
jne 0x1006d188
mov cl, byte [ebp - 0x119]
mov eax, dword [ebp - 0x108]
movq xmm0, qword [ebp - 0x110]
mov dword [0x100b0404], eax
mov al, byte [ebp - 0x10b]
mov byte [0x100b0407], al
xor eax, eax
movq qword [0x100b03fc], xmm0
xor byte [eax + 0x100b03fc], cl
inc eax
cmp eax, 0xc
jl 0x1006d1e0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x118]
xor ecx, ecx
movd xmm0, eax
pshufd xmm2, xmm0, 0
movsx eax, al
movaps xmm1, xmm2
movd xmm0, eax
mov eax, 6
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movaps xmmword [ebp - 0x160], xmm0
movd xmm0, eax
mov eax, 4
psrld xmm1, xmm0
mov edi, dword [ebp - 0x160]
pshuflw xmm0, xmm1, 0xd8
movaps xmm1, xmm2
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100aa390]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x150], xmm0
movd xmm0, eax
mov eax, 2
psrld xmm1, xmm0
mov esi, dword [ebp - 0x150]
pshuflw xmm0, xmm1, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100aa390]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x140], xmm0
mov edx, dword [ebp - 0x140]
movd xmm0, eax
psrld xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm0, xmm0, 0xd8
pand xmm0, xmmword [0x100aa390]
packuswb xmm0, xmm0
movaps xmmword [ebp - 0x130], xmm0
mov eax, dword [ebp - 0x130]
nop
movd xmm1, dword [ecx + 0x100b03fc]
movd xmm0, esi
pxor xmm1, xmm0
movd xmm0, edx
pxor xmm1, xmm0
movd xmm0, eax
pxor xmm1, xmm0
movd xmm0, edi
pxor xmm1, xmm0
movd dword [ecx + 0x100b03fc], xmm1
add ecx, 4
cmp ecx, 0xc
jl 0x1006d2e0
xor edx, edx
nop word [eax + eax]
movsx eax, byte [ebp - 0x119]
movsx ecx, dl
imul ecx, eax
xor byte [edx + 0x100b03fc], cl
inc edx
cmp edx, 0xc
jl 0x1006d320
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1006dc26
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret