Function at 0x10026154
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov eax, 0x10062dcf
call fcn.10061878
sub esp, 0xcc
push ebx
push esi
mov dword [ebp - 0x14], 0x4562
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x14], 0x4572
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x20], esi
jle 0x100261d0
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
lea eax, [edi + esi]
mov ecx, 0x1007d818
xor eax, ebx
cdq
push edx
push eax
call fcn.1000513b
inc ebx
cmp ebx, 0x730a
jl 0x1002618b
inc edi
push 0
pop ebx
cmp edi, 0x64fa
jl 0x10026188
inc esi
cmp esi, 0x257d
jl 0x10026186
push ebx
push ebx
push 0x2ae
push 0x15d8
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [ebp - 0x20]
cmp byte [ebp + 0x14], 0
je 0x100262bd
mov dword [ebp - 0x28], 0x7fbe
cmp dword [ebp - 0x28], 0x808e
jle 0x1002625a
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp + 0x14], ebx
mov ecx, edi
mov dword [ebp - 0x18], esi
mov edi, esi
mov dword [ebp - 0x20], ebx
shl edi, cl
mov esi, ebx
mov eax, edi
lea ecx, [ebp - 0x90]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002621e
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.100058e2
inc esi
cmp esi, 0x2b32
jl 0x10026202
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp + 0x14], edi
cmp edi, 0x1176
jl 0x100261f4
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x6d49
jl 0x100261ef
cmp dword [ebp - 0x28], 0x7d14
jge 0x1002626e
push str.urk_inq_vvoba_ibogxluy_lbgxrtul_jshat_pkcyty_zgna_letyaj_bsipqq_wvg_vtoe_aqunyxijf_onejc
call fcn.100497ec
pop ecx
cmp byte [ebp + 0xc], 0
je 0x1002629c
mov edx, dword [ebp + 0x20]
mov dword [edx], ebx
cmp dword [edx], 3
jge 0x100267b0
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc6a53d06
inc dword [edx]
cmp dword [edx], 3
jl 0x10026285
jmp 0x100267b0
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100267b0
push 0xcf0
push 0x23dd
call dword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x100267b0
cmp byte [ebp + 0x1c], 0
je 0x10026789
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14], 0xa6801fc3
mov dword [ebp + 0x14], 0xde2bbef7
cmp dword [ebp - 0x44], ebx
je 0x100262f5
mov byte [ebp + 0x17], bl
cmp byte [ebp + 0x17], 0
je 0x1002630b
push ecx
push ecx
mov dl, 1
call fcn.1002388f
jmp 0x10026309
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0xfff6
push eax
push ecx
lea edx, [ebp - 0x44]
call fcn.10023a6c
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0x14], eax
mov eax, dword [esi]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp + 0x14], 9
mov dword [ebp - 0x2c], 5
jmp 0x10026342
push ecx
mov byte [ebp - 0x21], bl
lea edx, [ebp - 0x21]
mov ecx, 0x230c
call fcn.10025697
inc dword [ebp - 0x2c]
pop ecx
cmp dword [ebp - 0x2c], 0xa
je 0x1002632d
lea eax, [ebp - 0x2c]
push eax
call fcn.10023990
pop ecx
mov esi, ebx
mov cl, byte [ebp + esi - 0x38]
mov dl, 0x57
call fcn.1002cf50
mov byte [ebp + esi - 0x38], al
inc esi
cmp esi, 4
jb 0x10026354
mov dword [ebp - 0x1c], 0x2299
cmp dword [ebp - 0x1c], 0x22c9
jle 0x100263b6
mov edi, ebx
mov dword [ebp + 0x14], ebx
mov esi, ebx
lea ebx, [esi + edi]
mov edi, 0x5871
mov eax, ebx
mov ecx, 0x1007d818
cdq
push edx
push eax
call fcn.1000513b
dec ebx
dec edi
jne 0x10026388
mov edi, dword [ebp + 0x14]
inc esi
cmp esi, 0x4002
jl 0x10026380
inc edi
mov dword [ebp + 0x14], edi
push 0
pop ebx
cmp edi, 0x69ec
jl 0x1002637e
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x228a
jge 0x100263d5
mov edx, str.primbzdr_qtlmvyb_ngbaobf_rnhoynid_bgewwuom_oizbn_hbvrofq_dhkc_emhq_vkehryj_tbselhb_ukzrjl_dncpxhz
mov ecx, 0x1007d818
call fcn.100077d7
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x25cb
lea ecx, [ebp - 0x6c]
push 1
call fcn.10005365
mov dword [ebp - 4], 4
xor edx, edx
mov dword [ebp - 0x28], 0xa96141e4
inc edx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x14], 0xdab9737e
mov dword [ebp + 0x14], 0xffffffff
mov dword [ebp + 0x14], ebx
jmp 0x10026443
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0xb7161ab6
inc dword [ebp + 0x14]
cmp dword [ebp + 0x14], edx
jl 0x10026433
mov dword [ebp + 0x14], ebx
jmp 0x10026457
mov eax, dword [ebp + 0x14]
mov dword [ebp + eax*4 - 0x3c], edx
inc dword [ebp + 0x14]
cmp dword [ebp + 0x14], edx
jl 0x1002644d
mov edx, dword [ebp - 0x3c]
mov ecx, 0x3b01d91e
imul edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
neg edx
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub ecx, eax
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6c]
cmp ecx, 0xffffffff
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
xor eax, eax
cmp ecx, edx
sete al
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x14], ebx
je 0x10026603
mov dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0x60]
mov dword [ebp + 0x14], ebx
push 2
call fcn.10005365
mov byte [ebp - 4], 5
mov dword [ebp - 0x20], 0x5cb4
cmp dword [ebp - 0x20], 0x607a
jle 0x10026551
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov eax, esi
mov dword [ebp - 0x34], 0x4a91
mov dword [ebp + 0x14], eax
mov edi, ebx
mov dword [ebp - 0x40], ebx
add eax, edi
mov esi, ebx
mov dword [ebp - 0x48], eax
mov edi, eax
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0xc0]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026501
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xc0]
call fcn.100058e2
inc esi
cmp esi, 0x11f4
jl 0x100264e3
mov edi, dword [ebp - 0x40]
mov eax, dword [ebp + 0x14]
inc edi
mov dword [ebp - 0x40], edi
cmp edi, 0x2f17
jl 0x100264da
dec eax
dec dword [ebp - 0x34]
mov dword [ebp + 0x14], eax
jne 0x100264d5
mov esi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x6c28
jl 0x100264c9
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp + 0x14], 1
cmp dword [ebp - 0x20], 0x5c0c
jge 0x1002656c
push str.dlgivusyh_yfbres_fjnkicb
call fcn.100497ec
pop ecx
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 5
push ebx
push eax
lea edx, [ebp - 0x78]
mov ecx, 0x72cb
call fcn.1002452c
mov eax, dword [ebp - 0x3c]
pop ecx
pop ecx
xor ecx, ecx
cmp eax, 0x7963f6d1
setne cl
xor edx, edx
mov dword [ebp + 0x14], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x28]
cmp eax, dword [esi + 4]
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
shl ecx, 2
test ecx, ecx
jne 0x100265cd
cmp dword [esi + 4], ebx
je 0x100265d7
mov eax, dword [ebp - 0x60]
cmp dword [eax], ebx
je 0x100265d7
xor ebx, ebx
inc ebx
mov ecx, dword [esi + 4]
mov eax, dword [ebp - 0x6c]
imul ecx, ebx
add ecx, 0xb89
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 1
setg cl
mov dword [ebp + 0x14], ecx
lea ecx, [ebp - 0x60]
call fcn.100053c7
jmp 0x10026768
mov dword [ebp - 0x34], 0xe51
cmp dword [ebp - 0x34], 0x110f
jle 0x1002669b
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov edi, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x20], 0x5e74
mov esi, dword [ebp + 0x14]
mov ecx, ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0x6b90
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0xa8]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026659
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xa8]
call fcn.100058e2
mov ecx, dword [ebp - 0x14]
add ecx, esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jne 0x1002663d
mov esi, dword [ebp - 0x30]
add dword [ebp + 0x14], esi
dec dword [ebp - 0x20]
jne 0x1002662e
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x76b4
jl 0x10026624
inc edi
cmp edi, 0x65ce
jl 0x10026621
cmp dword [ebp - 0x34], 0xd29
jge 0x100266af
push str.dghsrbx_anqfwuk_mctk_wnqzmxdhr_xiorl_fbfjgy_jwommh_cfoayrsrn_ghzudji_tjvz_yceyj_clifoujj_zbmcf_yylg
call fcn.100497ec
pop ecx
mov dword [ebp - 4], 4
mov dword [ebp + 0x14], ebx
jmp 0x100266c9
mov eax, dword [ebp + 0x14]
mov dword [ebp + eax*4 - 0x74], 0x9ba1
inc dword [ebp + 0x14]
cmp dword [ebp + 0x14], 2
jl 0x100266bb
mov dword [ebp - 0x18], 0x488d
cmp dword [ebp - 0x18], 0x4b5f
jle 0x10026751
mov esi, ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp + 0x14], ebx
mov ecx, ebx
mov dword [ebp - 0x14], ebx
add ecx, eax
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0xd8]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002670d
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.100058e2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x354
jl 0x100266ed
inc eax
mov dword [ebp + 0x14], eax
cmp eax, 0xbe4
jl 0x100266e8
inc edi
cmp edi, 0x2113
jl 0x100266e3
inc esi
cmp esi, 0x21ed
jl 0x100266e1
dec dword [ebp - 0x74]
cmp dword [ebp - 0x18], 0x468a
jge 0x10026768
push str.vyfk_xsldfode_nwaextfm_asle
call fcn.100497ec
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.100053c7
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x38]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [eax], 0x1c
jmp 0x100267a9
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], 0xcb363f9e
call fcn.10027c1d
mov eax, dword [esi]
dec dword [eax]
mov eax, dword [esi]
cmp dword [eax], 0xb
jle 0x10026796
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x14], 0x44f5
jge 0x10026778
mov edx, str.gjwuncho_lhsoxa_vtq_dgut_qjcftii_kcwltk_yww_awt_wxskachpz_gotea_jujolxyi
mov ecx, 0x1007d818
call fcn.100077d7
jmp 0x10026778