Function at 0x1003ea61
Capabilities:
Encode data using xor
Get disk size
Query environment variable

Disassembly:
mov eax, 0x10063811
call fcn.10061a48
sub esp, 0x148
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x40], dl
mov dword [ebp - 0x20], esi
je 0x1003eaac
test dl, dl
je 0x1003eaa1
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1003f551
mov dl, 1
call fcn.1003c67b
jmp 0x1003f551
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x1003f551
mov dword [ebp - 0x24], 0x1325
xor ebx, ebx
cmp dword [ebp - 0x24], 0x166c
jle 0x1003eb44
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov edx, esi
mov ecx, edi
shl edx, cl
mov esi, ebx
mov dword [ebp + 8], edx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x124]
or eax, edx
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003eaf9
mov eax, dword [eax]
push eax
call fcn.1004af7c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x124]
call fcn.10005365
mov edx, dword [ebp + 8]
inc edi
cmp edi, 0x2dfe
jl 0x1003ead9
inc esi
cmp esi, 0x4053
jl 0x1003ead7
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x7c43
jl 0x1003eacc
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x199b
jl 0x1003eac7
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x24], 0xf40
jge 0x1003eb58
push str.fzy_vosovudqg_znmjwetqh_fepqyu_rhtqfhz_jizgsb_doeahcbv_mvhbr_dmse_wiijmsod_nlfc_vqwxlp_rimiua
call fcn.1004af7c
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x20], 0
je 0x1003eb8a
mov edx, dword [ebp + 0xc]
mov dword [edx], ebx
cmp dword [edx], 4
jge 0x1003f551
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [edx]
cmp dword [edx], 4
jl 0x1003eb73
jmp 0x1003f551
mov eax, dword [ebp + 0x14]
push 0x6347
push 0x5090
push 1
push ecx
push ecx
mov dword [ebp - 0x44], esi
mov ecx, 0x31c4
mov esi, dword [ebp + 0x18]
push 0x26d7
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], esi
call fcn.1003dbc7
add esp, 0x18
mov dword [ebp + 8], 0x46bb
cmp dword [ebp + 8], 0x4912
jle 0x1003ebfe
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1007d9f8
xor eax, esi
cdq
push edx
push eax
call fcn.10004c38
inc edi
cmp edi, 0x1d58
jl 0x1003ebd8
inc esi
cmp esi, 0x4ebf
jl 0x1003ebd6
mov esi, dword [ebp + 0x18]
xor eax, eax
mov dword [ebp - 0x88], 7
mov dword [ebp - 0x8c], ebx
mov word [ebp - 0x9c], ax
mov dword [ebp - 4], 2
mov byte [ebp - 4], 3
cmp dword [ebp + 8], 0x4427
jge 0x1003ec5e
mov edx, str.hiogdzwzh_nvihe_wwhfqfa_imeqeqal_zgtln_oxivjk_zujwsbha_amwort_tdzqr_ukbfavydd
mov ecx, 0x1007d9f8
call fcn.100070aa
jmp 0x1003ec5e
mov dword [ebp - 4], 2
lea eax, [ebp - 0xe4]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x100707d0]
lea ecx, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xf4]
mov dword [ebp - 0x18], 3
push eax
push ebx
movdqu xmmword [ebp - 0xf4], xmm0
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
call fcn.10007962
mov byte [ebp - 4], 5
mov dword [ebp - 0x70], 0x2b96ce02
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x18], 0xffffffeb
cmp dword [ebp - 0x18], 0x11
jl 0x1003eeb5
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x38], 3
cmp dword [ebp - 0x38], ebx
jl 0x1003ee8e
push dword [ebp + 8]
movdqa xmm0, xmmword [0x100707f0]
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x54], ebx
push eax
push ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x50], ebx
movdqu xmmword [ebp - 0x104], xmm0
mov dword [ebp - 0x4c], ebx
call fcn.10007962
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x54]
add eax, 8
mov dword [eax], ebx
cmp dword [eax], 3
jg 0x1003ee7a
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], ebx
jl 0x1003ee6d
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], 3
jg 0x1003ee50
mov dword [ebp - 0x6c], 0x19a80bfb
mov dword [ebp - 0x1c], 0x3328
cmp dword [ebp - 0x1c], 0x36da
jle 0x1003ede3
push 0x23c6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ecx, ebx
mov dword [ebp + 8], ebx
mov edi, ebx
mov esi, ebx
mov eax, edi
mov dword [ebp - 0x20], 0x5821
cdq
idiv esi
mov dword [ebp - 0x34], edx
mov edx, ebx
mov dword [ebp - 0x30], edx
mov eax, ecx
mov ecx, edx
sar eax, cl
mov ecx, 0x1007d9f8
cdq
push edx
push eax
call fcn.10004c38
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x34]
dec dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
jne 0x1003ed98
inc esi
cmp esi, 0x412b
jl 0x1003ed84
inc edi
cmp edi, 0x234b
jl 0x1003ed82
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x7a36
jl 0x1003ed80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp + 0x18]
mov dword [ebp + 8], 1
mov byte [ebp - 4], 7
cmp dword [ebp - 0x1c], 0x306a
jge 0x1003ee2a
mov edx, str.yrg_uqtnluni_hrefxixbx_cvxrkhmni_gjzny_cciutwosu_fyjv_jeqlhy_hrkqdy
mov ecx, 0x1007d9f8
call fcn.100070aa
jmp 0x1003ee2a
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 6
push 0x714c
push eax
xor dl, dl
mov ecx, 0x12e9
call fcn.1003c75c
inc dword [ebp - 0x2c]
pop ecx
pop ecx
jmp 0x1003ed4d
lea eax, [ebp - 0x70]
mov edx, 0x96d
push eax
push 0x207e
call fcn.1003c977
dec dword [ebp - 0x24]
pop ecx
pop ecx
jmp 0x1003ed3a
mov eax, dword [ebp - 0x54]
add eax, 8
inc dword [eax]
jmp 0x1003ed23
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 5
call fcn.10004ee5
dec dword [ebp - 0x38]
jmp 0x1003ecdb
push 0x3ecc
lea eax, [ebp - 0x38]
push eax
push 0x7105
push ecx
lea edx, [ebp - 0x84]
mov cl, 1
call fcn.1003c3ee
add esp, 0x10
inc dword [ebp - 0x18]
jmp 0x1003ecc3
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.10004ee5
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x3c]
ja 0x1003ef22
mov dword [ebp + 8], 0x38462751
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], 0xfffffff7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x1003ef04
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
mov ecx, 0x5a34
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
call fcn.1003bb90
jmp 0x1003f52e
mov dword [ebp - 0x2c], 0x20624039
mov dword [ebp - 0x2c], 0xfffffffc
cmp dword [ebp - 0x2c], 0xfffffff2
jge 0x1003f3bd
mov dword [ebp - 0x24], 0xc0f8067e
mov dword [ebp + 8], 1
mov dword [ebp + 8], 0x7649
cmp dword [ebp + 8], 0x790d
jle 0x1003ef7f
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1007d9f8
and eax, esi
cdq
push edx
push eax
call fcn.10004c38
inc edi
cmp edi, 0x1ac0
jl 0x1003ef5c
inc esi
cmp esi, 0xdee
jl 0x1003ef5a
mov dword [ebp - 0x34], 0xde9ab5c2
mov byte [ebp - 4], 9
cmp dword [ebp + 8], 0x74a2
jge 0x1003efc6
mov edx, str.salziyx_gmlczk_lfv_hytcq_wluz
mov ecx, 0x1007d9f8
call fcn.100070aa
jmp 0x1003efc6
push 2
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp + 8], ebx
jmp 0x1003efe2
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x10c], 0xff55e00f
inc dword [ebp + 8]
cmp dword [ebp + 8], ecx
jl 0x1003efd1
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 1
jg 0x1003f3b5
mov dword [ebp - 0x18], 0x79c4185a
mov dword [ebp - 0x30], 0xc1a
cmp dword [ebp - 0x30], 0xdfa
jle 0x1003f096
push 0x201d
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, ebx
mov dword [ebp + 8], ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, esi
mov dword [ebp - 0x34], eax
mov esi, eax
mov edi, ebx
shl esi, cl
mov eax, esi
mov ecx, ebx
and eax, edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], eax
or eax, ecx
mov ecx, 0x1007d9f8
cdq
push edx
push eax
call fcn.10004c38
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x4b76
jl 0x1003f03c
inc edi
cmp edi, 0x6b1f
jl 0x1003f030
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x2ae1
jl 0x1003f025
inc eax
mov dword [ebp + 8], eax
cmp eax, 0x251d
jl 0x1003f020
push 0x13c17
push 0x131bb
call fcn.10031f24
pop ecx
pop ecx
call eax
mov dword [ebp + 8], 0xd0176df7
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x30], 0xaa3
jge 0x1003f0dd
mov edx, str.nam_dfjwbcsql_ebsovo_xtbf_dkhwfwq_vgkaxuq_bxrqvb_chac_djvz_iggg_lii_cfdqrdf
mov ecx, 0x1007d9f8
call fcn.100070aa
jmp 0x1003f0dd
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], 0x1796
cmp dword [ebp - 0x20], 0x18a5
jle 0x1003f161
push 0x23c6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x1c], 0x7ec0
mov dword [ebp + 8], ecx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x13c]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003f12d
mov eax, dword [eax]
push eax
call fcn.1004af7c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x13c]
call fcn.10005365
mov ecx, dword [ebp + 8]
add ecx, esi
dec dword [ebp - 0x1c]
mov dword [ebp + 8], ecx
jne 0x1003f111
inc esi
cmp esi, 0x5c8e
jl 0x1003f105
inc edi
cmp edi, 0x3b8d
jl 0x1003f103
mov dword [ebp + 8], 0xd0f065f4
cmp dword [ebp - 0x20], 0x1580
jge 0x1003f17c
push str.lrxxxfyot_euwxq_lsrltmbj_ulg_ost_bex_zudc_ndml_khowot
call fcn.1004af7c
pop ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], ebx
jl 0x1003f388
push 2
lea ecx, [ebp - 0xc0]
call fcn.10004e62
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xd8]
push 4
mov dword [ebp + 8], 0x643b8a27
call fcn.10004e62
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x64]
xor dl, dl
push 0x1840
push eax
mov ecx, 0x1c2c
call fcn.1003c288
pop ecx
pop ecx
lea eax, [ebp - 0xd8]
mov dl, 1
push eax
push 0x460d
push ecx
lea eax, [ebp - 0x64]
mov ecx, 0x5a0
push eax
call fcn.1003cef3
mov eax, dword [ebp - 0xc0]
add esp, 0x14
mov dword [eax], 1
mov dword [ebp + 8], 0xb9193c1d
mov dword [ebp + 8], 0x667f5aee
mov dword [ebp + 8], 0x4151c8b9
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp + 8], ebx
jmp 0x1003f235
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x80], 0xfffffff7
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x1003f227
mov dword [ebp - 0x80], ebx
jmp 0x1003f342
mov dword [ebp - 0x5c], 0xd2f38d9
mov dword [ebp + 8], 0xdffbe584
mov dword [ebp + 8], 4
mov dword [ebp + 8], 0xfffffff6
mov dword [ebp + 8], 0x2106
cmp dword [ebp + 8], 0x5ed
jge 0x1003f323
lea eax, [ebp - 0x74]
mov ecx, 0x1007db18
push eax
call fcn.10032cc2
mov edi, dword [ebp - 0x74]
lea ecx, [ebp - 0xb4]
push edi
call fcn.10004e62
mov byte [ebp - 4], 0x11
mov esi, dword [ebp - 0xb4]
test edi, edi
jle 0x1003f2bf
mov eax, esi
mov dword [ebp - 0x1c], edi
mov dword [ebp + 8], eax
push eax
mov ecx, 0x1007db18
call fcn.10032cc2
mov eax, dword [ebp + 8]
add eax, 4
dec dword [ebp - 0x1c]
mov dword [ebp + 8], eax
jne 0x1003f2a6
mov edx, dword [ebp - 0xb0]
mov ecx, esi
mov eax, edx
mov byte [ebp - 0x58], bl
push dword [ebp - 0x58]
sub eax, esi
sar eax, 2
push eax
call fcn.100448eb
mov eax, ebx
mov dword [ebp + 8], eax
pop ecx
pop ecx
test edi, edi
jle 0x1003f304
push dword [esi + eax*4]
call fcn.1003a81b
mov edx, 0x1006d068
mov ecx, eax
call fcn.100070aa
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, edi
jl 0x1003f2e5
push 0x1007d9f8
call fcn.1001e51d
pop ecx
call fcn.1003ea4a
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x10
call fcn.10004ee5
push 0x37ca
sub esp, 0xc
lea eax, [ebp - 0x5c]
push 1
push eax
push ecx
lea eax, [ebp - 0x60]
push eax
push ecx
call fcn.1003cc9c
add esp, 0x24
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 1
jle 0x1003f243
mov eax, dword [ebp - 0xc0]
dec dword [eax]
jns 0x1003f206
sub esp, 0x18
call fcn.1003c6b8
add esp, 0x18
lea ecx, [ebp - 0xd8]
call fcn.10004ee5
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 2
call fcn.10004ee5
dec dword [ebp - 0x18]
jns 0x1003f193
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1003f3ad
push ebx
push 0x188c
push 0x6468
push 1
mov edx, 0x4da5
mov cl, 1
call fcn.1003e24f
add esp, 0x10
inc dword [ebp - 0x24]
jmp 0x1003efea
dec dword [ebp - 0x2c]
jmp 0x1003ef30
lea eax, [ebp - 0x3c]
mov edx, 0x2407
push eax
lea eax, [ebp - 0x9c]
xor cl, cl
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.1003c3c6
mov dword [ebp - 0x30], 0x4d67
add esp, 0xc
cmp dword [ebp - 0x30], 0x4e1e
jle 0x1003f450
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x1c], 0x3370
mov dword [ebp + 8], edi
mov esi, edi
mov edi, 0x7542
mov eax, esi
lea ecx, [ebp - 0x154]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003f41b
mov eax, dword [eax]
push eax
call fcn.1004af7c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x154]
call fcn.10005365
inc esi
dec edi
jne 0x1003f401
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
add edi, esi
dec dword [ebp - 0x1c]
mov dword [ebp + 8], edi
jne 0x1003f3fa
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4d34
jl 0x1003f3ee
cmp dword [ebp - 0x30], 0x4b0a
jge 0x1003f464
push str.kqsn_asvzloq_zxibp_eujajo_kqay_xdidxcwya
call fcn.1004af7c
pop ecx
push 3
lea ecx, [ebp - 0xe4]
mov dword [ebp - 4], 2
call fcn.10004e62
push 2
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x14
call fcn.10004e62
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 0x15
push eax
push ecx
lea eax, [ebp - 0xe4]
mov dword [ebp - 0x48], 0xc5416513
push eax
xor dl, dl
call fcn.1003afd0
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0xcc]
call fcn.1003f821
add esp, 0xc
lea eax, [ebp - 0xcc]
lea edx, [ebp - 0x48]
push 1
push 0xca6
push 0x1ee4
push eax
push ecx
xor cl, cl
call fcn.1003e437
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 1
push 0x1c7a
push 0x7eba
call fcn.1003b01f
add esp, 0x14
lea ecx, [ebp - 0xcc]
call fcn.10004ee5
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 2
call fcn.10004ee5
push 0x4018
push 1
push ebx
lea eax, [ebp - 0x3c]
mov cl, 1
push eax
lea eax, [ebp - 0x9c]
push eax
lea edx, [ebp - 0x44]
call fcn.1003cd9e
mov esi, dword [ebp + 0x18]
add esp, 0x14
lea eax, [ebp - 0x9c]
cmp esi, eax
je 0x1003f543
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.10006052
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.10005431
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret