Function at 0x1015c630
Capabilities:
Encode data using xor
Get hostname
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb8
mov eax, dword [0x1021e964]
xor eax, esp
mov dword [esp + 0xb4], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc4]
xor ebx, ebx
push esi
push edi
push 0xff
mov dword [esp + 0x30], ebp
xor edi, edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
call fcn.1015b830
mov ecx, eax
add esp, 4
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x1015cd7e
movzx eax, word [ebp + 2]
movzx ecx, byte [ebp + 0x11]
and eax, 1
mov dword [esp + 0x18], eax
movzx eax, byte [ebp + 0x10]
shl ecx, 8
add ecx, eax
push 0x94
mov dword [esp + 0x3c], ecx
call fcn.1015b830
mov ebx, eax
add esp, 4
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x1015cd7e
lea eax, [esp + 0x30]
push eax
push 0x1c
push 1
call fcn.1015b920
cmp dword [esp + 0x30], edi
jne 0x1015c6dc
push ebx
call fcn.100be50c
push dword [esp + 0x18]
call fcn.100be50c
add esp, 8
jmp 0x1015cdbc
push 0x94
mov dword [0x1021d6f0], eax
push 0
push ebx
mov dword [eax], 4
mov dword [eax + 0x18], ebx
call fcn.101a4190
mov dword [ebx + 0x20], 0xffffffff
add esp, 0xc
mov dword [0x1021d6d4], 4
movzx eax, word [ebp + 0x20]
mov dword [ebx + 0x34], eax
push dword [ebp + 0x1c]
push ebp
call fcn.10160570
push dword [ebp + 0x14]
mov edi, eax
push ebp
mov dword [esp + 0x18], edi
call fcn.10160570
mov esi, eax
test edi, edi
jne 0x1015c7eb
test esi, esi
je 0x1015cd7e
push 0x105
call fcn.1015b830
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
test edi, edi
je 0x1015cd7e
push dword [esp + 0x18]
mov dword [esp + 0x24], 1
push 0x200
push esi
call fcn.10160360
mov dword [esp + 0x28], eax
test eax, eax
je 0x1015cd7e
cmp dword [esp + 0x18], 0
je 0x1015c7ce
push eax
call fcn.1015b830
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1015cd7e
push dword [esp + 0x18]
push esi
push dword [esp + 0x30]
push eax
call fcn.10160310
mov esi, dword [esp + 0x1c]
push 0x10010b20
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x105
push edi
push esi
push 0xa
call fcn.1015bea0
push esi
call fcn.100be50c
add esp, 0x1c
jmp 0x1015c7eb
push 0x10010b20
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x105
push edi
push esi
push 0xa
call fcn.1015bea0
add esp, 0x18
movzx edi, word [ebp + 0x12]
mov dword [esp + 0x1c], edi
cmp edi, 0xfffe
jne 0x1015c831
test esi, esi
jne 0x1015c80e
mov dword [0x1021d6d4], 4
jmp 0x1015cd7a
push esi
push 8
call fcn.1015bdb0
test eax, eax
jne 0x1015c829
mov dword [0x1021d6d4], 0x29
jmp 0x1015cd7a
dec eax
movzx eax, ax
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
xor esi, 1
and esi, dword [esp + 0x18]
push esi
push 0x105
push edi
call fcn.10160360
mov dword [esp + 0x28], eax
test eax, eax
je 0x1015cd7e
push eax
call fcn.1015b830
add esp, 4
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x1015cd7e
push esi
push edi
push dword [esp + 0x30]
push eax
call fcn.10160310
cmp dword [esp + 0x20], 0
je 0x1015c890
push edi
call fcn.100be50c
add esp, 4
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x1015cd64
push eax
push ebp
call fcn.10160570
push 0
push 0
push 3
movups xmm0, xmmword [eax]
push 0
push 3
movups xmmword [ebx + 0x74], xmm0
push 0xc0000000
movups xmm0, xmmword [eax + 0x10]
push dword [ebx + 0x1c]
movups xmmword [ebx + 0x84], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + 0x20], eax
cmp eax, 0xffffffff
jne 0x1015c8e3
mov dword [0x1021d6d4], 0x60
jmp 0x1015cd7e
push 0x40
lea eax, [esp + 0x88]
push eax
push 0x20
push ebx
call fcn.1015c2b0
test eax, eax
je 0x1015cd7e
lea ecx, [esp + 0x84]
mov eax, dword [ecx]
cmp eax, dword [0x1021d730]
jne 0x1015cd58
mov eax, dword [ecx + 4]
cmp eax, dword [0x1021d734]
jne 0x1015cd58
movzx eax, byte [esp + 0x8c]
mov byte [ebx + 0x18], al
movzx eax, byte [esp + 0x8d]
mov byte [ebx + 0x19], al
movzx eax, word [esp + 0x90]
mov dword [ebx + 8], eax
cmp byte [esp + 0x8c], 2
jb 0x1015c956
mov eax, dword [esp + 0x9c]
mov dword [ebx + 0x2c], eax
push ebx
call fcn.1015c070
test eax, eax
je 0x1015cd7e
movzx ecx, byte [ebx + 0x18]
movzx eax, byte [ebx + 0x19]
shl ecx, 8
add ecx, eax
cmp ecx, 0x120
je 0x1015c981
cmp ecx, 0x200
jne 0x1015c987
cmp dword [esp + 0x38], ecx
jbe 0x1015c996
mov dword [0x1021d6d4], 0xd
jmp 0x1015cd7e
movzx eax, word [ebp + 0x22]
test ax, ax
je 0x1015ca5d
movzx ebp, word [ebp + 0x20]
mov ebx, eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x3c]
push eax
call fcn.1015c040
movzx ecx, word [esp + 0x42]
mov esi, eax
push ecx
movzx ecx, word [esp + 0x42]
push ecx
movzx ecx, word [esp + 0x44]
push ecx
call fcn.10161920
imul edi, eax, 0xa8c0
add edi, esi
mov esi, dword [esp + 0x24]
mov ecx, dword [esi + 0x40]
mov eax, ecx
and eax, 0x1f
push eax
mov eax, ecx
shr ecx, 9
shr eax, 5
and ecx, 0x7f
and eax, 0xf
add ecx, 0x7bc
push eax
push ecx
call fcn.10161920
imul ecx, eax, 0xa8c0
lea edx, [ebp*2]
mov eax, dword [esi + 0x44]
add eax, ecx
mov ecx, edi
sub ecx, eax
mov esi, eax
sub esi, edi
cmp eax, edi
mov edi, dword [esp + 0x10]
mov eax, ebx
cmovbe esi, ecx
mov ecx, ebx
shl ecx, 4
shl eax, 4
sub ecx, ebx
sub eax, ebx
shl ecx, 2
mov ebx, dword [esp + 0x24]
add eax, eax
cmp ecx, edx
cmovae ebp, eax
cmp esi, ebp
jbe 0x1015ca59
mov dword [0x1021d6d4], 0x63
jmp 0x1015cd7e
mov ebp, dword [esp + 0x2c]
movzx eax, word [esp + 0x8e]
add eax, 0x20
test dword [esp + 0xd0], 0x100000
mov dword [ebx + 0x58], eax
je 0x1015ca90
mov dword [ebx], 0xffffffff
mov dword [ebx + 0x5c], eax
mov dword [0x1021d6d4], 0
jmp 0x1015cd7e
push dword [ebx + 8]
movzx eax, word [esp + 0x92]
xor edi, edi
push dword [esp + 0x18]
add eax, 0x20
mov dword [esp + 0x20], edi
push eax
push ebx
or esi, 0xffffffff
call fcn.1015c2b0
test eax, eax
je 0x1015cd7a
mov ecx, dword [ebx + 8]
xor eax, eax
mov dword [esp + 0x38], ecx
test ecx, ecx
jle 0x1015cb04
mov edx, dword [esp + 0x1c]
xor ebp, ebp
mov ebx, dword [esp + 0x14]
mov cl, byte [eax + ebx]
cmp cl, 0xff
jne 0x1015cae9
test esi, esi
jns 0x1015cae6
cmp edx, 0xffff
cmove esi, eax
inc edi
jmp 0x1015caef
cmp cl, 0xfe
je 0x1015caef
inc ebp
mov ecx, dword [esp + 0x38]
inc eax
cmp eax, ecx
jl 0x1015cad1
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
add eax, edi
cmp eax, dword [ebx + 4]
ja 0x1015cd70
mov eax, dword [esp + 0x1c]
cmp eax, 0xffff
je 0x1015cb41
cmp eax, ecx
mov ecx, dword [esp + 0x14]
jae 0x1015cb45
mov dl, byte [eax + ecx]
cmp dl, 0xfe
je 0x1015cb45
mov esi, eax
cmp dl, 0xff
je 0x1015cb45
test byte [ebp], 1
je 0x1015cb45
mov byte [eax + ecx], 0xff
jmp 0x1015cb45
mov ecx, dword [esp + 0x14]
cmp esi, 0xffffffff
je 0x1015cd4c
cmp byte [esi + ecx], 0xff
jne 0x1015cd4c
movzx eax, si
mov dword [ebx], eax
movzx eax, di
dec eax
mov dword [ebx + 0xc], eax
movzx eax, word [esp + 0x94]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x58]
add eax, esi
mov dword [ebx + 0x5c], eax
movzx eax, word [esp + 0x94]
movzx ecx, word [esp + 0x92]
add ecx, eax
movzx eax, word [esp + 0x90]
imul ecx, esi
push 0x1c
add ecx, eax
movzx eax, word [esp + 0x92]
add eax, 0x20
add ecx, eax
mov dword [ebx + 0x60], ecx
movzx eax, word [esp + 0x96]
mov dword [ebx + 0x64], eax
lea eax, [esp + 0x64]
push eax
lea eax, [ecx + 0x14]
push eax
push ebx
call fcn.1015c2b0
test eax, eax
je 0x1015cd7a
cmp word [esp + 0x60], 0
je 0x1015cc18
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x64]
add eax, dword [esp + 0x62]
mov esi, 0x18
movzx eax, ax
xor byte [edx], al
lea edx, [edx + 1]
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
sub esi, 1
jne 0x1015cbe6
cmp dword [esp + 0x78], esi
jne 0x1015cd70
movzx eax, word [esp + 0x64]
xorps xmm0, xmm0
inc eax
movlpd qword [esp + 0x4c], xmm0
mov dword [ebx + 0x54], eax
mov eax, dword [esp + 0xa2]
mov ecx, dword [esp + 0xa0]
mov word [esp + 0x5e], ax
mov word [esp + 0x62], ax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x50]
movlpd qword [esp + 0x58], xmm0
push eax
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
mov word [esp + 0x64], cx
mov word [esp + 0x68], cx
mov dword [esp + 0x40], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ax, word [ebx + 0x54]
lea edx, [esp + 0x64]
mov word [esp + 0x64], ax
mov esi, 0x18
mov eax, dword [esp + 0xa0]
add eax, dword [esp + 0xa2]
movzx eax, ax
xor byte [edx], al
lea edx, [edx + 1]
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
mov cx, ax
add eax, eax
shr cx, 0xf
add cx, ax
movzx eax, cx
sub esi, 1
jne 0x1015cca8
push 0x38
lea eax, [esp + 0x50]
push eax
push dword [ebx + 0x60]
push ebx
call fcn.1015dbc0
test eax, eax
je 0x1015cd7a
mov al, byte [ebx + 0x50]
push 1
mov byte [esp + 0x3b], al
lea eax, [esp + 0x3b]
push eax
push dword [ebx + 0x5c]
push ebx
call fcn.1015dbc0
test eax, eax
je 0x1015cd7a
mov dword [ebx + 0x14], esi
movzx eax, word [esp + 0xa0]
mov dword [ebx + 0x38], eax
movzx eax, word [esp + 0xa2]
mov dword [ebx + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 0x3c]
push eax
call fcn.1015c010
movzx eax, ax
mov dword [ebx + 0x48], eax
lea eax, [esp + 0x3c]
push eax
call fcn.1015c040
mov dword [ebx + 0x4c], eax
mov dword [0x1021d6d4], esi
jmp 0x1015cd7a
mov dword [0x1021d6d4], 0x66
jmp 0x1015cd7a
mov dword [0x1021d6d4], 0x65
jmp 0x1015cd7e
mov dword [0x1021d6d4], 4
jmp 0x1015cd7e
mov dword [0x1021d6d4], 0x65
mov edi, dword [esp + 0x10]
push dword [esp + 0x14]
call fcn.100be50c
add esp, 4
cmp dword [esp + 0x20], 0
je 0x1015cd9a
push edi
call fcn.100be50c
add esp, 4
test ebx, ebx
je 0x1015cdbc
cmp dword [ebx + 0x24], 0
je 0x1015cdbc
push 0
push 0x24
push 0
push 0x3c
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [ebx + 0x24], 0
cmp dword [0x1021d6d4], 0
mov eax, dword [esp + 0x30]
je 0x1015ce23
test eax, eax
je 0x1015ce21
push eax
call fcn.1015bcb0
mov edi, eax
mov esi, dword [edi + 0x18]
cmp dword [esi + 0x24], 0
je 0x1015cdf6
push 0
push 0x24
push 0
push 0x3c
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_UnlockFile]
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x20]
cmp eax, 0xffffffff
je 0x1015ce05
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x68]
call fcn.1015bc10
push dword [edi + 0x18]
call fcn.100be50c
add esp, 8
push dword [esp + 0x30]
call fcn.1015bb00
xor eax, eax
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1018d760
add esp, 0xb8
ret 8