Function at 0x100040f5
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov eax, 0x10065209
call fcn.10064c08
sub esp, 0xc8
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x1c], esi
je 0x100041d5
xor ebx, ebx
cmp byte [ebp + 0xc], bl
je 0x100041c3
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], bl
je 0x100041a4
mov dword [ebp - 0x1c], 0x6023
cmp dword [ebp - 0x1c], 0x6316
jle 0x1000417e
mov edi, ebx
mov esi, ebx
mov dword [ebp + 0x10], ebx
mov ebx, esi
mov esi, 0x727
mov eax, ebx
mov ecx, 0x10081dd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000c947
dec ebx
dec esi
jne 0x1000414e
mov esi, dword [ebp + 0x10]
inc esi
mov dword [ebp + 0x10], esi
cmp esi, 0x6961
jl 0x10004147
inc edi
push 0
pop ebx
cmp edi, 0x1855
jl 0x10004142
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x5d15
jge 0x100041a4
mov edx, str.ovrc_imsixtf_yqnzbyuip_mnc_xsu_zer_rrffucew
mov ecx, 0x10081dd8
call fcn.1000fdbf
jmp 0x10004702
push ebx
push 0xa6e
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
jmp 0x10004702
cmp byte [ebp + 8], 0
je 0x100041ef
push 1
push 0x16a6
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x10004702
mov dword [ebp - 0x40], esi
xor ebx, ebx
mov dword [ebp + 0x10], 0xfb0
cmp dword [ebp + 0x10], 0x1357
jle 0x10004250
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0xbc]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004226
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xbc]
call fcn.1000168f
inc edi
cmp edi, 0x30f3
jl 0x10004208
inc esi
cmp esi, 0x2b24
jl 0x10004206
mov esi, dword [ebp - 0x1c]
cmp dword [ebp + 0x10], 0xd26
jge 0x10004264
push str.ishmngy_bvisvm_savirp_uekqyfu_okktt_lpk_cagrt_dqm_lhlvpjo
call fcn.1004c2d0
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x30], 0x69f4288a
mov dword [ebp - 0x28], 0xb036
mov dword [ebp - 0x2c], 0x9d01078
mov dword [ebp - 0x24], 0xffffffff
push 4
call fcn.100014bd
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 4
push eax
push ebx
push 0x3d75
push 0x984
push 0x4653
push 0x7234
lea eax, [ebp - 0x7c]
mov dword [ebp + 0x10], 0xdf851f08
push eax
push ecx
mov dword [ebp - 0x1c], 0xbf7a8323
mov ecx, 0x2816
mov dword [ebp - 0x38], 0xffffffff
push 0x6f4
call fcn.10003660
add esp, 0x24
mov dword [ebp - 0x18], ebx
jmp 0x100042ed
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], 0xeb945924
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x100042df
lea eax, [ebp - 0x2c]
mov edx, 0x47a2
push eax
lea eax, [ebp - 0x30]
mov cl, 1
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push 0x4585
push 0xb08
push 0x5b51
push 0x60bc
push 0x4ffb
lea eax, [ebp - 0x28]
push eax
push 0x788
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0x6376
push 0x66ad
call fcn.10006191
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x28]
add esp, 0x3c
mov eax, dword [ebp - 0x7c]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp + 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x7c]
setle dl
sub edx, eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
or dword [ebp - 4], 0xffffffff
call fcn.10001540
mov eax, dword [esi]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x73838a1f
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], 0xf93bd5de
mov dword [ebp - 0x50], eax
mov dword [ebp + 0x10], 0x4927
cmp dword [ebp + 0x10], 0x4c17
jle 0x10004412
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0xd4]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100043d8
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xd4]
call fcn.1000168f
inc edi
cmp edi, 0x50b3
jl 0x100043b9
inc esi
cmp esi, 0x3d85
jl 0x100043b7
push ebx
push ebx
push 0xddb
push 0x17db
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov dword [ebp - 0x48], 0x8dacb314
cmp dword [ebp + 0x10], 0x454d
jge 0x1000442d
push str.vkavfyn_dtrcorr_gvesnqozw_ggpfod_bennm_okaig_xzheuoftz
call fcn.1004c2d0
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x64], 0xffffffff
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jge 0x10004463
mov dword [ebp + 0x10], ebx
jmp 0x10004452
mov eax, dword [ebp + 0x10]
mov dword [ebp + eax*4 - 0x8c], ebx
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 3
jl 0x10004445
inc dword [ebp - 0x8c]
jmp 0x1000469b
push 4
lea ecx, [ebp - 0x60]
call fcn.100014bd
mov dword [ebp - 4], 7
mov dword [ebp + 0x10], 0x7d96711d
mov dword [ebp + 0x10], 0xc0223dec
mov dword [ebp + 0x10], 0x7f8d
cmp dword [ebp + 0x10], 0x8211
jle 0x100044b9
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10081dd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000c947
inc edi
cmp edi, 0x6bb3
jl 0x10004496
inc esi
cmp esi, 0x6d58
jl 0x10004494
push 1
lea ecx, [ebp - 0x98]
call fcn.100014bd
mov byte [ebp - 4], 9
cmp dword [ebp + 0x10], 0x7cb1
jge 0x10004500
mov edx, str.lmzdxy_kcxojkpc_tjysg_bzylzhycv_qwfopit_hpriivx_btpdzh_jbrxsjc
mov ecx, 0x10081dd8
call fcn.1000fdbf
jmp 0x10004500
push 8
pop edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], ebx
jmp 0x1000451b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x60]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000450b
lea eax, [ebp - 0x14]
mov ecx, 0x31d9
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.10005ff0
mov eax, dword [ebp - 0x60]
pop ecx
pop ecx
cmp dword [eax + 0xc], ebx
je 0x10004636
mov dword [ebp + 0x10], 0x4361
cmp dword [ebp + 0x10], 0x4631
jle 0x10004585
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov esi, ebx
mov edi, esi
mov ebx, 0x9ff
mov eax, edi
mov ecx, 0x10081dd8
cdq
push edx
push eax
call fcn.1000c947
dec edi
dec ebx
jne 0x10004566
inc esi
cmp esi, 0x241b
jl 0x1000455f
push 8
pop edi
mov dword [ebp - 0x38], 0xfffffffa
mov byte [ebp - 4], 0xb
cmp dword [ebp + 0x10], 0x40f6
jge 0x100045a8
mov edx, str.uqktzudq_dsipyaxl_zbmprzdu_srhpxaqen_ixgnww_foqrleg_zjye
mov ecx, 0x10081dd8
call fcn.1000fdbf
mov dword [ebp - 4], edi
push 3
lea ecx, [ebp - 0x70]
call fcn.100014bd
lea eax, [ebp - 0x80]
mov ecx, 0x239e
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.10003abb
mov eax, dword [ebp - 0x38]
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
test ecx, ecx
je 0x100045f6
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x70]
mov edx, dword [ecx + 0xc]
mov dword [eax + 4], edx
mov eax, dword [ecx + 8]
sub eax, edx
cmp eax, dword [ebp - 0x20]
jg 0x10004624
cmp dword [ebp - 0x4c], ebx
jne 0x10004624
mov eax, ebx
jmp 0x10004627
xor eax, eax
inc eax
neg eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x34], eax
call fcn.10001540
jmp 0x10004684
mov dword [ebp + 0x10], 0xe7a
mov dword [ebp + 0x10], 0xfffffff7
mov dword [ebp + 0x10], ebx
jmp 0x1000465a
mov eax, dword [ebp + 0x10]
mov dword [ebp + eax*4 - 0xa4], 0x2d5fba25
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 3
jl 0x10004649
push ecx
push ebx
push 0x3557
push ecx
lea eax, [ebp - 0x48]
mov edx, 0x2245
push eax
mov ecx, 0x1b0f
call fcn.10003a93
add esp, 0x10
call fcn.10004713
pop ecx
lea ecx, [ebp - 0x98]
call fcn.10001540
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.10001540
lea eax, [ebp - 0x20]
push eax
push 0x2b15
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x64]
push eax
push 0xfa0
lea eax, [ebp - 0x4c]
push eax
push ebx
lea eax, [ebp - 0x48]
push eax
push 0x75c3
lea ecx, [ebp - 0x34]
call fcn.1000683c
add esp, 0x24
lea eax, [ebp - 0x3c]
push eax
push 0x36
push ecx
lea eax, [ebp - 0x40]
mov ecx, 0x251e
push 1
push eax
call fcn.10002dad
mov esi, dword [ebp - 0x40]
add esp, 0x14
mov cl, byte [ebx + esi]
mov dl, 0x48
call fcn.1000ff96
mov byte [ebx + esi], al
inc ebx
cmp ebx, 4
jb 0x100046e7
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret