Function at 0x100357e0
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x100627f8
call fcn.10060e94
sub esp, 0x3c
push ebx
push esi
mov dword [ebp - 0x20], 0x6be8
xor esi, esi
cmp dword [ebp - 0x20], 0x6ce4
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
jle 0x1003588d
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov eax, esi
mov dword [ebp - 0x14], esi
add eax, ebx
mov ebx, eax
mov dword [ebp - 0x24], eax
and ebx, edi
mov edi, esi
mov eax, ebx
lea ecx, [ebp - 0x44]
or eax, edi
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003583f
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.1000162e
inc edi
cmp edi, 0x735b
jl 0x10035826
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
inc eax
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp eax, 0xc46
jl 0x1003581b
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x6da3
jl 0x10035816
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x1cf0
jl 0x10035811
push esi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp dword [ebp - 0x20], 0x6878
jge 0x100358a1
push str.ncvfqqy_dmrqgg_riftl_slpalz_unjsetjvp_lratumc_qmjl_cybck_lvfodn
call fcn.10048570
pop ecx
or dword [ebp - 4], 0xffffffff
mov edi, 0x1007cfd8
mov dword [ebp - 0x24], 0x593
cmp dword [ebp - 0x24], 0x5af
jle 0x1003592b
mov ebx, esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], 0x3354
mov dword [ebp - 0x1c], esi
mov eax, esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
xor eax, esi
mov ecx, edi
or eax, ebx
cdq
push edx
push eax
call fcn.1000703f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x3f40
jl 0x100358d4
inc esi
push 0
mov dword [ebp - 0x1c], esi
cmp esi, 0x6547
pop esi
jl 0x100358cc
dec ebx
dec dword [ebp - 0x18]
jne 0x100358c9
mov ebx, dword [ebp - 0x14]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x7de1
jl 0x100358bf
push 0xb3c
push 0x12dc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [ebp + 0x10], 0
je 0x10035982
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [edx]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [eax], ecx
mov eax, dword [edx]
add eax, 0xfffffffb
add eax, ecx
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x9e923e64
mov eax, dword [ebp + 0x14]
setne dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, dword [eax + 4]
setl cl
xor eax, eax
cmp ecx, 0xa62a9695
mov ecx, 0xffff
setne al
cmp ecx, eax
mov eax, dword [ebp + 8]
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
jmp 0x10035a2d
mov dword [ebp - 0x18], 0x2263
cmp dword [ebp - 0x18], 0x2474
jle 0x100359ea
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov eax, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], esi
mov ecx, eax
mov esi, ebx
mov ebx, dword [ebp - 0x2c]
shl esi, cl
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, edi
cdq
push edx
push eax
call fcn.1000703f
inc ebx
cmp ebx, 0x18e7
jl 0x100359b1
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x20], eax
push 0
pop esi
cmp eax, 0x247
jl 0x100359a5
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x42fd
jl 0x100359a0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x218b
jge 0x10035a2d
mov edx, str.wzc_fhmx_pdnb_wuu_rdoegpn_izrylqm_scerl_brecx_bfq
mov ecx, edi
call fcn.1000b30d
jmp 0x10035a2d
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0x1b0
jge 0x10035a49
mov edx, str.nlw_faihubyqx_xvcgvs_zcc_wtmgq_ywob_xjlqxxp_esiksxnox_amvki_jthvip_peensmkp_oafvqic
mov ecx, edi
call fcn.1000b30d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret