Function at 0x10007f09
Capabilities:
Check os version
Encode data using xor
Get common file path

Disassembly:
push 0x228
push 0x100c1908
call fcn.10075ce0
xor edi, edi
mov dword [ebp - 0x214], edi
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0xf
jl 0x10007f22
mov esi, 0xffff0001
cmp dword [ebp - 0x214], esi
jge 0x10007f4a
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10007f66
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10007f82
cmp edx, 4
je 0x10007f82
and dword [ebp - 0x214], ecx
jmp 0x10007f8a
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x12
jl 0x10007f68
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0x17
jl 0x10007f92
cmp dword [ebp - 0x214], esi
jge 0x10007fb5
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x10007fd1
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x10007fed
cmp edx, 4
je 0x10007fed
and dword [ebp - 0x214], ecx
jmp 0x10007ff5
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0xe
jl 0x10007fd3
mov dword [ebp - 4], edi
mov dword [ebp - 0x234], edi
cmp dword [ebp - 0x234], 0x16
jge 0x1000803a
mov eax, dword [ebp - 0x234]
and eax, reloc.WS2_32.dll_accept
jns 0x1000801f
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000802c
inc dword [ebp - 0x214]
jmp 0x10008032
dec dword [ebp - 0x214]
inc dword [ebp - 0x234]
jmp 0x10008004
mov dword [ebp - 4], 0xfffffffe
call fcn.1000807b
xor eax, eax
inc eax
mov dword [ebp - 4], eax
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 4
jge 0x100080a4
mov ecx, dword [ebp - 0x238]
and ecx, reloc.WS2_32.dll_accept
jns 0x1000806f
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, eax
jne 0x10008096
inc dword [ebp - 0x214]
jmp 0x1000809c
dec dword [ebp - 0x214]
inc dword [ebp - 0x238]
jmp 0x10008053
mov dword [ebp - 4], 0xfffffffe
call fcn.100080d0
xor ecx, ecx
push 4
pop edi
xor esi, esi
inc esi
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, esi
je 0x100080eb
cmp edx, edi
je 0x100080eb
and dword [ebp - 0x214], ecx
jmp 0x100080f3
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0x20
jl 0x100080b8
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, esi
je 0x10008113
cmp edx, edi
je 0x10008113
and dword [ebp - 0x214], ecx
jmp 0x1000811b
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, edi
jl 0x100080fb
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, esi
je 0x1000813a
cmp edx, edi
je 0x1000813a
and dword [ebp - 0x214], ecx
jmp 0x10008142
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 7
jl 0x10008122
mov dword [ebp - 4], 2
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], edi
jge 0x1000818a
mov eax, dword [ebp - 0x22c]
and eax, reloc.WS2_32.dll_accept
jns 0x10008170
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, esi
jne 0x1000817c
inc dword [ebp - 0x214]
jmp 0x10008182
dec dword [ebp - 0x214]
inc dword [ebp - 0x22c]
jmp 0x10008156
mov dword [ebp - 4], 0xfffffffe
call fcn.100081cc
mov dword [ebp - 4], 3
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 5
jge 0x100081f5
mov eax, dword [ebp - 0x224]
and eax, reloc.WS2_32.dll_accept
jns 0x100081bf
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100081e7
inc dword [ebp - 0x214]
jmp 0x100081ed
dec dword [ebp - 0x214]
inc dword [ebp - 0x224]
jmp 0x100081a4
mov dword [ebp - 4], 0xfffffffe
call fcn.1000828f
xor ebx, ebx
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 0xb
jl 0x10008205
cmp dword [ebp - 0x214], ebx
jge 0x1000821f
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x1000823b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 7
jl 0x1000823d
cmp dword [ebp - 0x214], ebx
jge 0x10008257
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10008273
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x100082aa
cmp edx, 4
je 0x100082aa
and dword [ebp - 0x214], ecx
jmp 0x100082b0
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 6
jl 0x10008275
mov edi, 0xfa
push edi
lea eax, [ebp - 0x210]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call esi
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 9
jl 0x100082cd
cmp dword [ebp - 0x214], ebx
jge 0x100082f0
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000830c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10008328
cmp edx, 4
je 0x10008328
and dword [ebp - 0x214], ecx
jmp 0x1000832e
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0xa
jl 0x1000830e
push edi
lea eax, [ebp - 0x210]
push eax
call esi
xor edi, edi
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x10008351
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x1000835e
add dword [ebp - 0x214], eax
jmp 0x10008364
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 0xf
jl 0x10008342
mov esi, 0x100a6ea4
push esi
push esi
call dword [sym.imp.USER32.dll_FindWindowW]
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 7
jl 0x10008379
cmp dword [ebp - 0x214], edi
jge 0x1000839c
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x100083b8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 7
jl 0x100083ba
cmp dword [ebp - 0x214], edi
jge 0x100083d4
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x100083f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x1000840c
cmp edx, 4
je 0x1000840c
and dword [ebp - 0x214], ecx
jmp 0x10008414
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 6
jl 0x100083f2
mov dword [ebp - 4], 4
mov dword [ebp - 0x218], edi
cmp dword [ebp - 0x218], 5
jge 0x1000845d
mov eax, dword [ebp - 0x218]
and eax, reloc.WS2_32.dll_accept
jns 0x10008442
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000844f
inc dword [ebp - 0x214]
jmp 0x10008455
dec dword [ebp - 0x214]
inc dword [ebp - 0x218]
jmp 0x10008427
mov dword [ebp - 4], 0xfffffffe
call fcn.100084d1
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x1000846b
cmp dword [ebp - 0x214], 0xffff0001
jge 0x10008492
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x100084ae
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor ecx, ecx
push 5
pop edi
mov eax, ecx
cdq
mov ebx, edi
idiv ebx
cmp edx, 1
je 0x100084ec
cmp edx, 4
je 0x100084ec
and dword [ebp - 0x214], ecx
jmp 0x100084f4
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 3
jl 0x100084b3
xor eax, eax
and dword [ebp - 0x214], eax
inc eax
cmp eax, 6
jl 0x100084fc
cmp dword [ebp - 0x214], 0
jge 0x10008520
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xd
pop ecx
idiv ecx
test edx, edx
jne 0x1000853c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], edi
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 2
jge 0x1000857c
mov eax, dword [ebp - 0x21c]
and eax, reloc.WS2_32.dll_accept
jns 0x10008561
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000856e
inc dword [ebp - 0x214]
jmp 0x10008574
dec dword [ebp - 0x214]
inc dword [ebp - 0x21c]
jmp 0x10008546
mov dword [ebp - 4], 0xfffffffe
call fcn.100085f0
xor eax, eax
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 7
jl 0x1000858a
cmp dword [ebp - 0x214], 0xffff0001
jge 0x100085b1
mov eax, dword [ebp - 0x214]
imul eax, eax, 0xfffffffb
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x100085cd
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x214], eax
xor eax, eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_accept
jns 0x100085de
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x1000860b
add dword [ebp - 0x214], eax
jmp 0x10008611
sub dword [ebp - 0x214], eax
inc eax
cmp eax, 3
jl 0x100085cf
push esi
push esi
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], 6
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 7
jge 0x10008663
mov eax, dword [ebp - 0x220]
and eax, reloc.WS2_32.dll_accept
jns 0x10008648
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10008655
inc dword [ebp - 0x214]
jmp 0x1000865b
dec dword [ebp - 0x214]
inc dword [ebp - 0x220]
jmp 0x1000862d
mov dword [ebp - 4], 0xfffffffe
call fcn.100086a5
mov dword [ebp - 4], 7
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 8
jge 0x100086ce
mov eax, dword [ebp - 0x228]
and eax, reloc.WS2_32.dll_accept
jns 0x10008698
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100086c0
inc dword [ebp - 0x214]
jmp 0x100086c6
dec dword [ebp - 0x214]
inc dword [ebp - 0x228]
jmp 0x1000867d
mov dword [ebp - 4], 0xfffffffe
call fcn.100086f6
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop esi
idiv esi
cmp edx, 1
je 0x10008711
cmp edx, 4
je 0x10008711
and dword [ebp - 0x214], ecx
jmp 0x10008717
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 8
jl 0x100086dc
mov edi, 0xfa
push edi
lea eax, [ebp - 0x210]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call esi
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x1000874e
cmp edx, 4
je 0x1000874e
and dword [ebp - 0x214], ecx
jmp 0x10008756
nop
nop
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x10008734
xor ecx, ecx
mov eax, ecx
cdq
push 5
pop ebx
idiv ebx
cmp edx, 1
je 0x10008778
cmp edx, 4
je 0x10008778
and dword [ebp - 0x214], ecx
jmp 0x1000877e
sub dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x1000875e
push edi
lea eax, [ebp - 0x210]
push eax
call esi
mov dword [ebp - 4], 8
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x230], 2
jge 0x100087d2
mov eax, dword [ebp - 0x230]
and eax, reloc.WS2_32.dll_accept
jns 0x100087b7
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x100087c4
inc dword [ebp - 0x214]
jmp 0x100087ca
dec dword [ebp - 0x214]
inc dword [ebp - 0x230]
jmp 0x1000879c
mov dword [ebp - 4], 0xfffffffe
call fcn.10008856
xor eax, eax
xor dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x100087e0
cmp dword [ebp - 0x214], 0
jge 0x100087fb
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x10008817
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x214], ecx
cmp ecx, 0xffff0001
jge 0x10008834
imul ecx, ecx, 0xfffffffb
mov dword [ebp - 0x214], ecx
mov eax, ecx
cdq
push 7
pop esi
idiv esi
test edx, edx
je 0x1000884e
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
mov dword [ebp - 0x214], ecx
mov eax, ecx
call fcn.10075d28
ret