Function at 0x522110
Capabilities:
Encode data using xor
Get hostname

Disassembly:
sub esp, 0xb0
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
push esi
xor esi, esi
push 0xff
xor ebx, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.0051f5b0
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, esi
je 0x522751
movzx eax, byte [ebp + 0x11]
movzx ecx, byte [ebp + 0x10]
push edi
movzx edi, word [ebp + 2]
shl eax, 8
add eax, ecx
push 0x94
and edi, 1
mov dword [esp + 0x14], eax
call fcn.0051f5b0
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x522750
lea edx, [esp + 0x24]
push edx
push 0x1c
push 1
call fcn.0051f700
cmp dword [esp + 0x24], esi
je 0x522750
push 0x94
mov dword [0x463b50], eax
push esi
push ebx
mov dword [eax], 4
mov dword [eax + 0x18], ebx
call fcn.00526600
mov dword [ebx + 0x20], 0xffffffff
mov dword [0x463b34], 4
movzx eax, word [ebp + 0x20]
add esp, 0xc
mov dword [ebx + 0x34], eax
mov ecx, dword [ebp + 0x1c]
push ecx
push ebp
call fcn.00520330
mov edx, dword [ebp + 0x14]
push edx
push ebp
mov dword [esp + 0x1c], eax
call fcn.00520330
cmp dword [esp + 0x14], 0
mov esi, eax
jne 0x522295
test esi, esi
je 0x522750
push 0x105
call fcn.0051f5b0
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x522750
push edi
push 0x200
push esi
mov dword [esp + 0x2c], 1
call fcn.00520200
test eax, eax
je 0x522750
test edi, edi
je 0x52225f
push eax
call fcn.0051f5b0
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
je 0x522750
push edi
push esi
push eax
call fcn.00520280
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 0x4651d5
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x1c]
push 0x105
push ecx
push esi
push 0xa
call fcn.00524430
mov eax, dword [esp + 0x30]
add esp, 0x18
test eax, eax
je 0x522295
push eax
call fcn.00526d54
add esp, 4
movzx eax, word [ebp + 0x12]
mov dword [esp + 0x2c], eax
cmp eax, 0xfffe
jne 0x5222cf
test esi, esi
je 0x522746
push esi
push 8
call fcn.0051fa30
test eax, eax
jne 0x5222c7
mov dword [0x463b34], 0x29
jmp 0x522750
dec eax
movzx edx, ax
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp dword [esp + 0x20], eax
sete al
mov esi, eax
and esi, edi
push esi
push 0x105
push ecx
call fcn.00520200
test eax, eax
je 0x522750
push eax
call fcn.0051f5b0
add esp, 4
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x522750
push esi
mov esi, dword [esp + 0x18]
push esi
push eax
call fcn.00520280
cmp dword [esp + 0x20], 0
je 0x52232c
push esi
call fcn.00526d54
add esp, 4
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x522746
push eax
push ebp
call fcn.00520330
lea edx, [esp + 0x7c]
push edx
mov esi, eax
lea edi, [ebx + 0x74]
mov ecx, 8
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00521110
test eax, eax
je 0x522750
movzx eax, byte [ebx + 0x18]
movzx ecx, byte [ebx + 0x19]
shl eax, 8
add eax, ecx
cmp eax, 0x120
je 0x522378
cmp eax, 0x200
jne 0x52237e
cmp dword [esp + 0x10], eax
jbe 0x52238d
mov dword [0x463b34], 0xd
jmp 0x522750
movzx eax, word [ebp + 0x22]
xor ecx, ecx
cmp ax, cx
je 0x522444
movzx eax, ax
mov edi, eax
shl edi, 4
sub edi, eax
movzx eax, word [ebp + 0x20]
add edi, edi
add eax, eax
lea edx, [edi + edi]
cmp edx, eax
jae 0x5223bc
cdq
sub eax, edx
mov edi, eax
sar edi, 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x34]
call fcn.00520de0
movzx ecx, word [esp + 0x3a]
movzx edx, word [esp + 0x36]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x34]
push ecx
push edx
push eax
call fcn.005254a0
mov esi, eax
mov eax, dword [ebx + 0x40]
imul esi, esi, 0xa8c0
add esi, dword [esp + 0x10]
mov ecx, eax
mov edx, eax
shr eax, 9
and ecx, 0x1f
shr edx, 5
push ecx
and edx, 0xf
and eax, 0x7f
push edx
add eax, 0x7bc
push eax
call fcn.005254a0
imul eax, eax, 0xa8c0
add eax, dword [ebx + 0x44]
cmp eax, esi
jbe 0x52242b
sub eax, esi
jmp 0x52242f
sub esi, eax
mov eax, esi
cmp eax, edi
jbe 0x522442
mov dword [0x463b34], 0x63
jmp 0x522750
xor ecx, ecx
movzx eax, word [esp + 0x86]
add eax, 0x20
test dword [esp + 0xc8], 0x100000
mov dword [ebx + 0x58], eax
je 0x522475
mov edx, eax
mov dword [ebx], 0xffffffff
mov dword [ebx + 0x5c], edx
mov dword [0x463b34], ecx
jmp 0x522750
mov eax, dword [esp + 0x28]
mov edi, dword [ebx + 8]
push eax
movzx eax, word [esp + 0x8a]
add eax, 0x20
mov esi, ebx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], ecx
call fcn.00520e10
test eax, eax
je 0x522750
mov edi, dword [ebx + 8]
xor ecx, ecx
test edi, edi
jle 0x5224e7
mov esi, edi
mov edx, dword [esp + 0x28]
mov al, byte [ecx + edx]
cmp al, 0xff
jne 0x5224d8
cmp dword [esp + 0x10], 0
jge 0x5224d2
cmp dword [esp + 0x2c], 0xffff
jne 0x5224d2
mov dword [esp + 0x10], ecx
inc dword [esp + 0x30]
jmp 0x5224e0
cmp al, 0xfe
je 0x5224e0
inc dword [esp + 0x18]
inc ecx
cmp ecx, esi
jl 0x5224b2
jmp 0x5224eb
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
add eax, ecx
cmp eax, dword [ebx + 4]
jbe 0x522509
mov dword [0x463b34], 0x65
jmp 0x522750
mov eax, dword [esp + 0x2c]
cmp eax, 0xffff
je 0x522530
cmp eax, edi
jae 0x522530
cmp byte [eax + edx], 0xfe
je 0x522530
cmp byte [eax + edx], 0xff
je 0x522534
test byte [ebp], 1
je 0x522534
mov byte [eax + edx], 0xff
jmp 0x522534
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x52273a
cmp byte [eax + edx], 0xff
jne 0x52273a
movzx ecx, cx
movzx edx, ax
mov dword [ebx], edx
dec ecx
mov dword [ebx + 0xc], ecx
movzx edx, word [esp + 0x8c]
mov ecx, dword [ebx + 0x58]
add ecx, eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x5c], ecx
movzx ecx, word [esp + 0x8c]
movzx edx, word [esp + 0x8a]
add edx, ecx
movzx ecx, word [esp + 0x86]
imul edx, eax
movzx eax, word [esp + 0x88]
add edx, eax
lea edx, [edx + ecx + 0x20]
mov dword [ebx + 0x60], edx
movzx eax, word [esp + 0x8a]
mov dword [ebx + 0x64], eax
lea ecx, [esp + 0x58]
mov eax, edx
push ecx
add eax, 0x14
mov edi, 0x1c
mov esi, ebx
call fcn.00520e10
test eax, eax
je 0x522750
cmp word [esp + 0x58], 0
je 0x52261b
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5a]
add edx, eax
movzx eax, dx
lea ecx, [esp + 0x5c]
lea edx, [edi - 4]
lea esp, [esp]
xor byte [ecx], al
mov si, ax
shr si, 0xf
add eax, eax
add si, ax
movzx eax, si
mov si, ax
add eax, eax
shr si, 0xf
add si, ax
inc ecx
sub edx, 1
movzx eax, si
jne 0x5225e0
cmp dword [esp + 0x70], edx
je 0x52261b
mov dword [0x463b34], 0x65
jmp 0x522750
movzx ecx, word [esp + 0x5c]
push 0x38
lea edx, [esp + 0x48]
inc ecx
push 0
push edx
mov dword [ebx + 0x54], ecx
call fcn.00526600
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa6]
add esp, 0xc
mov word [esp + 0x54], ax
mov word [esp + 0x58], ax
lea eax, [esp + 0x10]
mov word [esp + 0x56], cx
mov word [esp + 0x5a], cx
push eax
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dx, word [ebx + 0x54]
mov eax, dword [esp + 0x9a]
mov word [esp + 0x5c], dx
mov edx, dword [esp + 0x98]
add eax, edx
lea ecx, [esp + 0x5c]
movzx eax, ax
mov edx, 0x18
xor byte [ecx], al
mov si, ax
shr si, 0xf
add eax, eax
add si, ax
movzx eax, si
mov si, ax
add eax, eax
shr si, 0xf
add si, ax
inc ecx
sub edx, 1
movzx eax, si
jne 0x522694
mov eax, dword [ebx + 0x60]
lea ecx, [esp + 0x44]
push ecx
lea edi, [edx + 0x38]
mov esi, ebx
call fcn.00520ee0
test eax, eax
je 0x522750
mov dl, byte [ebx + 0x50]
lea eax, [esp + 0x1f]
push eax
mov eax, dword [ebx + 0x5c]
mov edi, 1
mov byte [esp + 0x23], dl
call fcn.00520ee0
test eax, eax
je 0x522750
xor esi, esi
mov dword [ebx + 0x14], esi
movzx ecx, word [esp + 0x98]
mov dword [ebx + 0x38], ecx
movzx edx, word [esp + 0x9a]
lea eax, [esp + 0x34]
push eax
mov dword [ebx + 0x3c], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esp + 0x34]
call fcn.00520db0
movzx ecx, ax
lea eax, [esp + 0x34]
mov dword [ebx + 0x48], ecx
call fcn.00520de0
mov dword [ebx + 0x4c], eax
mov dword [0x463b34], esi
jmp 0x522750
mov dword [0x463b34], 0x66
jmp 0x522750
mov dword [0x463b34], 4
pop edi
mov edx, dword [esp + 0x24]
push edx
call fcn.00526d54
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x522772
mov eax, dword [esp + 0x10]
push eax
call fcn.00526d54
add esp, 4
test ebx, ebx
je 0x522795
cmp dword [ebx + 0x24], 0
je 0x522795
mov ecx, dword [ebx + 0x20]
push 0
push 0x24
push 0
push 0x3c
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [ebx + 0x24], 0
cmp dword [0x463b34], 0
mov eax, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
je 0x5227bb
test eax, eax
je 0x5227b9
push eax
call fcn.00521510
mov edx, dword [esp + 0x14]
push edx
call fcn.0051f8b0
xor eax, eax
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.00526a8a
add esp, 0xb0
ret 8