Function at 0x404e44
Capabilities:
Encode data using xor
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb38
push ebx
push esi
push edi
mov eax, 0x475660
call fcn.00468644
lea eax, [ebp - 0x7c]
call fcn.004025e4
lea eax, [ebp - 0x84]
call fcn.004025e4
mov dword [ebp - 0x60], 0x400
push dword [ebp - 0x60]
lea edx, [ebp - 0x4b8]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x4746f5
lea ecx, [ebp - 0x4b8]
push ecx
call fcn.00468350
add esp, 8
push 0x4746f9
lea eax, [ebp - 0x4b8]
push eax
call fcn.00468350
add esp, 8
push 0x4746fd
lea edx, [ebp - 0x4b8]
push edx
call fcn.00468350
add esp, 8
push 0x474701
lea ecx, [ebp - 0x4b8]
push ecx
call fcn.00468350
add esp, 8
push 0x474703
lea eax, [ebp - 0x4b8]
push eax
call fcn.00468350
add esp, 8
push 0x474705
lea edx, [ebp - 0x4b8]
push edx
call fcn.00468350
add esp, 8
push 0x474707
push 0x47bc94
call fcn.004683d8
add esp, 8
mov dword [ebp - 0x74], 0x100
lea ecx, [ebp - 0x74]
push ecx
push 0x47c094
call sub.KERNEL32.DLL_GetComputerNameA
push 0x474708
push 0x47c194
call fcn.004683d8
add esp, 8
xor eax, eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 0x2d
mov dword [0x47c3bc], 0x3e9
push str.0000
push 0x47be94
call fcn.004683d8
add esp, 8
push 0x474714
push 0x47c214
call fcn.004683d8
add esp, 8
mov dword [0x47d4e0], 1
lea edx, [ebp - 0x4c8]
push edx
call sub.KERNEL32.DLL_GetSystemTime
mov word [ebp - 0x4c], 8
mov word [ebp - 0x4c], 0x14
lea edx, [ebp - 0x4b8]
lea eax, [ebp - 4]
call fcn.0047267c
inc dword [ebp - 0x40]
mov eax, dword [eax]
call fcn.0045dd68
xor edx, edx
mov dl, al
cmp edx, 1
sbb ecx, ecx
neg ecx
push ecx
dec dword [ebp - 0x40]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0047274c
pop ecx
test cl, cl
je 0x405374
mov word [ebp - 0x4c], 0x20
lea edx, [ebp - 0x4b8]
lea eax, [ebp - 8]
call fcn.0047267c
inc dword [ebp - 0x40]
mov eax, dword [eax]
call fcn.0045dc70
mov dword [ebp - 0x6c], eax
dec dword [ebp - 0x40]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0047274c
cmp dword [ebp - 0x6c], 0
jle 0x405374
push 0x47c4d0
call fcn.00405934
pop ecx
push 0x47c8d4
call fcn.00405934
pop ecx
push 0x47ccd8
call fcn.00405934
pop ecx
push 0x47d0dc
call fcn.00405934
pop ecx
lea ecx, [ebp - 0x4c8]
push ecx
call sub.KERNEL32.DLL_GetSystemTime
movzx eax, word [ebp - 0x4c8]
mov dword [0x47c8d0], eax
movzx edx, word [ebp - 0x4c6]
mov dword [0x47ccd4], edx
movzx ecx, word [ebp - 0x4c2]
mov dword [0x47d0d8], ecx
mov eax, dword [0x47c3bc]
mov dword [0x47d4dc], eax
push 0x47bc94
call fcn.00468408
pop ecx
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xff
jle 0x40508e
mov dword [ebp - 0x70], 0xff
xor edx, edx
mov dword [ebp - 0x88], edx
mov word [ebp - 0x4c], 8
mov ecx, dword [ebp - 0x88]
cmp ecx, dword [ebp - 0x70]
jge 0x4050e8
mov eax, dword [ebp - 0x88]
mov dl, byte [eax + 0x47c4d0]
mov ecx, dword [ebp - 0x88]
xor dl, byte [ecx + 0x47c8d4]
mov eax, dword [ebp - 0x88]
xor dl, byte [eax + 0x47bc94]
mov ecx, dword [ebp - 0x88]
mov byte [ecx + 0x47d0dc], dl
inc dword [ebp - 0x88]
mov edx, dword [ebp - 0x88]
cmp edx, dword [ebp - 0x70]
jl 0x4050a7
mov eax, dword [ebp - 0x70]
mov dl, byte [eax + 0x47c4d0]
mov ecx, dword [ebp - 0x70]
xor dl, byte [ecx + 0x47c8d4]
mov eax, dword [ebp - 0x70]
mov byte [eax + 0x47d0dc], dl
push 0x47c094
call fcn.00468408
pop ecx
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xff
jle 0x405121
mov dword [ebp - 0x70], 0xff
xor edx, edx
mov dword [ebp - 0x8c], edx
mov word [ebp - 0x4c], 8
mov ecx, dword [ebp - 0x8c]
cmp ecx, dword [ebp - 0x70]
jge 0x40517b
mov eax, dword [ebp - 0x8c]
mov dl, byte [eax + 0x47c5d0]
mov ecx, dword [ebp - 0x8c]
xor dl, byte [ecx + 0x47c9d4]
mov eax, dword [ebp - 0x8c]
xor dl, byte [eax + 0x47c094]
mov ecx, dword [ebp - 0x8c]
mov byte [ecx + 0x47d1dc], dl
inc dword [ebp - 0x8c]
mov edx, dword [ebp - 0x8c]
cmp edx, dword [ebp - 0x70]
jl 0x40513a
mov eax, dword [ebp - 0x70]
mov dl, byte [eax + 0x47c5d0]
mov ecx, dword [ebp - 0x70]
xor dl, byte [ecx + 0x47c9d4]
mov eax, dword [ebp - 0x70]
mov byte [eax + 0x47d1dc], dl
push 0x47c194
call fcn.00468408
pop ecx
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x80
jle 0x4051b4
mov dword [ebp - 0x70], 0x80
xor edx, edx
mov dword [ebp - 0x90], edx
mov word [ebp - 0x4c], 8
mov ecx, dword [ebp - 0x90]
cmp ecx, dword [ebp - 0x70]
jge 0x40520e
mov eax, dword [ebp - 0x90]
mov dl, byte [eax + 0x47c6d0]
mov ecx, dword [ebp - 0x90]
xor dl, byte [ecx + 0x47cad4]
mov eax, dword [ebp - 0x90]
xor dl, byte [eax + 0x47c194]
mov ecx, dword [ebp - 0x90]
mov byte [ecx + 0x47d2dc], dl
inc dword [ebp - 0x90]
mov edx, dword [ebp - 0x90]
cmp edx, dword [ebp - 0x70]
jl 0x4051cd
mov eax, dword [ebp - 0x70]
mov dl, byte [eax + 0x47c6d0]
mov ecx, dword [ebp - 0x70]
xor dl, byte [ecx + 0x47cad4]
mov eax, dword [ebp - 0x70]
mov byte [eax + 0x47d2dc], dl
push 0x47c214
call fcn.00468408
pop ecx
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x80
jle 0x405247
mov dword [ebp - 0x70], 0x80
xor edx, edx
mov dword [ebp - 0x94], edx
mov word [ebp - 0x4c], 8
mov ecx, dword [ebp - 0x94]
cmp ecx, dword [ebp - 0x70]
jge 0x4052a1
mov eax, dword [ebp - 0x94]
mov dl, byte [eax + 0x47c750]
mov ecx, dword [ebp - 0x94]
xor dl, byte [ecx + 0x47cb54]
mov eax, dword [ebp - 0x94]
xor dl, byte [eax + 0x47c214]
mov ecx, dword [ebp - 0x94]
mov byte [ecx + 0x47d35c], dl
inc dword [ebp - 0x94]
mov edx, dword [ebp - 0x94]
cmp edx, dword [ebp - 0x70]
jl 0x405260
mov eax, dword [ebp - 0x70]
mov dl, byte [eax + 0x47c750]
mov ecx, dword [ebp - 0x70]
xor dl, byte [ecx + 0x47cb54]
mov eax, dword [ebp - 0x70]
mov byte [eax + 0x47d35c], dl
push 0x47be94
call fcn.00468408
pop ecx
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xff
jle 0x4052da
mov dword [ebp - 0x70], 0xff
xor edx, edx
mov dword [ebp - 0x98], edx
mov word [ebp - 0x4c], 8
mov ecx, dword [ebp - 0x98]
cmp ecx, dword [ebp - 0x70]
jge 0x405334
mov eax, dword [ebp - 0x98]
mov dl, byte [eax + 0x47c7d0]
mov ecx, dword [ebp - 0x98]
xor dl, byte [ecx + 0x47cbd4]
mov eax, dword [ebp - 0x98]
xor dl, byte [eax + 0x47be94]
mov ecx, dword [ebp - 0x98]
mov byte [ecx + 0x47d3dc], dl
inc dword [ebp - 0x98]
mov edx, dword [ebp - 0x98]
cmp edx, dword [ebp - 0x70]
jl 0x4052f3
mov eax, dword [ebp - 0x70]
mov dl, byte [eax + 0x47c7d0]
mov ecx, dword [ebp - 0x70]
xor dl, byte [ecx + 0x47cbd4]
mov eax, dword [ebp - 0x70]
mov byte [eax + 0x47d3dc], dl
mov edx, 0x47c4d0
mov ecx, 0x1014
mov eax, dword [ebp - 0x6c]
call fcn.0045dcc0
cmp dword [ebp - 0x6c], 0
jle 0x405374
mov eax, dword [ebp - 0x6c]
call fcn.0045dcf8
xor edx, edx
mov dword [ebp - 0x6c], edx
mov word [ebp - 0x4c], 0x2c
lea edx, [ebp - 0x4b8]
lea eax, [ebp - 0xc]
call fcn.0047267c
inc dword [ebp - 0x40]
mov eax, dword [eax]
xor edx, edx
call fcn.0045dc30
mov dword [ebp - 0x6c], eax
dec dword [ebp - 0x40]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0047274c
cmp dword [ebp - 0x6c], 0
jle 0x4058f2
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0045dcec
mov dword [ebp - 0x64], eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x6c]
call fcn.0045dcec
cmp dword [ebp - 0x64], 0x100c
jg 0x4053ec
mov edx, 0x47c4d0
mov ecx, 0x100c
mov eax, dword [ebp - 0x6c]
call fcn.0045dc94
jmp 0x4053fe
mov edx, 0x47c4d0
mov ecx, 0x1014
mov eax, dword [ebp - 0x6c]
call fcn.0045dc94
xor eax, eax
mov dword [ebp - 0x9c], eax
mov word [ebp - 0x4c], 8
cmp dword [ebp - 0x9c], 0xff
jge 0x405476
mov edx, dword [ebp - 0x9c]
mov cl, byte [edx + 0x47c4d0]
mov eax, dword [ebp - 0x9c]
xor cl, byte [eax + 0x47c8d4]
mov edx, dword [ebp - 0x9c]
xor cl, byte [edx + 0x47d0dc]
mov eax, dword [ebp - 0x9c]
mov byte [eax + 0x47bc94], cl
mov edx, dword [ebp - 0x9c]
mov byte [edx + 0x47bc95], 0
mov ecx, dword [ebp - 0x9c]
test byte [ecx + 0x47bc94], 0xff
je 0x405476
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0xff
jl 0x405418
cmp dword [ebp - 0x64], 0x100c
jg 0x405670
push str.SUNPOS
push 0x47c194
call fcn.004683d8
add esp, 8
mov word [ebp - 0x4c], 0x44
lea eax, [ebp - 0x10]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x40]
mov ecx, dword [0x47b888]
mov eax, dword [ecx]
call fcn.004323ec
lea edx, [ebp - 0x10]
push dword [edx]
lea eax, [ebp - 0x18]
call fcn.004015a4
push eax
inc dword [ebp - 0x40]
mov edx, 0x47471e
lea eax, [ebp - 0x14]
call fcn.0047267c
inc dword [ebp - 0x40]
mov edx, dword [eax]
pop ecx
pop eax
call fcn.0045deec
lea ecx, [ebp - 0x18]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x41cda4]
call fcn.00402614
mov dword [ebp - 0xa0], eax
dec dword [ebp - 0x40]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x4c], 0x38
push 0x3e9
mov edx, 0x47472c
lea eax, [ebp - 0x20]
call fcn.0047267c
inc dword [ebp - 0x40]
push dword [eax]
mov word [ebp - 0x4c], 0x50
mov edx, 0x474723
lea eax, [ebp - 0x1c]
call fcn.0047267c
inc dword [ebp - 0x40]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa0]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 8]
mov dword [0x47c3bc], eax
dec dword [ebp - 0x40]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x4c], 0x5c
mov edx, 0x474742
lea eax, [ebp - 0x2c]
call fcn.0047267c
inc dword [ebp - 0x40]
push dword [eax]
lea eax, [ebp - 0x30]
call fcn.004015a4
push eax
inc dword [ebp - 0x40]
mov edx, str.UserReg
lea eax, [ebp - 0x28]
call fcn.0047267c
inc dword [ebp - 0x40]
push dword [eax]
mov edx, 0x474731
lea eax, [ebp - 0x24]
call fcn.0047267c
inc dword [ebp - 0x40]
mov edx, dword [eax]
mov eax, dword [ebp - 0xa0]
pop ecx
mov ebx, dword [eax]
call dword [ebx]
lea eax, [ebp - 0x30]
call fcn.004026c0
push eax
push 0x47be94
call fcn.004683d8
add esp, 8
dec dword [ebp - 0x40]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x40]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0047274c
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0
je 0x405665
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
mov dword [ebp - 0x34], edx
mov word [ebp - 0x4c], 0x74
mov edx, 3
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x4c], 0x68
mov word [ebp - 0x4c], 8
jmp 0x40587b
xor eax, eax
mov dword [ebp - 0xa4], eax
mov word [ebp - 0x4c], 8
cmp dword [ebp - 0xa4], 0xff
jge 0x4056e8
mov edx, dword [ebp - 0xa4]
mov cl, byte [edx + 0x47c5d0]
mov eax, dword [ebp - 0xa4]
xor cl, byte [eax + 0x47c9d4]
mov edx, dword [ebp - 0xa4]
xor cl, byte [edx + 0x47d1dc]
mov eax, dword [ebp - 0xa4]
mov byte [eax + 0x47c094], cl
mov edx, dword [ebp - 0xa4]
mov byte [edx + 0x47c095], 0
mov ecx, dword [ebp - 0xa4]
test byte [ecx + 0x47c094], 0xff
je 0x4056e8
inc dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], 0xff
jl 0x40568a
xor eax, eax
mov dword [ebp - 0xa8], eax
mov word [ebp - 0x4c], 8
cmp dword [ebp - 0xa8], 0x80
jge 0x405760
mov edx, dword [ebp - 0xa8]
mov cl, byte [edx + 0x47c6d0]
mov eax, dword [ebp - 0xa8]
xor cl, byte [eax + 0x47cad4]
mov edx, dword [ebp - 0xa8]
xor cl, byte [edx + 0x47d2dc]
mov eax, dword [ebp - 0xa8]
mov byte [eax + 0x47c194], cl
mov edx, dword [ebp - 0xa8]
mov byte [edx + 0x47c195], 0
mov ecx, dword [ebp - 0xa8]
test byte [ecx + 0x47c194], 0xff
je 0x405760
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0x80
jl 0x405702
xor eax, eax
mov dword [ebp - 0xac], eax
mov word [ebp - 0x4c], 8
cmp dword [ebp - 0xac], 0x80
jge 0x4057d8
mov edx, dword [ebp - 0xac]
mov cl, byte [edx + 0x47c750]
mov eax, dword [ebp - 0xac]
xor cl, byte [eax + 0x47cb54]
mov edx, dword [ebp - 0xac]
xor cl, byte [edx + 0x47d35c]
mov eax, dword [ebp - 0xac]
mov byte [eax + 0x47c214], cl
mov edx, dword [ebp - 0xac]
mov byte [edx + 0x47c215], 0
mov ecx, dword [ebp - 0xac]
test byte [ecx + 0x47c214], 0xff
je 0x4057d8
inc dword [ebp - 0xac]
cmp dword [ebp - 0xac], 0x80
jl 0x40577a
push 0x47c214
call fcn.00468408
pop ecx
test eax, eax
jne 0x4057f9
push 0x474748
push 0x47c214
call fcn.004683d8
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], eax
mov word [ebp - 0x4c], 8
cmp dword [ebp - 0xb0], 0xff
jge 0x405871
mov edx, dword [ebp - 0xb0]
mov cl, byte [edx + 0x47c7d0]
mov eax, dword [ebp - 0xb0]
xor cl, byte [eax + 0x47cbd4]
mov edx, dword [ebp - 0xb0]
xor cl, byte [edx + 0x47d3dc]
mov eax, dword [ebp - 0xb0]
mov byte [eax + 0x47be94], cl
mov edx, dword [ebp - 0xb0]
mov byte [edx + 0x47be95], 0
mov ecx, dword [ebp - 0xb0]
test byte [ecx + 0x47be94], 0xff
je 0x405871
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0xff
jl 0x405813
mov eax, dword [0x47d4dc]
mov dword [0x47c3bc], eax
mov cx, word [0x47d0d8]
mov dx, word [0x47ccd4]
mov ax, word [0x47c8d0]
call fcn.0045eb24
fstp qword [ebp - 0x7c]
lea eax, [ebp - 0x7c]
mov edx, 0x2d
call fcn.00404e1c
mov ecx, dword [sym.hws.exe__Form1]
fstp qword [ecx + 0x370]
mov cx, word [ebp - 0x4c2]
mov dx, word [ebp - 0x4c6]
mov ax, word [ebp - 0x4c8]
call fcn.0045eb24
fstp qword [ebp - 0x84]
lea edx, [ebp - 0x7c]
lea eax, [ebp - 0x84]
call fcn.00402e94
fstp qword [ebp - 0xb8]
lea eax, [ebp - 0xb8]
call fcn.00402ec0
mov dword [ebp - 0x68], eax
mov word [ebp - 0x4c], 0
jmp 0x40590c
cmp dword [ebp - 0x6c], 0
jle 0x40591a
mov eax, dword [ebp - 0x6c]
call fcn.0045dcf8
mov eax, 0x2d
sub eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x5c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret