Function at 0x523570
Capabilities:
Encode data using xor
Get hostname

Disassembly:
sub esp, 0xb0
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
xor ebx, ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x30], ebp
push 0xff
mov dword [esp + 0x2c], edi
xor esi, esi
mov dword [esp + 0x24], edi
call fcn.00522730
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
je 0x523bbc
movzx eax, word [ebp + 2]
movzx ecx, byte [ebp + 0x11]
and eax, 1
mov dword [esp + 0x14], eax
movzx eax, byte [ebp + 0x10]
shl ecx, 8
add ecx, eax
push 0x94
mov dword [esp + 0x28], ecx
call fcn.00522730
mov edi, eax
add esp, 4
test edi, edi
je 0x523bbc
lea eax, [esp + 0x28]
push eax
push 0x1c
push 1
call fcn.00522810
cmp dword [esp + 0x28], ebx
je 0x523bbc
push 0x94
mov dword [0x598ca0], eax
push ebx
push edi
mov dword [eax], 4
mov dword [eax + 0x18], edi
call fcn.0054b440
mov dword [edi + 0x20], 0xffffffff
add esp, 0xc
mov dword [0x598c84], 4
movzx eax, word [ebp + 0x20]
mov dword [edi + 0x34], eax
push dword [ebp + 0x1c]
push ebp
call fcn.00527280
push dword [ebp + 0x14]
mov dword [esp + 0x14], eax
push ebp
call fcn.00527280
mov esi, eax
cmp dword [esp + 0x10], ebx
jne 0x5236fa
test esi, esi
je 0x523bb8
push 0x105
call fcn.00522730
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x523baa
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
push 0x200
push esi
call fcn.005270e0
mov dword [esp + 0x1c], eax
test eax, eax
je 0x523bb8
cmp dword [esp + 0x14], ebx
je 0x5236ca
push eax
call fcn.00522730
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x523bb8
push dword [esp + 0x14]
push esi
push dword [esp + 0x24]
push ebx
call fcn.00527090
mov esi, ebx
push 0x444144
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x105
push dword [esp + 0x1c]
push esi
push 0xa
call fcn.00522d60
add esp, 0x18
test ebx, ebx
je 0x5236fa
push ebx
call fcn.00549ff4
add esp, 4
movzx eax, word [ebp + 0x12]
mov dword [esp + 0x1c], eax
cmp eax, 0xfffe
jne 0x52373f
test esi, esi
jne 0x52371c
mov dword [0x598c84], 4
jmp 0x523bb8
push esi
push 8
call fcn.00522c50
test eax, eax
jne 0x523737
mov dword [0x598c84], 0x29
jmp 0x523bb8
dec eax
movzx eax, ax
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x10]
xor ebx, ebx
cmp dword [esp + 0x20], ebx
sete bl
and ebx, dword [esp + 0x14]
push ebx
push 0x105
push esi
call fcn.005270e0
mov dword [esp + 0x14], eax
test eax, eax
je 0x523bbc
push eax
call fcn.00522730
add esp, 4
mov dword [edi + 0x1c], eax
test eax, eax
je 0x523bbc
push ebx
push esi
push dword [esp + 0x1c]
push eax
call fcn.00527090
cmp dword [esp + 0x20], 0
je 0x5237a0
push esi
call fcn.00549ff4
add esp, 4
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x523b9e
push eax
push ebp
call fcn.00527280
movdqu xmm0, xmmword [eax]
movdqu xmmword [edi + 0x74], xmm0
movdqu xmm0, xmmword [eax + 0x10]
lea eax, [esp + 0x7c]
push eax
push edi
movdqu xmmword [edi + 0x84], xmm0
call fcn.00524850
test eax, eax
je 0x523bbc
movzx ecx, byte [edi + 0x18]
movzx eax, byte [edi + 0x19]
shl ecx, 8
add ecx, eax
cmp ecx, 0x120
je 0x5237f8
cmp ecx, 0x200
jne 0x5237fe
cmp dword [esp + 0x24], ecx
jbe 0x52380d
mov dword [0x598c84], 0xd
jmp 0x523bbc
movzx eax, word [ebp + 0x22]
test ax, ax
je 0x5238c5
mov ebx, eax
shl ebx, 4
sub ebx, eax
movzx eax, word [ebp + 0x20]
add ebx, ebx
add eax, eax
lea ecx, [ebx + ebx]
cmp ecx, eax
jae 0x523837
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x34]
push eax
call fcn.00522f00
movzx ecx, word [esp + 0x3a]
mov esi, eax
push ecx
movzx ecx, word [esp + 0x3a]
push ecx
movzx ecx, word [esp + 0x3c]
push ecx
call fcn.005283e0
mov ecx, dword [edi + 0x40]
imul eax, eax, 0xa8c0
add eax, esi
mov dword [esp + 0x24], eax
mov eax, ecx
and eax, 0x1f
push eax
mov eax, ecx
shr ecx, 9
shr eax, 5
and ecx, 0x7f
and eax, 0xf
add ecx, 0x7bc
push eax
push ecx
call fcn.005283e0
mov ecx, dword [esp + 0x24]
imul eax, eax, 0xa8c0
add eax, dword [edi + 0x44]
cmp eax, ecx
jbe 0x5238aa
sub eax, ecx
jmp 0x5238ae
sub ecx, eax
mov eax, ecx
mov esi, dword [esp + 0x10]
cmp eax, ebx
jbe 0x5238c5
mov dword [0x598c84], 0x63
jmp 0x523bbc
movzx eax, word [esp + 0x86]
add eax, 0x20
test dword [esp + 0xc8], 0x100000
mov dword [edi + 0x58], eax
je 0x5238f8
mov dword [edi], 0xffffffff
mov dword [edi + 0x5c], eax
mov dword [0x598c84], 0
jmp 0x523bbc
push dword [edi + 8]
movzx eax, word [esp + 0x8a]
or esi, 0xffffffff
push dword [esp + 0x1c]
add eax, 0x20
mov dword [esp + 0x1c], 0
push eax
push edi
xor ebx, ebx
call fcn.00523180
test eax, eax
je 0x523bb8
mov edx, dword [edi + 8]
xor eax, eax
test edx, edx
jle 0x523968
mov edx, dword [esp + 0x1c]
xor ebp, ebp
mov ecx, dword [esp + 0x18]
mov cl, byte [eax + ecx]
cmp cl, 0xff
jne 0x523951
test esi, esi
jns 0x52394e
cmp edx, 0xffff
cmove esi, eax
inc ebp
jmp 0x523957
cmp cl, 0xfe
je 0x523957
inc ebx
inc eax
cmp eax, dword [edi + 8]
jl 0x523935
mov edx, dword [edi + 8]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
lea eax, [ebx + ecx]
cmp eax, dword [edi + 4]
ja 0x523bae
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
cmp eax, 0xffff
je 0x5239a4
cmp eax, edx
jae 0x5239a4
mov dl, byte [eax + ebx]
cmp dl, 0xfe
je 0x5239a4
mov esi, eax
cmp dl, 0xff
je 0x5239a4
test byte [ebp], 1
je 0x5239a4
mov byte [eax + ebx], 0xff
cmp esi, 0xffffffff
je 0x523b92
cmp byte [esi + ebx], 0xff
jne 0x523b92
movzx eax, si
mov dword [edi], eax
movzx eax, cx
dec eax
mov dword [edi + 0xc], eax
movzx eax, word [esp + 0x8c]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x58]
add eax, esi
mov dword [edi + 0x5c], eax
movzx eax, word [esp + 0x8c]
movzx ecx, word [esp + 0x8a]
add ecx, eax
movzx eax, word [esp + 0x88]
imul ecx, esi
push 0x1c
add ecx, eax
movzx eax, word [esp + 0x8a]
add eax, 0x20
add ecx, eax
mov dword [edi + 0x60], ecx
movzx eax, word [esp + 0x8e]
mov dword [edi + 0x64], eax
lea eax, [esp + 0x5c]
push eax
lea eax, [ecx + 0x14]
push eax
push edi
call fcn.00523180
test eax, eax
je 0x523bb8
cmp word [esp + 0x58], 0
je 0x523a75
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x5c]
add eax, dword [esp + 0x5a]
mov esi, 0x18
movzx eax, ax
xor byte [edx], al
lea edx, [edx + 1]
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
dec esi
jne 0x523a45
cmp dword [esp + 0x70], esi
jne 0x523bae
movzx eax, word [esp + 0x5c]
inc eax
push 0x38
mov dword [edi + 0x54], eax
lea eax, [esp + 0x48]
push 0
push eax
call fcn.0054b440
mov eax, dword [esp + 0xa6]
add esp, 0xc
mov ecx, dword [esp + 0x98]
mov word [esp + 0x56], ax
mov word [esp + 0x5a], ax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x48]
mov word [esp + 0x58], cx
push eax
mov word [esp + 0x60], cx
mov dword [esp + 0x38], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ax, word [edi + 0x54]
lea edx, [esp + 0x5c]
mov word [esp + 0x5c], ax
mov esi, 0x18
mov eax, dword [esp + 0x98]
add eax, dword [esp + 0x9a]
movzx eax, ax
lea esp, [esp]
xor byte [edx], al
lea edx, [edx + 1]
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
dec esi
jne 0x523af0
push 0x38
lea eax, [esp + 0x48]
push eax
push dword [edi + 0x60]
push edi
call fcn.005249c0
test eax, eax
je 0x523bb8
mov al, byte [edi + 0x50]
push 1
mov byte [esp + 0x33], al
lea eax, [esp + 0x33]
push eax
push dword [edi + 0x5c]
push edi
call fcn.005249c0
test eax, eax
je 0x523bb8
mov dword [edi + 0x14], esi
movzx eax, word [esp + 0x98]
mov dword [edi + 0x38], eax
movzx eax, word [esp + 0x9a]
mov dword [edi + 0x3c], eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x34]
push eax
call fcn.00522ed0
movzx eax, ax
mov dword [edi + 0x48], eax
lea eax, [esp + 0x34]
push eax
call fcn.00522f00
mov dword [edi + 0x4c], eax
mov dword [0x598c84], esi
jmp 0x523bb8
mov dword [0x598c84], 0x66
jmp 0x523bb8
mov dword [0x598c84], 4
jmp 0x523bbc
mov esi, eax
jmp 0x523bbc
mov dword [0x598c84], 0x65
mov esi, dword [esp + 0x10]
push dword [esp + 0x18]
call fcn.00549ff4
add esp, 4
cmp dword [esp + 0x20], 0
je 0x523bd8
push esi
call fcn.00549ff4
add esp, 4
test edi, edi
je 0x523bfa
cmp dword [edi + 0x24], 0
je 0x523bfa
push 0
push 0x24
push 0
push 0x3c
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [edi + 0x24], 0
cmp dword [0x598c84], 0
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
je 0x523c20
test eax, eax
je 0x523c1e
push eax
call fcn.00523d30
push dword [esp + 0x18]
call fcn.005229e0
xor eax, eax
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.0054a992
add esp, 0xb0
ret 8