Function at 0x10026837
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x1005da2b
call fcn.1005c610
sub esp, 0x48
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x18], cl
je 0x10026937
mov dword [ebp - 0x28], 0x5f3f
xor esi, esi
cmp dword [ebp - 0x28], 0x61b7
jle 0x100268c8
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x24], esi
mov ecx, esi
mov dword [ebp - 0x1c], 0x1962
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov eax, edi
sar eax, cl
mov ecx, 0x10078098
xor eax, ebx
cdq
push edx
push eax
call fcn.10003fb2
mov ecx, dword [ebp - 0x20]
add ecx, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
jne 0x10026884
inc esi
push 0
mov dword [ebp - 0x24], esi
cmp esi, 0x7f33
pop esi
jl 0x10026875
inc edi
cmp edi, 0x5b34
jl 0x10026872
inc ebx
cmp ebx, 0x3e2c
jl 0x10026870
mov edi, dword [ebp - 0x2c]
cmp byte [ebp + 0x14], 0
je 0x100268ec
mov dword [edi], esi
cmp dword [edi], 2
jge 0x100268fd
mov edx, dword [ebp + 0x24]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x120d
inc dword [edi]
cmp dword [edi], 2
jl 0x100268d8
jmp 0x100268fd
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x100268fd
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x28], 0x5e93
jge 0x10026918
mov edx, str.ybppkex_bvggr_ergtmscs_eiukd_cnluwfrxa_hoax_exuppla_qiipbo_aovncc_usatf_cntm_uhytoe_cqe_hbvinb
mov ecx, 0x10078098
call fcn.100065fc
jmp 0x10026b49
mov dword [ebp - 0x2c], 0x1701
cmp dword [ebp - 0x2c], 0x9e1
jge 0x10026a0a
lea eax, [ebp + 0x1c]
push eax
call fcn.1002a487
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x38]
lea ebx, [eax + eax]
push ebx
call fcn.10004264
mov dword [ebp - 4], 2
test ebx, ebx
jle 0x1002697f
mov esi, dword [ebp - 0x38]
mov edi, ebx
push esi
call fcn.1002a487
add esi, 4
dec edi
jne 0x10026973
mov eax, dword [ebp + 0x1c]
xor esi, esi
mov edi, dword [ebp - 0x38]
mov ecx, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ecx
test eax, eax
jle 0x100269ed
inc esi
mov edx, dword [edi + ecx*8]
mov dword [ebp - 0x2c], edx
cmp edx, dword [edi + ecx*8 + 4]
je 0x100269e0
or edx, 0xffffffff
lea eax, [esi + 1]
jmp 0x100269b4
mov ecx, dword [ebp - 0x2c]
cmp dword [edi + eax*4], ecx
mov ecx, dword [ebp - 0x1c]
je 0x100269ba
inc eax
cmp eax, ebx
jl 0x100269a8
jmp 0x100269bc
mov edx, eax
cmp edx, esi
je 0x100269dd
mov eax, edx
sub eax, esi
add dword [ebp - 0x20], eax
mov ecx, dword [edi + edx*4 - 4]
mov eax, dword [edi + edx*4]
mov dword [edi + edx*4 - 4], eax
mov dword [edi + edx*4], ecx
dec edx
cmp edx, esi
jne 0x100269c7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x1c]
inc ecx
add esi, 2
mov dword [ebp - 0x1c], ecx
cmp ecx, eax
jl 0x10026994
xor esi, esi
push dword [ebp - 0x20]
call fcn.1002a6fe
push eax
call fcn.100067d3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x38]
call fcn.100042e7
jmp 0x10026a0c
xor esi, esi
mov dword [ebp - 0x1c], 0x736b
cmp dword [ebp - 0x1c], 0x7725
jle 0x10026a98
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x24], esi
mov edx, edi
mov dword [ebp - 0x2c], esi
mov ecx, ebx
mov edi, esi
shl edx, cl
mov dword [ebp - 0x28], edx
mov ebx, esi
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x50]
and eax, edx
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026a53
mov eax, dword [eax]
push eax
call fcn.10046da3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x50]
call fcn.100045f1
mov edx, dword [ebp - 0x28]
inc ebx
cmp ebx, 0x2ecb
jl 0x10026a36
inc edi
cmp edi, 0x5fdf
jl 0x10026a34
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x24], ebx
cmp ebx, 0xdb2
jl 0x10026a26
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x65ec
jl 0x10026a21
cmp byte [ebp - 0x18], 0
je 0x10026b16
mov dword [ebp - 0x28], 0x39e4
cmp dword [ebp - 0x28], 0x3d3f
jle 0x10026ad1
mov edi, esi
mov ebx, 0x37df
mov eax, edi
mov ecx, 0x10078098
cdq
push edx
push eax
call fcn.10003fb2
dec edi
dec ebx
jne 0x10026ab5
inc esi
cmp esi, 0x658
jl 0x10026aae
mov dword [ebp - 4], 3
cmp dword [ebp - 0x28], 0x3646
jge 0x10026af0
mov edx, str.prszgxa_jqgp_bws_qadwzsg_icqewmaz_gokey_taoysiytu_tvlww_uzm_njfq_elnatwo_xeouaca
mov ecx, 0x10078098
call fcn.100065fc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x18]
add dword [eax], ecx
jmp 0x10026b35
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
cmp dword [edx], 4
jge 0x10026b35
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xbbca
inc dword [edx]
cmp dword [edx], 4
jl 0x10026b23
cmp dword [ebp - 0x1c], 0x7361
jge 0x10026b49
push str.vhm_pbn_nwelfgzu_vame_dtf_ijnlxqaaw
call fcn.10046da3
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret