Function at 0x10008871
Capabilities:
Check os version
Encode data using xor
Get common file path

Disassembly:
push 0x228
push 0x100c1888
call fcn.10075ce0
xor esi, esi
mov dword [ebp - 0x214], esi
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0x19
jl 0x1000888a
cmp dword [ebp - 0x214], 0xffff0001
jge 0x100088b1
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x100088cd
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x234], esi
cmp dword [ebp - 0x234], 0x3d
jge 0x1000890c
mov eax, dword [ebp - 0x234]
and eax, reloc.WS2_32.dll_accept
jns 0x100088f1
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100088fe
inc dword [ebp - 0x214]
jmp 0x10008904
dec dword [ebp - 0x214]
inc dword [ebp - 0x234]
jmp 0x100088d6
mov dword [ebp - 4], 0xfffffffe
call fcn.1000894d
xor eax, eax
inc eax
mov dword [ebp - 4], eax
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0x16
jge 0x10008976
mov ecx, dword [ebp - 0x238]
and ecx, reloc.WS2_32.dll_accept
jns 0x10008941
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, eax
jne 0x10008968
inc dword [ebp - 0x214]
jmp 0x1000896e
dec dword [ebp - 0x214]
inc dword [ebp - 0x238]
jmp 0x10008925
mov dword [ebp - 4], 0xfffffffe
call fcn.1000899e
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x100089b9
cmp edx, 4
je 0x100089b9
and dword [ebp - 0x214], ecx
jmp 0x100089c1
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0xb
jl 0x10008984
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 6
jl 0x100089c9
mov edi, 0xffff0001
cmp dword [ebp - 0x214], edi
jge 0x100089f1
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10008a0d
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x10008a29
cmp edx, 4
je 0x10008a29
and dword [ebp - 0x214], ecx
jmp 0x10008a31
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
push 2
pop ebx
cmp ecx, ebx
jl 0x10008a0f
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 0x10
jl 0x10008a3b
cmp dword [ebp - 0x214], 0
jge 0x10008a56
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10008a72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 8
jl 0x10008a74
cmp dword [ebp - 0x214], 0
jge 0x10008a8f
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10008aab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov esi, 0x100a6ea4
push esi
push esi
call dword [sym.imp.USER32.dll_FindWindowW]
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0x10
jl 0x10008aba
cmp dword [ebp - 0x214], edi
jge 0x10008add
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10008af9
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop edi
idiv edi
cmp edx, 1
je 0x10008b15
cmp edx, 4
je 0x10008b15
and dword [ebp - 0x214], ecx
jmp 0x10008b1b
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0xd
jl 0x10008afb
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], ebx
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 7
jge 0x10008b73
mov eax, dword [ebp - 0x22c]
and eax, reloc.WS2_32.dll_accept
jns 0x10008b58
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10008b65
inc dword [ebp - 0x214]
jmp 0x10008b6b
dec dword [ebp - 0x214]
inc dword [ebp - 0x22c]
jmp 0x10008b3d
mov dword [ebp - 4], 0xfffffffe
call fcn.10008bde
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 7
jl 0x10008b81
cmp dword [ebp - 0x214], 0
jge 0x10008b9c
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10008bb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
push 5
pop edi
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10008bcc
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10008bf9
add dword [ebp - 0x214], eax
jmp 0x10008bff
sub dword [ebp - 0x214], eax
inc eax
cmp eax, edi
jl 0x10008bbd
push esi
push esi
call dword [sym.imp.USER32.dll_FindWindowW]
xor ecx, ecx
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x10008c27
cmp edx, 4
je 0x10008c27
and dword [ebp - 0x214], ecx
jmp 0x10008c2f
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x10008c0e
xor ecx, ecx
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x10008c50
cmp edx, 4
je 0x10008c50
and dword [ebp - 0x214], ecx
jmp 0x10008c58
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 7
jl 0x10008c37
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, edi
jl 0x10008c60
cmp dword [ebp - 0x214], 0
jge 0x10008c83
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10008c9f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 3
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 8
jge 0x10008ce3
mov eax, dword [ebp - 0x224]
and eax, reloc.WS2_32.dll_accept
jns 0x10008cc8
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10008cd5
inc dword [ebp - 0x214]
jmp 0x10008cdb
dec dword [ebp - 0x214]
inc dword [ebp - 0x224]
jmp 0x10008cad
mov dword [ebp - 4], 0xfffffffe
call fcn.10008d2a
mov dword [ebp - 4], 4
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 8
jge 0x10008d53
mov eax, dword [ebp - 0x218]
and eax, reloc.WS2_32.dll_accept
jns 0x10008d18
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10008d45
inc dword [ebp - 0x214]
jmp 0x10008d4b
dec dword [ebp - 0x214]
inc dword [ebp - 0x218]
jmp 0x10008cfd
mov dword [ebp - 4], 0xfffffffe
call fcn.10008db6
and dword [ebp - 0x214], 0
jge 0x10008d77
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x10008d93
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor ecx, ecx
push 4
pop ebx
mov eax, ecx
cdq
push 5
pop edi
idiv edi
cmp edx, 1
je 0x10008dd1
cmp edx, ebx
je 0x10008dd1
and dword [ebp - 0x214], ecx
jmp 0x10008dd7
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, ebx
jl 0x10008d98
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10008dff
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10008e0c
add dword [ebp - 0x214], eax
jmp 0x10008e12
sub dword [ebp - 0x214], eax
inc eax
cmp eax, ebx
jl 0x10008df0
push esi
push esi
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
call edi
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10008e32
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10008e3f
add dword [ebp - 0x214], eax
jmp 0x10008e45
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x10008e23
push esi
push esi
call edi
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, ebx
jl 0x10008e51
xor edi, edi
cmp dword [ebp - 0x214], edi
jge 0x10008e6c
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10008e88
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x21c], edi
cmp dword [ebp - 0x21c], 2
jge 0x10008ecb
mov eax, dword [ebp - 0x21c]
and eax, reloc.WS2_32.dll_accept
jns 0x10008eb0
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10008ebd
inc dword [ebp - 0x214]
jmp 0x10008ec3
dec dword [ebp - 0x214]
inc dword [ebp - 0x21c]
jmp 0x10008e95
mov dword [ebp - 4], 0xfffffffe
call fcn.10008efc
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10008ee8
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10008f17
add dword [ebp - 0x214], eax
jmp 0x10008f1d
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x10008ed9
push esi
push esi
call dword [sym.imp.USER32.dll_FindWindowW]
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x10008f2d
cmp dword [ebp - 0x214], edi
jge 0x10008f47
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10008f63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 4], 6
mov dword [ebp - 0x220], edi
cmp dword [ebp - 0x220], 2
jge 0x10008fac
mov eax, dword [ebp - 0x220]
and eax, reloc.WS2_32.dll_accept
jns 0x10008f91
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10008f9e
inc dword [ebp - 0x214]
jmp 0x10008fa4
dec dword [ebp - 0x214]
inc dword [ebp - 0x220]
jmp 0x10008f76
mov dword [ebp - 4], 0xfffffffe
call fcn.10008ff3
mov dword [ebp - 4], 7
mov dword [ebp - 0x228], edi
cmp dword [ebp - 0x228], edi
jge 0x1000901c
mov eax, dword [ebp - 0x228]
and eax, reloc.WS2_32.dll_accept
jns 0x10008fdf
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000900e
inc dword [ebp - 0x214]
jmp 0x10009014
dec dword [ebp - 0x214]
inc dword [ebp - 0x228]
jmp 0x10008fc5
mov dword [ebp - 4], 0xfffffffe
call fcn.10009063
mov dword [ebp - 4], 8
mov dword [ebp - 0x230], edi
cmp dword [ebp - 0x230], edi
jge 0x1000908c
mov eax, dword [ebp - 0x230]
and eax, reloc.WS2_32.dll_accept
jns 0x1000904f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000907e
inc dword [ebp - 0x214]
jmp 0x10009084
dec dword [ebp - 0x214]
inc dword [ebp - 0x230]
jmp 0x10009035
mov dword [ebp - 4], 0xfffffffe
call fcn.10009151
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x1000909a
cmp dword [ebp - 0x214], edi
jge 0x100090bd
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x100090d9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
push esi
push esi
call dword [sym.imp.USER32.dll_FindWindowW]
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x100090ef
cmp dword [ebp - 0x214], edi
jge 0x10009112
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000912e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000916c
cmp edx, 4
je 0x1000916c
and dword [ebp - 0x214], ecx
jmp 0x10009174
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x10009130
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x10009196
cmp edx, 4
je 0x10009196
and dword [ebp - 0x214], ecx
jmp 0x1000919e
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x1000917c
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x100091a6
cmp dword [ebp - 0x214], edi
jge 0x100091c0
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop edi
mov ecx, edi
idiv ecx
test edx, edx
jne 0x100091de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor ebx, ebx
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x100091e2
mov esi, 0xffff0001
cmp dword [ebp - 0x214], esi
jge 0x1000920a
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
mov ecx, edi
idiv ecx
test edx, edx
je 0x10009225
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x214], ebx
push 0xfa
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x1000923f
cmp dword [ebp - 0x214], ebx
jge 0x10009259
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov ecx, edi
idiv ecx
test edx, edx
jne 0x10009274
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 2
jl 0x10009276
cmp dword [ebp - 0x214], esi
jge 0x10009299
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
idiv edi
test edx, edx
je 0x100092b2
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x100092b4
cmp dword [ebp - 0x214], ebx
jge 0x100092d7
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x100092f3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x1000930f
cmp edx, 4
je 0x1000930f
and dword [ebp - 0x214], ecx
jmp 0x10009317
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x100092f5
mov eax, dword [ebp - 0x214]
call fcn.10075d28
ret