Function at 0x10007690
Capabilities:
Allocate or change rwx memory
Create directory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.Logs
call esi
push 0
push str.ScreenShots
call esi
call fcn.10007450
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0x12441fd
mov dword [esp + 0x14], 0xc
nop dword [eax]
mov bl, byte [esi + 0xedca503]
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push esi
call edi
lea eax, [esp + 0x10]
mov byte [esi], bl
push eax
push dword [esp + 0x14]
push 1
push esi
call edi
inc esi
sub dword [esp + 0x14], 1
jne 0x100076d0
mov dword [esp + 0x10], 0
xor eax, eax
mov esi, 0x501ea3
nop dword [eax]
mov bl, byte [eax + 0x1000e55c]
lea eax, [esp + 0x14]
push eax
push 0x40
push 1
push esi
call edi
lea eax, [esp + 0x14]
mov byte [esi], bl
push eax
push dword [esp + 0x18]
push 1
push esi
call edi
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
shl eax, 3
mov esi, dword [eax + 0x1000e558]
test esi, esi
jne 0x10007710
mov dword [esp + 0x10], esi
xor eax, eax
mov ebx, 0xdbbde5
nop dword [eax]
nop word [eax + eax]
mov edi, dword [eax + 0x1000e500]
mov esi, dword [eax + 0x1000e4fc]
lea eax, [esp + 0x14]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push esi
push ebx
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x20]
add esp, 0xc
push eax
push dword [esp + 0x18]
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
lea eax, [eax + eax*2]
shl eax, 2
mov ebx, dword [eax + 0x1000e4f8]
test ebx, ebx
jne 0x10007760
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push 0x50ea4e
call esi
lea eax, [esp + 0x14]
mov dword [0x50ea4e], 0x10013d80
push eax
push dword [esp + 0x18]
push 4
push 0x50ea4e
call esi
lea eax, [esp + 0x14]
push eax
push 0x40
push 0xe
push 0x181d3d0
call esi
movq xmm0, qword [0x10013dec]
mov ecx, 0x181d3d0
movq qword [ecx], xmm0
mov eax, dword [0x10013df4]
mov dword [ecx + 8], eax
mov ax, word [0x10013df8]
mov word [ecx + 0xc], ax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 0xe
push ecx
call esi
mov bl, byte [0x10013de4]
lea eax, [esp + 0x14]
push eax
push 0x40
push 1
push 0x1826e38
inc bl
call esi
lea eax, [esp + 0x14]
mov byte [0x1826e38], bl
push eax
push dword [esp + 0x18]
push 1
push 0x1826e38
call esi
mov bl, byte [0x10013de6]
lea eax, [esp + 0x14]
push eax
push 0x40
push 1
push 0x1826e39
add bl, 2
call esi
lea eax, [esp + 0x14]
mov byte [0x1826e39], bl
push eax
push dword [esp + 0x18]
push 1
push 0x1826e39
call esi
mov bl, byte [0x10013de7]
lea eax, [esp + 0x14]
push eax
push 0x40
push 1
push 0x1826e3a
add bl, 3
call esi
lea eax, [esp + 0x14]
mov byte [0x1826e3a], bl
push eax
push dword [esp + 0x18]
push 1
push 0x1826e3a
call esi
mov bl, byte [0x10013de9]
lea eax, [esp + 0x14]
add bl, 4
push eax
push 0x40
push 1
push 0x1826e3b
call esi
lea eax, [esp + 0x14]
mov byte [0x1826e3b], bl
push eax
push dword [esp + 0x18]
push 1
push 0x1826e3b
call esi
mov bl, byte [0x10013dea]
lea eax, [esp + 0x14]
push eax
push 0x40
push 1
push 0x1826e3c
add bl, 5
call esi
lea eax, [esp + 0x14]
mov byte [0x1826e3c], bl
push eax
push dword [esp + 0x18]
push 1
push 0x1826e3c
call esi
push fcn.10005200
push 0xceb249
push 0xff
call fcn.1000b4d0
push fcn.10005200
push 0xceb37c
push 0xff
call fcn.1000b4d0
push fcn.10005200
push 0xceb415
push 0xff
call fcn.1000b4d0
push fcn.10009490
push 0xd5dd56
push 0xff
call fcn.1000b4d0
call fcn.10005b80
push 0x10005a40
push 0x5d2503
push 0xe8
mov dword [0x10015e38], 0
mov dword [0x10015e3c], 0
call fcn.1000b4d0
add esp, 0x3c
mov eax, 0xcf65cf
xor esi, esi
nop word [eax + eax]
push 0x10005bc0
push eax
push 0xe8
call fcn.1000b4d0
lea esi, [esi + 1]
add esp, 0xc
mov eax, dword [esi*4 + 0x1000e4b8]
test eax, eax
jne 0x100079a0
xor esi, esi
mov eax, 0x508676
nop dword [eax + eax]
push 0x10004c10
push eax
push 0xe8
call fcn.1000b4d0
lea esi, [esi + 1]
add esp, 0xc
mov eax, dword [esi*4 + 0x1000e4a4]
test eax, eax
jne 0x100079d0
push 0x10005280
push 0x5da853
push 0xe9
call fcn.1000b4d0
push 0x100059f0
push 0x502116
push 0xe8
call fcn.1000b4d0
push 0x10005290
push 0xd28f35
push 0xe9
call fcn.1000b4d0
push 0x100052f0
push 0x50e7ae
push 0xe8
call fcn.1000b4d0
push 0x10006330
push 0xaa6713
push 0xe9
call fcn.1000b4d0
push 0x100063d0
push 0xaa5477
push 0xe9
call fcn.1000b4d0
add esp, 0x48
push 0x100064f0
push 0x870072
push 0xe9
call fcn.1000b4d0
push 0x10009410
push 0xc56c0b
push 0xe9
call fcn.1000b4d0
push 0x10009420
push 0xc56c3f
push 0xe9
call fcn.1000b4d0
push 0x10009430
push 0xc56ca7
push 0xe9
call fcn.1000b4d0
push 0x10009440
push 0xc56c73
push 0xe9
call fcn.1000b4d0
push 0x10009450
push 0xc56c25
push 0xe9
call fcn.1000b4d0
add esp, 0x48
push 0x10009460
push 0xc56c59
push 0xe9
call fcn.1000b4d0
push 0x10009470
push 0xc56cc1
push 0xe9
call fcn.1000b4d0
push 0x10009480
push 0xc56c8d
push 0xe9
call fcn.1000b4d0
push 0x1000b270
xorps xmm0, xmm0
push 0x50f060
push 0xe9
movups xmmword [0x10015e28], xmm0
call fcn.1000b4d0
push 0x1000b2a0
push 0xcebad5
push 0xe9
call fcn.1000b4d0
add esp, 0x3c
mov eax, 0x45ffad
xor esi, esi
nop
push 0x1000b210
push eax
push 0xe8
call fcn.1000b4d0
lea esi, [esi + 1]
add esp, 0xc
mov eax, dword [esi*4 + 0x1000e840]
test eax, eax
jne 0x10007b60
push 0x1000a9c0
push 0x88a8de
push 0xe8
call fcn.1000b4d0
add esp, 0xc
call fcn.10008ff0
mov eax, dword [str.0123456789QRWEqrwe]
xor ebx, ebx
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, str.0123456789QRWEqrwe
mov byte [0x100120cc], 0
mov dword [0x100120d0], 0
mov byte [0x100120d4], 0
mov dword [0x100120d8], 0
add eax, 0xffffffd0
cmp eax, 0x47
ja case.0x10007be0.58
movzx eax, byte [eax + 0x10007c94]
jmp dword [eax*4 + 0x10007c88]
xor eax, eax
jmp 0x10007bf0
mov eax, 4
mov dword [esp + 0x14], eax
call ecx
mov esi, eax
mov ecx, 0x100120e8
lea eax, [esp + 0x14]
push eax
call fcn.10001620
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [eax], esi
jmp 0x10007c19
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [edi]
add eax, 0xffffffd0
cmp eax, 0x47
ja case.0x10007c2a.58
movzx eax, byte [eax + 0x10007ce8]
jmp dword [eax*4 + 0x10007cdc]
xor eax, eax
jmp 0x10007c3a
mov eax, 4
mov dword [esp + 0x14], eax
call ecx
mov esi, eax
mov ecx, 0x100120e0
lea eax, [esp + 0x14]
push eax
call fcn.10001620
mov dword [eax], esi
jmp 0x10007c5d
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [sym.imp.KERNEL32.dll_GetTickCount]
inc ebx
mov eax, dword [ebx*4 + str.0123456789QRWEqrwe]
lea edi, [ebx*4 + str.0123456789QRWEqrwe]
test eax, eax
jne 0x10007bd1
call fcn.10008ff0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret