Function at 0x10009913
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x1005c16e
call fcn.1005b9d8
sub esp, 0x60
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10009bc9
mov dword [ebp - 0x20], 0x2bb0
cmp dword [ebp - 0x20], 0x2e21
jle 0x1000997e
xor esi, esi
mov dword [ebp - 0x1c], esi
mov edi, esi
mov ebx, 0x31f5
xor esi, esi
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x10077e58
cdq
push edx
push eax
call fcn.100030bc
inc esi
cmp esi, 0x314d
jl 0x1000994f
dec edi
dec ebx
jne 0x1000994d
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0xbfc
jl 0x10009946
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2852
jge 0x1000999a
mov edx, str.wkwod_hcwriqwm_xlms_vnjkq_fmybeglo_lmywmpc_ypuqgls_nhtyyy_vhiqqb_mpnjdqh_lbt
mov ecx, 0x10077e58
call fcn.1000530a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x10009a83
mov dword [ebp - 0x1c], 0x48e8
cmp dword [ebp - 0x1c], 0x4a98
jle 0x100099ef
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x20], 0x4205
mov eax, ebx
mov ecx, 0x10077e58
xor eax, esi
cdq
push edx
push eax
call fcn.100030bc
add ebx, edi
dec dword [ebp - 0x20]
jne 0x100099c5
inc edi
cmp edi, 0x2b5a
jl 0x100099bc
inc esi
cmp esi, 0x49df
jl 0x100099ba
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x45db
jge 0x10009a0e
mov edx, str.gveztttpp_ora_hmqm_hwrffo
mov ecx, 0x10077e58
call fcn.1000530a
mov eax, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x10009ca9
push 0x10e4
push 0x5859
push ecx
push ecx
push 0x6066
push ecx
push ecx
push 0x4c1b
push 0x6cae
xor dl, dl
mov ecx, 0x462
call fcn.1000927e
add esp, 0x24
jmp 0x10009ca9
mov dword [ebp - 0x28], 0x15e1abe8
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x38], 0xbf35dd75
mov dword [ebp - 0x34], 0x6a218f0e
push 2
call fcn.10003233
mov dword [ebp - 4], 4
xor ebx, ebx
mov dword [ebp - 0x3c], 0xfffffff6
inc ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x1d42
cmp dword [ebp - 0x24], 0x1dec
jle 0x10009b45
push 0x14a8
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x20], edi
mov eax, esi
cdq
idiv edi
mov edi, 0x2d90
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0x68]
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10009b07
mov eax, dword [eax]
push eax
call fcn.1004434f
pop ecx
push 0
push ebx
lea ecx, [ebp - 0x68]
call fcn.100035c0
dec esi
dec edi
jne 0x10009af0
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x282c
jl 0x10009ae4
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x7f99
jl 0x10009adf
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov dword [ebp - 0x20], 0xfeea382
cmp dword [ebp - 0x24], 0x1adf
jge 0x10009b60
push str.ckktemz_wrxzisas_ltx_jefch_dktha_grninwvy_pojt_eephi_cfdwls_fxdtbf_qhc
call fcn.1004434f
pop ecx
push 0x3cbf
push ebx
push 0x611e
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 4
push eax
push ebx
lea eax, [ebp - 0x50]
mov edx, 0x7da3
push eax
push 0x42c7
push 0x4006
xor cl, cl
call fcn.100086df
add esp, 0x1c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x38]
push 0x47cc
push ecx
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push ecx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x3c]
call fcn.10008e3e
add esp, 0x28
lea ecx, [ebp - 0x50]
call fcn.100032b6
jmp 0x10009ca9
test cl, cl
je 0x10009ca4
mov dword [ebp - 0x20], 0x4b32
cmp dword [ebp - 0x20], 0x4caf
jle 0x10009c1f
xor esi, esi
mov dword [ebp - 0x24], esi
xor edi, edi
mov ebx, 0x3cad
xor esi, esi
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10077e58
cdq
push edx
push eax
call fcn.100030bc
inc esi
cmp esi, 0x2638
jl 0x10009bef
mov esi, dword [ebp - 0x24]
add edi, esi
dec ebx
jne 0x10009bed
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x3e2c
jl 0x10009be6
mov dword [ebp - 4], 7
cmp dword [ebp - 0x20], 0x497b
jge 0x10009c3e
mov edx, str.yvubn_wdkeklec_ivpwkj_ngthrn_pqano_stqbs_yhax_cbsxkys_ayz
mov ecx, 0x10077e58
call fcn.1000530a
mov esi, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0
cmp dword [esi], 0xfffffff3
je 0x10009ca9
xor ebx, ebx
inc ebx
push 0x4119
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0xfffffffb
push eax
push 0
push dword [ebp + 0x14]
mov dl, bl
mov ecx, 0x4716
push dword [ebp + 0x1c]
push esi
push ebx
push 0x2473
call fcn.1000643a
add esp, 0x20
dec dword [esi]
cmp dword [esi], 0xfffffff3
jne 0x10009c53
jmp 0x10009ca9
mov eax, dword [ebp + 0x18]
inc dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret