Function at 0x4c68e0
Capabilities:
Encode data using xor
Get hostname

Disassembly:
sub esp, 0xb0
mov eax, dword [0x417270]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
mov ebp, dword [esp + 0xbc]
push esi
xor esi, esi
push 0xff
xor ebx, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call fcn.004c3d90
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, esi
je 0x4c6f21
movzx eax, byte [ebp + 0x11]
movzx ecx, byte [ebp + 0x10]
push edi
movzx edi, word [ebp + 2]
shl eax, 8
add eax, ecx
push 0x94
and edi, 1
mov dword [esp + 0x14], eax
call fcn.004c3d90
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x4c6f20
lea edx, [esp + 0x24]
push edx
push 0x1c
push 1
call fcn.004c3ee0
cmp dword [esp + 0x24], esi
je 0x4c6f20
push 0x94
mov dword [0x416fc8], eax
push esi
push ebx
mov dword [eax], 4
mov dword [eax + 0x18], ebx
call fcn.004caf20
mov dword [ebx + 0x20], 0xffffffff
mov dword [0x416fac], 4
movzx eax, word [ebp + 0x20]
add esp, 0xc
mov dword [ebx + 0x34], eax
mov ecx, dword [ebp + 0x1c]
push ecx
push ebp
call fcn.004c4b10
mov edx, dword [ebp + 0x14]
push edx
push ebp
mov dword [esp + 0x1c], eax
call fcn.004c4b10
cmp dword [esp + 0x14], 0
mov esi, eax
jne 0x4c6a65
test esi, esi
je 0x4c6f20
push 0x105
call fcn.004c3d90
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x4c6f20
push edi
push 0x200
push esi
mov dword [esp + 0x2c], 1
call fcn.004c49e0
test eax, eax
je 0x4c6f20
test edi, edi
je 0x4c6a2f
push eax
call fcn.004c3d90
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
je 0x4c6f20
push edi
push esi
push eax
call fcn.004c4a60
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 0x4186a1
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x1c]
push 0x105
push ecx
push esi
push 0xa
call fcn.004c8be0
mov eax, dword [esp + 0x30]
add esp, 0x18
test eax, eax
je 0x4c6a65
push eax
call fcn.004cb4e1
add esp, 4
movzx eax, word [ebp + 0x12]
mov dword [esp + 0x2c], eax
cmp eax, 0xfffe
jne 0x4c6a9f
test esi, esi
je 0x4c6f16
push esi
push 8
call fcn.004c4210
test eax, eax
jne 0x4c6a97
mov dword [0x416fac], 0x29
jmp 0x4c6f20
dec eax
movzx edx, ax
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp dword [esp + 0x20], eax
sete al
mov esi, eax
and esi, edi
push esi
push 0x105
push ecx
call fcn.004c49e0
test eax, eax
je 0x4c6f20
push eax
call fcn.004c3d90
add esp, 4
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x4c6f20
push esi
mov esi, dword [esp + 0x18]
push esi
push eax
call fcn.004c4a60
cmp dword [esp + 0x20], 0
je 0x4c6afc
push esi
call fcn.004cb4e1
add esp, 4
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x4c6f16
push eax
push ebp
call fcn.004c4b10
lea edx, [esp + 0x7c]
push edx
mov esi, eax
lea edi, [ebx + 0x74]
mov ecx, 8
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.004c58e0
test eax, eax
je 0x4c6f20
movzx eax, byte [ebx + 0x18]
movzx ecx, byte [ebx + 0x19]
shl eax, 8
add eax, ecx
cmp eax, 0x120
je 0x4c6b48
cmp eax, 0x200
jne 0x4c6b4e
cmp dword [esp + 0x10], eax
jbe 0x4c6b5d
mov dword [0x416fac], 0xd
jmp 0x4c6f20
movzx eax, word [ebp + 0x22]
xor ecx, ecx
cmp ax, cx
je 0x4c6c14
movzx eax, ax
mov edi, eax
shl edi, 4
sub edi, eax
movzx eax, word [ebp + 0x20]
add edi, edi
add eax, eax
lea edx, [edi + edi]
cmp edx, eax
jae 0x4c6b8c
cdq
sub eax, edx
mov edi, eax
sar edi, 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x34]
call fcn.004c55b0
movzx ecx, word [esp + 0x3a]
movzx edx, word [esp + 0x36]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x34]
push ecx
push edx
push eax
call fcn.004c9c50
mov esi, eax
mov eax, dword [ebx + 0x40]
imul esi, esi, 0xa8c0
add esi, dword [esp + 0x10]
mov ecx, eax
mov edx, eax
shr eax, 9
and ecx, 0x1f
shr edx, 5
push ecx
and edx, 0xf
and eax, 0x7f
push edx
add eax, 0x7bc
push eax
call fcn.004c9c50
imul eax, eax, 0xa8c0
add eax, dword [ebx + 0x44]
cmp eax, esi
jbe 0x4c6bfb
sub eax, esi
jmp 0x4c6bff
sub esi, eax
mov eax, esi
cmp eax, edi
jbe 0x4c6c12
mov dword [0x416fac], 0x63
jmp 0x4c6f20
xor ecx, ecx
movzx eax, word [esp + 0x86]
add eax, 0x20
test dword [esp + 0xc8], 0x100000
mov dword [ebx + 0x58], eax
je 0x4c6c45
mov edx, eax
mov dword [ebx], 0xffffffff
mov dword [ebx + 0x5c], edx
mov dword [0x416fac], ecx
jmp 0x4c6f20
mov eax, dword [esp + 0x28]
mov edi, dword [ebx + 8]
push eax
movzx eax, word [esp + 0x8a]
add eax, 0x20
mov esi, ebx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], ecx
call fcn.004c55e0
test eax, eax
je 0x4c6f20
mov edi, dword [ebx + 8]
xor ecx, ecx
test edi, edi
jle 0x4c6cb7
mov esi, edi
mov edx, dword [esp + 0x28]
mov al, byte [ecx + edx]
cmp al, 0xff
jne 0x4c6ca8
cmp dword [esp + 0x10], 0
jge 0x4c6ca2
cmp dword [esp + 0x2c], 0xffff
jne 0x4c6ca2
mov dword [esp + 0x10], ecx
inc dword [esp + 0x30]
jmp 0x4c6cb0
cmp al, 0xfe
je 0x4c6cb0
inc dword [esp + 0x18]
inc ecx
cmp ecx, esi
jl 0x4c6c82
jmp 0x4c6cbb
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
add eax, ecx
cmp eax, dword [ebx + 4]
jbe 0x4c6cd9
mov dword [0x416fac], 0x65
jmp 0x4c6f20
mov eax, dword [esp + 0x2c]
cmp eax, 0xffff
je 0x4c6d00
cmp eax, edi
jae 0x4c6d00
cmp byte [eax + edx], 0xfe
je 0x4c6d00
cmp byte [eax + edx], 0xff
je 0x4c6d04
test byte [ebp], 1
je 0x4c6d04
mov byte [eax + edx], 0xff
jmp 0x4c6d04
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x4c6f0a
cmp byte [eax + edx], 0xff
jne 0x4c6f0a
movzx ecx, cx
movzx edx, ax
mov dword [ebx], edx
dec ecx
mov dword [ebx + 0xc], ecx
movzx edx, word [esp + 0x8c]
mov ecx, dword [ebx + 0x58]
add ecx, eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x5c], ecx
movzx ecx, word [esp + 0x8c]
movzx edx, word [esp + 0x8a]
add edx, ecx
movzx ecx, word [esp + 0x86]
imul edx, eax
movzx eax, word [esp + 0x88]
add edx, eax
lea edx, [edx + ecx + 0x20]
mov dword [ebx + 0x60], edx
movzx eax, word [esp + 0x8a]
mov dword [ebx + 0x64], eax
lea ecx, [esp + 0x58]
mov eax, edx
push ecx
add eax, 0x14
mov edi, 0x1c
mov esi, ebx
call fcn.004c55e0
test eax, eax
je 0x4c6f20
cmp word [esp + 0x58], 0
je 0x4c6deb
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5a]
add edx, eax
movzx eax, dx
lea ecx, [esp + 0x5c]
lea edx, [edi - 4]
lea esp, [esp]
xor byte [ecx], al
mov si, ax
shr si, 0xf
add eax, eax
add si, ax
movzx eax, si
mov si, ax
add eax, eax
shr si, 0xf
add si, ax
inc ecx
sub edx, 1
movzx eax, si
jne 0x4c6db0
cmp dword [esp + 0x70], edx
je 0x4c6deb
mov dword [0x416fac], 0x65
jmp 0x4c6f20
movzx ecx, word [esp + 0x5c]
push 0x38
lea edx, [esp + 0x48]
inc ecx
push 0
push edx
mov dword [ebx + 0x54], ecx
call fcn.004caf20
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa6]
add esp, 0xc
mov word [esp + 0x54], ax
mov word [esp + 0x58], ax
lea eax, [esp + 0x10]
mov word [esp + 0x56], cx
mov word [esp + 0x5a], cx
push eax
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dx, word [ebx + 0x54]
mov eax, dword [esp + 0x9a]
mov word [esp + 0x5c], dx
mov edx, dword [esp + 0x98]
add eax, edx
lea ecx, [esp + 0x5c]
movzx eax, ax
mov edx, 0x18
xor byte [ecx], al
mov si, ax
shr si, 0xf
add eax, eax
add si, ax
movzx eax, si
mov si, ax
add eax, eax
shr si, 0xf
add si, ax
inc ecx
sub edx, 1
movzx eax, si
jne 0x4c6e64
mov eax, dword [ebx + 0x60]
lea ecx, [esp + 0x44]
push ecx
lea edi, [edx + 0x38]
mov esi, ebx
call fcn.004c56b0
test eax, eax
je 0x4c6f20
mov dl, byte [ebx + 0x50]
lea eax, [esp + 0x1f]
push eax
mov eax, dword [ebx + 0x5c]
mov edi, 1
mov byte [esp + 0x23], dl
call fcn.004c56b0
test eax, eax
je 0x4c6f20
xor esi, esi
mov dword [ebx + 0x14], esi
movzx ecx, word [esp + 0x98]
mov dword [ebx + 0x38], ecx
movzx edx, word [esp + 0x9a]
lea eax, [esp + 0x34]
push eax
mov dword [ebx + 0x3c], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [esp + 0x34]
call fcn.004c5580
movzx ecx, ax
lea eax, [esp + 0x34]
mov dword [ebx + 0x48], ecx
call fcn.004c55b0
mov dword [ebx + 0x4c], eax
mov dword [0x416fac], esi
jmp 0x4c6f20
mov dword [0x416fac], 0x66
jmp 0x4c6f20
mov dword [0x416fac], 4
pop edi
mov edx, dword [esp + 0x24]
push edx
call fcn.004cb4e1
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x4c6f42
mov eax, dword [esp + 0x10]
push eax
call fcn.004cb4e1
add esp, 4
test ebx, ebx
je 0x4c6f65
cmp dword [ebx + 0x24], 0
je 0x4c6f65
mov ecx, dword [ebx + 0x20]
push 0
push 0x24
push 0
push 0x3c
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [ebx + 0x24], 0
cmp dword [0x416fac], 0
mov eax, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
je 0x4c6f8b
test eax, eax
je 0x4c6f89
push eax
call fcn.004c5ce0
mov edx, dword [esp + 0x14]
push edx
call fcn.004c4090
xor eax, eax
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.004cb3aa
add esp, 0xb0
ret 8