Function at 0x10001000
Capabilities:
Check os version
Encode data using xor
Get common file path

Disassembly:
push 0x220
push 0x100c1d18
call fcn.10075ce0
xor esi, esi
mov dword [ebp - 0x214], esi
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 7
jl 0x10001019
cmp dword [ebp - 0x214], 0xffff0001
jge 0x10001040
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x1000105c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 0x10
jl 0x1000105e
cmp dword [ebp - 0x214], esi
jge 0x10001081
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000109d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x224], esi
cmp dword [ebp - 0x224], 0xb
jge 0x100010dc
mov eax, dword [ebp - 0x224]
and eax, reloc.WS2_32.dll_accept
jns 0x100010c1
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100010ce
inc dword [ebp - 0x214]
jmp 0x100010d4
dec dword [ebp - 0x214]
inc dword [ebp - 0x224]
jmp 0x100010a6
mov dword [ebp - 4], 0xfffffffe
call fcn.1000120b
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 0x16
jl 0x100010ea
cmp dword [ebp - 0x214], esi
jge 0x1000110d
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10001129
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x1000112b
cmp dword [ebp - 0x214], esi
jge 0x1000114e
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000116a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], esi
jge 0x10001178
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10001194
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 5
jl 0x10001196
cmp dword [ebp - 0x214], esi
jge 0x100011b9
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x100011d5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x230], esi
cmp dword [ebp - 0x230], 7
jge 0x10001234
mov ecx, dword [ebp - 0x230]
and ecx, reloc.WS2_32.dll_accept
jns 0x100011fd
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, eax
jne 0x10001226
inc dword [ebp - 0x214]
jmp 0x1000122c
dec dword [ebp - 0x214]
inc dword [ebp - 0x230]
jmp 0x100011e1
mov dword [ebp - 4], 0xfffffffe
call fcn.10001262
xor ecx, ecx
push 4
pop esi
push 5
pop edi
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x1000127d
cmp edx, esi
je 0x1000127d
and dword [ebp - 0x214], ecx
jmp 0x10001285
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0xc
jl 0x10001248
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
test eax, eax
jns 0x100012a1
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x100012bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 0xb
jl 0x100012bf
cmp dword [ebp - 0x214], 0
jge 0x100012da
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x100012f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x10001310
cmp edx, esi
je 0x10001310
and dword [ebp - 0x214], ecx
jmp 0x10001318
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0xb
jl 0x100012f8
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x1000133e
cmp edx, esi
je 0x1000133e
and dword [ebp - 0x214], ecx
jmp 0x10001346
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x10
jl 0x10001326
xor ecx, ecx
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x10001366
cmp edx, esi
je 0x10001366
and dword [ebp - 0x214], ecx
jmp 0x1000136c
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x10
jl 0x1000134e
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0xb
jl 0x10001386
cmp dword [ebp - 0x214], 0xffff0001
jge 0x100013ad
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x100013c9
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 2
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0xd
jge 0x1000140d
mov eax, dword [ebp - 0x22c]
and eax, reloc.WS2_32.dll_accept
jns 0x100013f2
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100013ff
inc dword [ebp - 0x214]
jmp 0x10001405
dec dword [ebp - 0x214]
inc dword [ebp - 0x22c]
jmp 0x100013d7
mov dword [ebp - 4], 0xfffffffe
call fcn.10001439
xor ecx, ecx
xor edi, edi
inc edi
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, edi
je 0x10001454
cmp edx, esi
je 0x10001454
and dword [ebp - 0x214], ecx
jmp 0x1000145a
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 8
jl 0x1000141e
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, edi
je 0x1000148c
cmp edx, esi
je 0x1000148c
and dword [ebp - 0x214], ecx
jmp 0x10001494
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 7
jl 0x10001474
xor ebx, ebx
mov dword [ebp - 0x214], ebx
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x100014b3
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, edi
jne 0x100014bf
add dword [ebp - 0x214], eax
jmp 0x100014c5
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x100014a4
mov eax, 0x100a6ea4
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], 3
mov dword [ebp - 0x218], ebx
cmp dword [ebp - 0x218], ebx
jge 0x10001519
mov eax, dword [ebp - 0x218]
and eax, reloc.WS2_32.dll_accept
jns 0x100014ff
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, edi
jne 0x1000150b
inc dword [ebp - 0x214]
jmp 0x10001511
dec dword [ebp - 0x214]
inc dword [ebp - 0x218]
jmp 0x100014e5
mov dword [ebp - 4], 0xfffffffe
call fcn.10001545
xor ecx, ecx
push 5
pop edi
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x10001560
cmp edx, esi
je 0x10001560
and dword [ebp - 0x214], ecx
jmp 0x10001566
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x1000152a
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x10001598
cmp edx, esi
je 0x10001598
and dword [ebp - 0x214], ecx
jmp 0x100015a0
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, edi
jl 0x10001580
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x100015a7
cmp dword [ebp - 0x214], 0
jge 0x100015c2
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x100015de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 8
jl 0x100015e0
cmp dword [ebp - 0x214], 0
jge 0x10001604
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10001620
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x1000163a
cmp edx, esi
je 0x1000163a
and dword [ebp - 0x214], ecx
jmp 0x10001642
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x10001622
mov dword [ebp - 4], esi
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 7
jge 0x10001688
mov eax, dword [ebp - 0x21c]
and eax, reloc.WS2_32.dll_accept
jns 0x1000166d
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000167a
inc dword [ebp - 0x214]
jmp 0x10001680
dec dword [ebp - 0x214]
inc dword [ebp - 0x21c]
jmp 0x10001652
mov dword [ebp - 4], 0xfffffffe
call fcn.100016cc
mov dword [ebp - 4], 5
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], esi
jge 0x100016f5
mov eax, dword [ebp - 0x220]
and eax, reloc.WS2_32.dll_accept
jns 0x100016bc
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100016e7
inc dword [ebp - 0x214]
jmp 0x100016ed
dec dword [ebp - 0x214]
inc dword [ebp - 0x220]
jmp 0x100016a2
mov dword [ebp - 4], 0xfffffffe
call fcn.10001737
mov dword [ebp - 4], 6
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0
jge 0x10001760
mov eax, dword [ebp - 0x228]
and eax, reloc.WS2_32.dll_accept
jns 0x1000172a
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10001752
inc dword [ebp - 0x214]
jmp 0x10001758
dec dword [ebp - 0x214]
inc dword [ebp - 0x228]
jmp 0x1000170f
mov dword [ebp - 4], 0xfffffffe
call fcn.100017b1
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x1000176e
cmp dword [ebp - 0x214], 0
jge 0x10001789
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x100017a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
call fcn.10075d28
ret