Function at 0x100017cc
Capabilities:
Check os version
Encode data using xor
Get common file path

Disassembly:
push 0x214
push 0x100c1cd8
call fcn.10075ce0
xor eax, eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x2e
jge 0x10001822
mov eax, dword [ebp - 0x224]
and eax, reloc.WS2_32.dll_accept
jns 0x10001807
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10001814
inc dword [ebp - 0x214]
jmp 0x1000181a
dec dword [ebp - 0x214]
inc dword [ebp - 0x224]
jmp 0x100017ec
mov dword [ebp - 4], 0xfffffffe
call fcn.1000184a
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x10001865
cmp edx, 4
je 0x10001865
and dword [ebp - 0x214], ecx
jmp 0x1000186b
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x19
jl 0x10001830
mov edi, 0xfa
push edi
lea eax, [ebp - 0x210]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call esi
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x100018a2
cmp edx, 4
je 0x100018a2
and dword [ebp - 0x214], ecx
jmp 0x100018a8
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x39
jl 0x10001888
push edi
lea eax, [ebp - 0x210]
push eax
call esi
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x100018d4
cmp edx, 4
je 0x100018d4
and dword [ebp - 0x214], ecx
jmp 0x100018dc
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x1b
jl 0x100018ba
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x100018fe
cmp edx, 4
je 0x100018fe
and dword [ebp - 0x214], ecx
jmp 0x10001904
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0xa
jl 0x100018e4
push edi
lea eax, [ebp - 0x210]
push eax
call esi
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
xor ebx, ebx
inc ebx
cmp edx, ebx
je 0x10001932
cmp edx, 4
je 0x10001932
and dword [ebp - 0x214], ecx
jmp 0x10001938
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 7
jl 0x10001916
push edi
lea eax, [ebp - 0x210]
push eax
call esi
mov dword [ebp - 4], ebx
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 0
jge 0x10001987
mov eax, dword [ebp - 0x218]
and eax, reloc.WS2_32.dll_accept
jns 0x1000196d
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, ebx
jne 0x10001979
inc dword [ebp - 0x214]
jmp 0x1000197f
dec dword [ebp - 0x214]
inc dword [ebp - 0x218]
jmp 0x10001952
mov dword [ebp - 4], 0xfffffffe
call fcn.100019f3
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 0x10
jl 0x10001995
cmp dword [ebp - 0x214], 0
jge 0x100019b0
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x100019cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10001a0e
cmp edx, 4
je 0x10001a0e
and dword [ebp - 0x214], ecx
jmp 0x10001a14
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 7
jl 0x100019ce
push edi
lea eax, [ebp - 0x210]
push eax
call esi
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10001a35
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10001a42
add dword [ebp - 0x214], eax
jmp 0x10001a48
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0xe
jl 0x10001a26
mov edi, 0x100a6ea4
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10001a77
cmp edx, 4
je 0x10001a77
and dword [ebp - 0x214], ecx
jmp 0x10001a7f
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 6
jl 0x10001a5d
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10001aa1
cmp edx, 4
je 0x10001aa1
and dword [ebp - 0x214], ecx
jmp 0x10001aa9
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 6
jl 0x10001a87
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x10001ab1
cmp dword [ebp - 0x214], 0
jge 0x10001ad5
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10001af1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10001b15
cmp edx, 4
je 0x10001b15
and dword [ebp - 0x214], ecx
jmp 0x10001b1d
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 4
jl 0x10001afb
mov dword [ebp - 4], 2
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 3
jge 0x10001b67
mov eax, dword [ebp - 0x220]
and eax, reloc.WS2_32.dll_accept
jns 0x10001b4c
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10001b59
inc dword [ebp - 0x214]
jmp 0x10001b5f
dec dword [ebp - 0x214]
inc dword [ebp - 0x220]
jmp 0x10001b31
mov dword [ebp - 4], 0xfffffffe
call fcn.10001b9a
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10001bb5
cmp edx, 4
je 0x10001bb5
and dword [ebp - 0x214], ecx
jmp 0x10001bbb
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 7
jl 0x10001b75
push 0xfa
lea eax, [ebp - 0x210]
push eax
call esi
xor ebx, ebx
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 5
jl 0x10001bd3
cmp dword [ebp - 0x214], ebx
jge 0x10001bf6
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10001c12
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 3
mov dword [ebp - 0x21c], ebx
cmp dword [ebp - 0x21c], ebx
jge 0x10001c54
mov eax, dword [ebp - 0x21c]
and eax, reloc.WS2_32.dll_accept
jns 0x10001c39
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10001c46
inc dword [ebp - 0x214]
jmp 0x10001c4c
dec dword [ebp - 0x214]
inc dword [ebp - 0x21c]
jmp 0x10001c1f
mov dword [ebp - 4], 0xfffffffe
call fcn.10001c87
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10001ca2
cmp edx, 4
je 0x10001ca2
and dword [ebp - 0x214], ecx
jmp 0x10001caa
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 4
jl 0x10001c62
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10001ccc
cmp edx, 4
je 0x10001ccc
and dword [ebp - 0x214], ecx
jmp 0x10001cd2
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x10001cb2
push 0xfa
lea eax, [ebp - 0x210]
push eax
call esi
xor ecx, ecx
push 7
pop ebx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x10001d05
cmp edx, 4
je 0x10001d05
and dword [ebp - 0x214], ecx
jmp 0x10001d0d
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, ebx
jl 0x10001ceb
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x10001d14
cmp dword [ebp - 0x214], 0
jge 0x10001d38
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10001d54
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x10001d56
mov esi, 0xffff0001
mov eax, dword [ebp - 0x214]
cmp eax, esi
jge 0x10001d7a
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
cdq
mov ecx, ebx
idiv ecx
test edx, edx
je 0x10001d8f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10001da0
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10001dad
add dword [ebp - 0x214], eax
jmp 0x10001db3
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x10001d91
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x10001dc3
cmp dword [ebp - 0x214], 0
jge 0x10001dde
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov ecx, ebx
idiv ecx
test edx, edx
jne 0x10001df9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x10001dfb
cmp dword [ebp - 0x214], 0
jge 0x10001e16
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov ecx, ebx
idiv ecx
test edx, edx
jne 0x10001e31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x214], ecx
cmp ecx, esi
jge 0x10001e4a
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
mov edi, ebx
idiv edi
test edx, edx
je 0x10001e63
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x214], ecx
test ecx, ecx
jns 0x10001e73
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov ecx, ebx
idiv ecx
test edx, edx
jne 0x10001e8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x214], ecx
cmp ecx, esi
jge 0x10001ea7
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
idiv ebx
test edx, edx
je 0x10001ebe
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
mov dword [ebp - 0x214], ecx
mov eax, ecx
call fcn.10075d28
ret