Function at 0x4d60b0
Capabilities:
Encode data using xor
Get hostname

Disassembly:
sub esp, 0xb0
mov eax, dword [0x551e00]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
xor ebx, ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x30], ebp
push 0xff
mov dword [esp + 0x2c], edi
xor esi, esi
mov dword [esp + 0x24], edi
call fcn.004d5270
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
je 0x4d66fc
movzx eax, word [ebp + 2]
movzx ecx, byte [ebp + 0x11]
and eax, 1
mov dword [esp + 0x14], eax
movzx eax, byte [ebp + 0x10]
shl ecx, 8
add ecx, eax
push 0x94
mov dword [esp + 0x28], ecx
call fcn.004d5270
mov edi, eax
add esp, 4
test edi, edi
je 0x4d66fc
lea eax, [esp + 0x28]
push eax
push 0x1c
push 1
call fcn.004d5350
cmp dword [esp + 0x28], ebx
je 0x4d66fc
push 0x94
mov dword [0x54fd90], eax
push ebx
push edi
mov dword [eax], 4
mov dword [eax + 0x18], edi
call fcn.004fa8e0
mov dword [edi + 0x20], 0xffffffff
add esp, 0xc
mov dword [0x54fd74], 4
movzx eax, word [ebp + 0x20]
mov dword [edi + 0x34], eax
push dword [ebp + 0x1c]
push ebp
call fcn.004d9db0
push dword [ebp + 0x14]
mov dword [esp + 0x14], eax
push ebp
call fcn.004d9db0
mov esi, eax
cmp dword [esp + 0x10], ebx
jne 0x4d623a
test esi, esi
je 0x4d66f8
push 0x105
call fcn.004d5270
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x4d66ea
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
push 0x200
push esi
call fcn.004d9c10
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4d66f8
cmp dword [esp + 0x14], ebx
je 0x4d620a
push eax
call fcn.004d5270
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4d66f8
push dword [esp + 0x14]
push esi
push dword [esp + 0x24]
push ebx
call fcn.004d9bc0
mov esi, ebx
push 0x408154
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x105
push dword [esp + 0x1c]
push esi
push 0xa
call fcn.004d58a0
add esp, 0x18
test ebx, ebx
je 0x4d623a
push ebx
call fcn.004f948a
add esp, 4
movzx eax, word [ebp + 0x12]
mov dword [esp + 0x1c], eax
cmp eax, 0xfffe
jne 0x4d627f
test esi, esi
jne 0x4d625c
mov dword [0x54fd74], 4
jmp 0x4d66f8
push esi
push 8
call fcn.004d5790
test eax, eax
jne 0x4d6277
mov dword [0x54fd74], 0x29
jmp 0x4d66f8
dec eax
movzx eax, ax
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x10]
xor ebx, ebx
cmp dword [esp + 0x20], ebx
sete bl
and ebx, dword [esp + 0x14]
push ebx
push 0x105
push esi
call fcn.004d9c10
mov dword [esp + 0x14], eax
test eax, eax
je 0x4d66fc
push eax
call fcn.004d5270
add esp, 4
mov dword [edi + 0x1c], eax
test eax, eax
je 0x4d66fc
push ebx
push esi
push dword [esp + 0x1c]
push eax
call fcn.004d9bc0
cmp dword [esp + 0x20], 0
je 0x4d62e0
push esi
call fcn.004f948a
add esp, 4
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x4d66de
push eax
push ebp
call fcn.004d9db0
movdqu xmm0, xmmword [eax]
movdqu xmmword [edi + 0x74], xmm0
movdqu xmm0, xmmword [eax + 0x10]
lea eax, [esp + 0x7c]
push eax
push edi
movdqu xmmword [edi + 0x84], xmm0
call fcn.004d7390
test eax, eax
je 0x4d66fc
movzx ecx, byte [edi + 0x18]
movzx eax, byte [edi + 0x19]
shl ecx, 8
add ecx, eax
cmp ecx, 0x120
je 0x4d6338
cmp ecx, 0x200
jne 0x4d633e
cmp dword [esp + 0x24], ecx
jbe 0x4d634d
mov dword [0x54fd74], 0xd
jmp 0x4d66fc
movzx eax, word [ebp + 0x22]
test ax, ax
je 0x4d6405
mov ebx, eax
shl ebx, 4
sub ebx, eax
movzx eax, word [ebp + 0x20]
add ebx, ebx
add eax, eax
lea ecx, [ebx + ebx]
cmp ecx, eax
jae 0x4d6377
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x34]
push eax
call fcn.004d5a40
movzx ecx, word [esp + 0x3a]
mov esi, eax
push ecx
movzx ecx, word [esp + 0x3a]
push ecx
movzx ecx, word [esp + 0x3c]
push ecx
call fcn.004daf10
mov ecx, dword [edi + 0x40]
imul eax, eax, 0xa8c0
add eax, esi
mov dword [esp + 0x24], eax
mov eax, ecx
and eax, 0x1f
push eax
mov eax, ecx
shr ecx, 9
shr eax, 5
and ecx, 0x7f
and eax, 0xf
add ecx, 0x7bc
push eax
push ecx
call fcn.004daf10
mov ecx, dword [esp + 0x24]
imul eax, eax, 0xa8c0
add eax, dword [edi + 0x44]
cmp eax, ecx
jbe 0x4d63ea
sub eax, ecx
jmp 0x4d63ee
sub ecx, eax
mov eax, ecx
mov esi, dword [esp + 0x10]
cmp eax, ebx
jbe 0x4d6405
mov dword [0x54fd74], 0x63
jmp 0x4d66fc
movzx eax, word [esp + 0x86]
add eax, 0x20
test dword [esp + 0xc8], 0x100000
mov dword [edi + 0x58], eax
je 0x4d6438
mov dword [edi], 0xffffffff
mov dword [edi + 0x5c], eax
mov dword [0x54fd74], 0
jmp 0x4d66fc
push dword [edi + 8]
movzx eax, word [esp + 0x8a]
or esi, 0xffffffff
push dword [esp + 0x1c]
add eax, 0x20
mov dword [esp + 0x1c], 0
push eax
push edi
xor ebx, ebx
call fcn.004d5cc0
test eax, eax
je 0x4d66f8
mov edx, dword [edi + 8]
xor eax, eax
test edx, edx
jle 0x4d64a8
mov edx, dword [esp + 0x1c]
xor ebp, ebp
mov ecx, dword [esp + 0x18]
mov cl, byte [eax + ecx]
cmp cl, 0xff
jne 0x4d6491
test esi, esi
jns 0x4d648e
cmp edx, 0xffff
cmove esi, eax
inc ebp
jmp 0x4d6497
cmp cl, 0xfe
je 0x4d6497
inc ebx
inc eax
cmp eax, dword [edi + 8]
jl 0x4d6475
mov edx, dword [edi + 8]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
lea eax, [ebx + ecx]
cmp eax, dword [edi + 4]
ja 0x4d66ee
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
cmp eax, 0xffff
je 0x4d64e4
cmp eax, edx
jae 0x4d64e4
mov dl, byte [eax + ebx]
cmp dl, 0xfe
je 0x4d64e4
mov esi, eax
cmp dl, 0xff
je 0x4d64e4
test byte [ebp], 1
je 0x4d64e4
mov byte [eax + ebx], 0xff
cmp esi, 0xffffffff
je 0x4d66d2
cmp byte [esi + ebx], 0xff
jne 0x4d66d2
movzx eax, si
mov dword [edi], eax
movzx eax, cx
dec eax
mov dword [edi + 0xc], eax
movzx eax, word [esp + 0x8c]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x58]
add eax, esi
mov dword [edi + 0x5c], eax
movzx eax, word [esp + 0x8c]
movzx ecx, word [esp + 0x8a]
add ecx, eax
movzx eax, word [esp + 0x88]
imul ecx, esi
push 0x1c
add ecx, eax
movzx eax, word [esp + 0x8a]
add eax, 0x20
add ecx, eax
mov dword [edi + 0x60], ecx
movzx eax, word [esp + 0x8e]
mov dword [edi + 0x64], eax
lea eax, [esp + 0x5c]
push eax
lea eax, [ecx + 0x14]
push eax
push edi
call fcn.004d5cc0
test eax, eax
je 0x4d66f8
cmp word [esp + 0x58], 0
je 0x4d65b5
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x5c]
add eax, dword [esp + 0x5a]
mov esi, 0x18
movzx eax, ax
xor byte [edx], al
lea edx, [edx + 1]
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
dec esi
jne 0x4d6585
cmp dword [esp + 0x70], esi
jne 0x4d66ee
movzx eax, word [esp + 0x5c]
inc eax
push 0x38
mov dword [edi + 0x54], eax
lea eax, [esp + 0x48]
push 0
push eax
call fcn.004fa8e0
mov eax, dword [esp + 0xa6]
add esp, 0xc
mov ecx, dword [esp + 0x98]
mov word [esp + 0x56], ax
mov word [esp + 0x5a], ax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x48]
mov word [esp + 0x58], cx
push eax
mov word [esp + 0x60], cx
mov dword [esp + 0x38], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ax, word [edi + 0x54]
lea edx, [esp + 0x5c]
mov word [esp + 0x5c], ax
mov esi, 0x18
mov eax, dword [esp + 0x98]
add eax, dword [esp + 0x9a]
movzx eax, ax
lea esp, [esp]
xor byte [edx], al
lea edx, [edx + 1]
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
dec esi
jne 0x4d6630
push 0x38
lea eax, [esp + 0x48]
push eax
push dword [edi + 0x60]
push edi
call fcn.004d7500
test eax, eax
je 0x4d66f8
mov al, byte [edi + 0x50]
push 1
mov byte [esp + 0x33], al
lea eax, [esp + 0x33]
push eax
push dword [edi + 0x5c]
push edi
call fcn.004d7500
test eax, eax
je 0x4d66f8
mov dword [edi + 0x14], esi
movzx eax, word [esp + 0x98]
mov dword [edi + 0x38], eax
movzx eax, word [esp + 0x9a]
mov dword [edi + 0x3c], eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x34]
push eax
call fcn.004d5a10
movzx eax, ax
mov dword [edi + 0x48], eax
lea eax, [esp + 0x34]
push eax
call fcn.004d5a40
mov dword [edi + 0x4c], eax
mov dword [0x54fd74], esi
jmp 0x4d66f8
mov dword [0x54fd74], 0x66
jmp 0x4d66f8
mov dword [0x54fd74], 4
jmp 0x4d66fc
mov esi, eax
jmp 0x4d66fc
mov dword [0x54fd74], 0x65
mov esi, dword [esp + 0x10]
push dword [esp + 0x18]
call fcn.004f948a
add esp, 4
cmp dword [esp + 0x20], 0
je 0x4d6718
push esi
call fcn.004f948a
add esp, 4
test edi, edi
je 0x4d673a
cmp dword [edi + 0x24], 0
je 0x4d673a
push 0
push 0x24
push 0
push 0x3c
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [edi + 0x24], 0
cmp dword [0x54fd74], 0
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
je 0x4d6760
test eax, eax
je 0x4d675e
push eax
call fcn.004d6870
push dword [esp + 0x18]
call fcn.004d5520
xor eax, eax
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.004f9e32
add esp, 0xb0
ret 8