Function at 0x1000321d
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x10057aab
call fcn.100574a0
sub esp, 0x100
push ebx
push esi
mov byte [ebp - 0x34], cl
xor ebx, ebx
mov dword [ebp - 0x20], 0x5e9
cmp dword [ebp - 0x20], 0x86d
push edi
mov dword [ebp - 0x10], esp
jle 0x10003292
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, esi
mov esi, 0x29d3
mov eax, ebx
mov ecx, 0x10072d38
xor eax, edi
cdq
push edx
push eax
call fcn.1000aa66
dec ebx
dec esi
jne 0x10003256
mov esi, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x5bea
jl 0x1000324f
inc edi
push 0
pop ebx
cmp edi, 0x1a6d
jl 0x1000324a
push 0xa1c
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x569
jge 0x100032ad
mov edx, str.xtdcbskht_qqrf_mnjhgz_vrhyav_xvemyrt_cva_pdvdntf_aqkytuo_kmhl_xlv_gnpdnxlqi_ewufjnyw_mtfwoqalt_vtzcur
mov ecx, 0x10072d38
call fcn.1000cc60
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x34], 0
je 0x10003a40
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x74], ax
mov dword [ebp - 4], 2
mov dword [ebp - 0x38], 0x90ac204e
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x54], 0xa2ef703c
mov dword [ebp - 0x50], 0xfffffffd
mov dword [ebp - 0x18], 0x7de3
cmp dword [ebp - 0x18], 0x80c1
jle 0x1000336c
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0x555e
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ebx, esi
mov esi, dword [ebp - 0x1c]
and ebx, edi
mov eax, ebx
mov ecx, 0x10072d38
or eax, esi
cdq
push edx
push eax
call fcn.1000aa66
inc esi
cmp esi, 0x733c
jl 0x1000332b
mov esi, dword [ebp - 0x24]
inc edi
push 0
pop ebx
cmp edi, 0x7030
jl 0x10003321
dec esi
dec dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
jne 0x1000331f
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x1189
jl 0x10003315
mov dword [ebp - 0x38], ebx
jmp 0x100033db
push ecx
push ecx
mov dword [ebp - 0x5c], 0xd95e17ca
mov cl, 1
push 0x6fc6
call fcn.100031e2
add esp, 0xc
lea eax, [ebp - 0x5c]
mov ecx, 0x1cc4
push 0x22e4
push 0x29bd
push 0x7206
push eax
push 0x2094
push 0x6cd0
call fcn.100059d3
add esp, 0x18
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x13
jle 0x10003396
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 0x7d10
jge 0x1000341b
mov edx, str.mhhr_laq_wondwzhh_dlutshi_fnmfbatdb_wyesgkzoz_qnfcatx_nktattvt_yikehg_xnzd
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x1000341b
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x38]
push ebx
push eax
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x50]
call fcn.100061a5
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp eax, dword [ebp + 0xc]
ja 0x10003592
mov dword [ebp - 0x18], 0x261f9c28
lea ecx, [ebp - 0x8c]
push 1
call fcn.10001bc4
push ebx
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 5
push eax
push 0x21b5
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x24], 0x3acb
push eax
push 0x597c
mov dword [ebp - 0x2c], 0xfffffff9
mov edx, 0x7abd
push 0x598e
mov ecx, 0xfe7
call fcn.10005434
add esp, 0x18
mov dword [ebp - 0x3c], ebx
jmp 0x100034ae
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xc0], 4
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 4
jl 0x1000349d
cmp dword [ebp - 0x18], ebx
je 0x100034ce
push ecx
push ebx
push ecx
mov ecx, 0x45d5
call fcn.10002ecc
add esp, 0xc
jmp 0x10003553
mov dword [ebp - 0x1c], 0xe662
mov dword [ebp - 0x20], 0x658d83f7
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], ebx
je 0x100034ff
mov eax, dword [ebp - 0x8c]
cmp dword [eax], ebx
je 0x100034ff
xor eax, eax
inc eax
jmp 0x10003501
mov eax, ebx
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
cmp eax, 4
mov eax, dword [ebp - 0x8c]
setge cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x2d]
mov byte [ebp - 0x2d], bl
call fcn.10005e8d
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 2
call fcn.10001c21
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x74]
cmp eax, ecx
je 0x10003582
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.1000aff6
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.1000b1c0
jmp 0x10003a47
lea eax, [ebp - 0x44]
mov edx, 0x6634
push eax
push 0x154
push 0x5119
push 1
lea eax, [ebp - 0x48]
mov ecx, 0x4afb
push eax
lea eax, [ebp - 0x74]
push eax
push 0x6d05
push ebx
push 1
call fcn.1000448a
add esp, 0x24
lea ecx, [ebp - 0x98]
push 1
call fcn.10001bc4
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 6
call fcn.10001bc4
push ecx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x98]
call fcn.10003c2d
lea eax, [ebp - 0x80]
push eax
push 0x532a
push 0x30d4
lea ecx, [ebp - 0x58]
call fcn.1000419e
mov eax, dword [ebp - 0x80]
add esp, 0x14
mov dword [eax], ebx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], ebx
jmp 0x10003668
push 0x5e0a
push 1
push 1
push 0x376d
mov dword [ebp - 0x1c], 0xfffffff6
xor dl, dl
push 0x321c
mov ecx, 0x5471
call fcn.10005cb2
mov dword [ebp - 0x1c], ebx
add esp, 0x14
cmp dword [ebp - 0x1c], ebx
jl 0x10003665
push ecx
push 1
push ecx
mov byte [ebp - 0x2e], bl
lea ecx, [ebp - 0x2e]
call fcn.10002ecc
add esp, 0xc
dec dword [ebp - 0x1c]
jns 0x1000364e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1000361d
mov eax, dword [ebp - 0x80]
inc dword [eax]
cmp dword [eax], 0
jle 0x10003611
push 1
xor dl, dl
mov cl, 1
call fcn.10005d29
pop ecx
lea ecx, [ebp - 0x80]
call fcn.10001c21
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.10001c21
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x48]
jae 0x10003894
mov dword [ebp - 0x24], 0x3b9b
cmp dword [ebp - 0x24], 0x3e3b
jle 0x10003707
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov eax, edi
mov dword [ebp - 0x18], ebx
cdq
mov ebx, 0xa9
idiv esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov esi, edx
mov eax, edi
mov ecx, 0x10072d38
cdq
push edx
push eax
call fcn.1000aa66
add edi, esi
dec ebx
jne 0x100036d5
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x6340
jl 0x100036c0
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x5b7e
jl 0x100036bb
mov byte [ebp - 4], 8
cmp dword [ebp - 0x24], 0x399c
jge 0x10003741
mov edx, str.anocubdbh_ofhdnmkan_uvdqsk_aoiyfa_ros_fqpdvaoz_mpgrjugo_dtbsbbsb_egtruiekm
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x10003741
mov dword [ebp - 4], 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x20], 0x97b09b37
mov dword [ebp - 0x18], 0x4f4cc511
mov dword [ebp - 0x24], 0x477ae27
mov dword [ebp - 0x18], ebx
jmp 0x10003779
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa8], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000376c
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0x168f928d
setg cl
xor edx, edx
cmp ecx, 0xfffffffc
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setge cl
mov dword [ebp - 0xa0], ecx
lea eax, [ecx + 0x1c77]
test eax, eax
jne 0x100037ba
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 1
push ebx
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x6082
setne al
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x13638ecf
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
lea edx, [ebp - 0x44]
setne cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x74]
call fcn.10003c19
mov dword [ebp - 0x28], 0x41ed
cmp dword [ebp - 0x28], 0x4254
pop ecx
jle 0x10003874
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x20], 0x5eb1
mov eax, edi
lea ecx, [ebp - 0xd8]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000384f
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.1000afb2
add edi, esi
dec dword [ebp - 0x20]
jne 0x10003835
inc esi
cmp esi, 0x7e90
jl 0x1000382c
cmp dword [ebp - 0x28], 0x3ed3
jge 0x10003888
push str.wrmjg_oahgn_iavzvvr_taamahrg_rsnlphrnm
call fcn.10040f4c
pop ecx
mov dword [ebp - 4], 2
jmp 0x1000369a
mov dword [ebp - 0x40], 6
mov dword [ebp - 0x18], ebx
jmp 0x100038b1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb0], 0xcff0ea75
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100038a0
xor eax, eax
mov dword [ebp - 0x40], ebx
inc eax
cmp dword [ebp - 0x40], eax
jg 0x10003a1f
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jl 0x10003a17
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jl 0x100038ea
call fcn.100030c7
dec dword [ebp - 0x24]
jns 0x100038e0
mov dword [ebp - 0x28], 0x47d4
cmp dword [ebp - 0x28], 0x4a05
jle 0x10003956
mov esi, ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [edi + esi]
xor eax, ecx
lea ecx, [ebp - 0xf0]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003920
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xf0]
call fcn.1000afb2
mov ecx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x10e1
jl 0x10003903
inc edi
cmp edi, 0x174e
jl 0x100038fe
inc esi
cmp esi, 0x5a32
jl 0x100038fc
mov byte [ebp - 0x2f], bl
cmp dword [ebp - 0x28], 0x443f
jge 0x1000396d
push str.ejuprlgl_ombk_vqnrg_awur_poami_xbjr
call fcn.10040f4c
pop ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x24], 0x2e3a
cmp dword [ebp - 0x24], 0x2ecb
jle 0x100039e4
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0x1b1e
mov eax, esi
lea ecx, [ebp - 0x108]
or eax, edi
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100039b1
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x108]
call fcn.1000afb2
dec esi
dec dword [ebp - 0x20]
jne 0x10003995
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x76e2
jl 0x1000398b
inc edi
cmp edi, 0x26e9
jl 0x10003986
cmp byte [ebp - 0x2f], 0
je 0x100039f1
xor cl, cl
call fcn.10004f7a
cmp dword [ebp - 0x24], 0x2c4a
jge 0x10003a05
push str.cviokzz_mjqji_jorz_dlccv
call fcn.10040f4c
pop ecx
mov dword [ebp - 4], 2
xor eax, eax
dec dword [ebp - 0x18]
inc eax
jmp 0x100038cc
inc dword [ebp - 0x40]
jmp 0x100038bd
lea edx, [ebp - 0x40]
call fcn.10003129
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x74]
cmp esi, eax
je 0x10003582
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
jmp 0x1000357d
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret