Function at 0x100189da
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Get disk information

Disassembly:
mov eax, 0x1005c397
call fcn.1005bac8
sub esp, 0xe4
mov dword [ebp - 0x48], edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10018b0d
cmp byte [ebp + 0xc], 0
je 0x10018a3b
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10018a36
push 0x20ec
push 0x4e32
push 0xfe3
push 0x1fa0
xor esi, esi
xor dl, dl
inc esi
mov ecx, 0x5d81
push esi
push esi
push 0x5d1c
call fcn.100188f7
add esp, 0x1c
jmp 0x10019327
mov dword [ebp - 0x14], 0x4523
xor ebx, ebx
cmp dword [ebp - 0x14], 0x46e4
jle 0x10018ab5
mov dword [ebp - 0x1c], ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], edi
lea eax, [edi + esi]
mov edi, 0x3fa5
mov dword [ebp - 0x24], eax
mov esi, eax
mov eax, esi
mov ecx, 0x10076b78
or eax, ebx
cdq
push edx
push eax
call fcn.10001c56
dec esi
dec edi
jne 0x10018a6a
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0xf1e
jl 0x10018a5d
inc esi
mov dword [ebp - 0x18], esi
push 0
pop ebx
cmp esi, 0x45f0
jl 0x10018a55
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x7c1f
jl 0x10018a50
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10018acf
push 0x28c2
mov edx, 0x428c
xor cl, cl
call fcn.1001a3ca
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0x4259
jge 0x10018a36
mov edx, str.zgkvezqs_kkqo_aqg_phlwo_kapwtqqd_yugpir_qom
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x10018a36
cmp byte [ebp + 8], 0
je 0x10018b21
mov eax, dword [ebp + 0x14]
mov dword [eax], 5
jmp 0x10019327
mov dword [ebp - 0x24], 0x324f
xor ebx, ebx
cmp dword [ebp - 0x24], 0x33cb
jle 0x10018b7c
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov eax, esi
mov dword [ebp - 0x24], ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, 0x10076b78
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001c56
inc ebx
cmp ebx, 0x145b
jl 0x10018b44
mov esi, dword [ebp - 0x1c]
inc edi
push 0
pop ebx
cmp edi, 0x281b
jl 0x10018b3a
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x1628
jl 0x10018b38
xor esi, esi
mov dword [ebp - 0x18], 0x3ea4
inc esi
cmp dword [ebp - 0x18], 0x4082
jle 0x10018bdb
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
add eax, edi
lea ecx, [ebp - 0xd8]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018bb0
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xd8]
call fcn.100020a8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x27ad
jl 0x10018b96
inc edi
cmp edi, 0x3e35
jl 0x10018b91
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x1c], 0x133f29c8
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10018bff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], 0x4a6847df
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018bf1
mov dword [ebp - 0x14], ebx
or edi, 0xffffffff
cmp dword [ebp - 0x14], 3
jge 0x10018c1c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], edi
inc dword [ebp - 0x14]
jmp 0x10018c0a
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x10018caf
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2c], ebx
jne 0x10018c50
mov edx, ebx
cmp dword [ebp - 0x14], ebx
je 0x10018c52
mov edx, esi
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x2c]
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 9
jne 0x10018ca1
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2c], ebx
mov eax, ebx
je 0x10018ca3
mov eax, esi
mov dword [ebp - 0x60], eax
dec dword [ebp - 0x14]
jns 0x10018c28
mov dword [ebp - 0x24], 0x80f885bd
cmp dword [ebp - 0x18], 0x3b25
jge 0x10018cca
push str.ezhbjdnj_onhto_ojdvffv_sxymcqw_zzsnzmjbk_tbfq_scvs_wkklae_xjfe_psne_bysfaysx_rxtrjink_abueapd
call fcn.10043bf4
pop ecx
mov dword [ebp - 4], edi
mov eax, dword [0x1027ea8c]
test al, 1
jne 0x10018cee
push ecx
or eax, esi
mov dword [0x1027fe24], edi
push 0x1571
mov dword [0x1027ea8c], eax
call fcn.1001a81f
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x50], 0xba29f583
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x14], 0x4b3c
cmp dword [ebp - 0x14], 0x4b76
jle 0x10018d62
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x18], 0x645c
mov dword [ebp - 0x1c], eax
cdq
lea ecx, [ebp - 0x90]
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018d35
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x90]
call fcn.100020a8
mov eax, dword [ebp - 0x1c]
add eax, edi
dec dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jne 0x10018d1d
inc edi
cmp edi, 0x65cc
jl 0x10018d11
or edi, 0xffffffff
mov edx, 0x3b89
xor cl, cl
call fcn.10018872
cmp dword [ebp - 0x14], 0x493a
jge 0x10018d82
push str.lcqyyhnej_makooup_wftqglip_sdmyp_bhwquj_tuobft_tpgssol_iiaxrbuii_letbdqq_ayrqwny_deqkqqry_rlry_nrweqvmc
call fcn.10043bf4
pop ecx
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
neg eax
dec eax
je 0x10018e3b
push ecx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x44], 0x6db6
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x4c], ebx
push eax
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x38]
call fcn.1001884d
mov dword [ebp - 0x18], 0x1c2d
add esp, 0xc
cmp dword [ebp - 0x18], 0x1cfa
jle 0x10018e22
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, edi
cdq
idiv ecx
lea ecx, [ebp - 0xa8]
mov eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018df3
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xa8]
call fcn.100020a8
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x12d9
jl 0x10018dd4
inc edi
cmp edi, 0x4b44
jl 0x10018dcf
or edi, 0xffffffff
cmp dword [ebp - 0x18], 0x1a31
jge 0x10018e36
push str.ckyuuuk_rlv_lsmusou_rtdmepzq_zjhsyfds_gtfbut_mhzatlv_jucphbot_roavuxael_fiompjg_xrlcbmr_iyzbnwln_kxlfmdnun
call fcn.10043bf4
pop ecx
mov dword [ebp - 4], edi
jmp 0x10018e5d
push esi
push 0x400b
push 0x4a71
push ebx
lea eax, [ebp - 0x54]
xor dl, dl
push eax
push 0x2ac2
lea ecx, [ebp - 0x38]
call fcn.1001a531
add esp, 0x18
mov dword [ebp - 0x20], 0x58fc
cmp dword [ebp - 0x20], 0x59a3
jle 0x10018f12
mov edi, ebx
mov dword [ebp - 0x30], ebx
mov eax, ebx
mov dword [ebp - 0x14], ebx
mov edx, edi
mov dword [ebp - 0x24], ebx
mov ecx, eax
mov edi, ebx
shl edx, cl
mov dword [ebp - 0x18], edx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0xc0]
or eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018eac
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xc0]
call fcn.100020a8
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x1fc9
jl 0x10018e8e
inc edi
cmp edi, 0x4c7e
jl 0x10018e89
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x14e3
jl 0x10018e7b
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 0x1786
jl 0x10018e76
push 0x87c
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
or edi, 0xffffffff
cmp dword [ebp - 0x20], 0x56f8
jge 0x10018f26
push str.shilsm_edyrw_rkyvpq_yuocqwpx_ckrnlz_tzutgn_rpglflt_gslxafjpu
call fcn.10043bf4
pop ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], 0x3364
cmp dword [ebp - 0x24], 0x363b
jle 0x10018fa2
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, edi
cdq
idiv dword [ebp - 0x1c]
or edx, ecx
lea ecx, [ebp - 0xf0]
mov eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10018f65
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xf0]
call fcn.100020a8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x683a
jl 0x10018f43
inc edi
cmp edi, 0x4e35
jl 0x10018f40
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x68f4
jl 0x10018f3e
or edi, 0xffffffff
cmp byte [0x1027e98e], 0
jne 0x10019170
mov dword [ebp - 0x14], 0xbfc4f27d
push 4
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0x9c8ddac0
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x18], ebx
jmp 0x10018fdd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 0xcfd66c4a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10018fcf
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
je 0x10019028
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0xd705
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x70], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
sub ecx, 0x9b78
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x4868
setge al
add eax, 7
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x8c1
cmp dword [ebp - 0x30], 0xb8a
jle 0x100190a5
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x20], ebx
mov esi, eax
mov dword [ebp - 0x1c], ebx
and esi, edi
mov eax, ebx
mov ecx, 0x10076b78
xor eax, esi
cdq
push edx
push eax
call fcn.10001c56
inc ebx
cmp ebx, 0x6faa
jl 0x1001906b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
push 0
pop ebx
cmp eax, 0x1af
jl 0x10019064
inc edi
cmp edi, 0x1642
jl 0x1001905f
xor esi, esi
inc esi
or edi, 0xffffffff
lea eax, [ebp - 0x31]
mov byte [ebp - 0x31], bl
push eax
call fcn.100189b8
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x30], 0x875
pop ecx
jge 0x100190f5
mov edx, str.rqzwjxkw_bnvlldae_dtvykl_yphmkdttc
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x100190f5
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
push eax
call fcn.1001a81f
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0x8319
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0xfe497d6a
mov dword [ebp - 0x18], ebx
jmp 0x10019139
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], 0x788afb1c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001912b
cmp dword [ebp - 0x20], ebx
je 0x1001914b
mov ecx, esi
cmp dword [ebp - 0x5c], ebx
jne 0x1001914d
mov ecx, ebx
mov eax, dword [ebp - 0x30]
sub ecx, eax
jne 0x10019159
cmp dword [ebp - 0x20], ebx
je 0x10019160
mov eax, esi
cmp dword [ebp - 0x1c], ebx
jne 0x10019162
mov eax, ebx
sub esp, 0x10
mov dword [ebp - 0x18], eax
call fcn.100187db
add esp, 0x10
cmp dword [ebp - 0x24], 0x30cd
jge 0x10019184
push str.elhpshr_irwlixv_spptoexx_obvf_yrw_yfeu_wsshbyfs_xke_jfrhzvb_bfua_xwelb_eryqe
call fcn.10043bf4
pop ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x99cfe04
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0xdb5cabfc
mov dword [ebp - 0x18], ebx
jmp 0x100191ab
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001919d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
sub ecx, eax
mov eax, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
je 0x10019268
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x1001928c
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], 8
je 0x10019216
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x10019222
cmp dword [ebp - 0x18], ebx
jne 0x10019222
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x10019224
mov eax, esi
add eax, 0x520f3038
je 0x1001922e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
je 0x10019243
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x40]
test eax, eax
setg cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 5
dec dword [ebp - 0x28]
jns 0x100191fa
jmp 0x1001928c
push esi
lea eax, [ebp - 0x28]
xor dl, dl
push eax
push 0x7f1d
push esi
push 0x5c8a
push 0x7e8
mov ecx, 0x846
call fcn.1001a531
add esp, 0x18
mov eax, dword [0x1027eaa0]
cmp eax, 0x270
jne 0x100192d8
mov edx, 0x1027eaa8
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, dword [edx - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
add edx, 4
cmp edx, 0x1027f468
jl 0x1001929d
jmp 0x100192e4
cmp eax, 0x4e0
jb 0x100192e9
call fcn.1001a85a
mov eax, dword [0x1027eaa0]
mov ecx, dword [eax*4 + 0x1027eaa4]
inc eax
mov dword [0x1027eaa0], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [0x1027fe24]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret