Function at 0x1002c2d0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.10032c80
mov eax, dword [0x1003f00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1003f8dc]
movaps xmm0, xmmword [0x1003b7a0]
push ebx
push esi
mov esi, dword [eax + ecx*4]
mov eax, dword [0x10112a8c]
push edi
movups xmmword [ebp - 0x1034], xmm0
mov dword [ebp - 0x1024], 0x242f382d
mov dword [ebp - 0x1020], 0x380d2205
mov word [ebp - 0x101c], 0x4c36
cmp eax, dword [esi + 4]
jle 0x1002c377
push 0x10112a8c
call fcn.10031abc
add esp, 4
cmp dword [0x10112a8c], 0xffffffff
jne 0x1002c377
push 0x1a
lea eax, [ebp - 0x1034]
push eax
push 0x10113308
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x10034bf0
call fcn.10031ee1
add esp, 4
push 0x10112a8c
call fcn.10031a72
add esp, 4
cmp byte [0x10113321], 0
je 0x1002c3ad
movups xmm0, xmmword [0x10113308]
mov eax, 0x10
movaps xmm1, xmmword [0x1003be00]
pxor xmm1, xmm0
movups xmmword [0x10113308], xmm1
nop
xor byte [eax + 0x10113308], 0x4c
inc eax
cmp eax, 0x1a
jb 0x1002c3a0
push 0x10113308
call fcn.1002cfa0
movaps xmm0, xmmword [0x1003b680]
add esp, 4
mov eax, dword [0x10112fb4]
movups xmmword [ebp - 0x103c], xmm0
mov dword [ebp - 0x101c], 0x1605001b
movaps xmm0, xmmword [0x1003b630]
movups xmmword [ebp - 0x102c], xmm0
mov byte [ebp - 0x1018], 0x4c
cmp eax, dword [esi + 4]
jle 0x1002c43a
push 0x10112fb4
call fcn.10031abc
add esp, 4
cmp dword [0x10112fb4], 0xffffffff
jne 0x1002c43a
push 0x25
lea eax, [ebp - 0x103c]
push eax
push 0x10112634
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x10034ba0
call fcn.10031ee1
add esp, 4
push 0x10112fb4
call fcn.10031a72
add esp, 4
cmp byte [0x10112658], 0
je 0x1002c47f
movaps xmm2, xmmword [0x1003be00]
xor eax, eax
nop dword [eax]
movups xmm0, xmmword [eax + 0x10112634]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax + 0x10112634], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x1002c450
cmp eax, 0x25
jae 0x1002c47f
xor byte [eax + 0x10112634], 0x4c
inc eax
cmp eax, 0x25
jb 0x1002c472
mov eax, dword [0x10113580]
mov dword [ebp - 0x1014], 0xd180901
mov dword [ebp - 0x1010], 0x5000f6c
mov dword [ebp - 0x100c], 0x4c180209
cmp eax, dword [esi + 4]
jle 0x1002c4f5
push 0x10113580
call fcn.10031abc
add esp, 4
cmp dword [0x10113580], 0xffffffff
jne 0x1002c4f5
movq xmm0, qword [ebp - 0x1014]
mov eax, dword [ebp - 0x100c]
push 0x10034bd0
movq qword [0x101132f0], xmm0
mov dword [0x101132f8], eax
call fcn.10031ee1
add esp, 4
push 0x10113580
call fcn.10031a72
add esp, 4
cmp byte [0x101132fb], 0
je 0x1002c50d
xor eax, eax
xor byte [eax + 0x101132f0], 0x4c
inc eax
cmp eax, 0xc
jb 0x1002c500
push 0x101132f0
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x10112634
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [0x1004117c]
mov eax, dword [0x10112624]
add edi, 0xd3b84
mov dword [ebp - 0x1010], 0x627f627c
mov word [ebp - 0x100c], 0x4c7b
cmp eax, dword [esi + 4]
jle 0x1002c59a
push 0x10112624
call fcn.10031abc
add esp, 4
cmp dword [0x10112624], 0xffffffff
jne 0x1002c59a
mov eax, dword [ebp - 0x1010]
mov dword [0x10112c28], eax
mov ax, word [ebp - 0x100c]
push 0x10034b90
mov word [0x10112c2c], ax
call fcn.10031ee1
add esp, 4
push 0x10112624
call fcn.10031a72
add esp, 4
mov al, byte [0x10112c2d]
test al, al
je 0x1002c5cd
xor byte [0x10112c28], 0x4c
xor byte [0x10112c29], 0x4c
xor byte [0x10112c2a], 0x4c
xor byte [0x10112c2b], 0x4c
xor byte [0x10112c2c], 0x4c
xor al, 0x4c
mov byte [0x10112c2d], al
push 6
push 0x10112c28
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
call edi
add esp, 0xc
test eax, eax
jne 0x1002c601
call fcn.1002cde0
mov ecx, eax
call fcn.100308c0
push eax
call fcn.1002cfa0
add esp, 4
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebx, dword [0x1004117c]
mov eax, dword [0x101127b4]
add ebx, 0xdb400
mov dword [ebp - 0x1014], 0x3c212d3f
mov dword [ebp - 0x1010], 0x2d2d3f62
mov byte [ebp - 0x103d], 0x4c
cmp eax, dword [esi + 4]
jle 0x1002c680
push 0x101127b4
call fcn.10031abc
add esp, 4
cmp dword [0x101127b4], 0xffffffff
jne 0x1002c680
movq xmm0, qword [ebp - 0x1014]
mov al, byte [ebp - 0x103d]
push 0x10034b40
movq qword [0x101134a0], xmm0
mov byte [0x101134a8], al
call fcn.10031ee1
add esp, 4
push 0x101127b4
call fcn.10031a72
add esp, 4
mov al, byte [0x101134a8]
test al, al
je 0x1002c6c8
xor byte [0x101134a0], 0x4c
xor byte [0x101134a1], 0x4c
xor byte [0x101134a2], 0x4c
xor byte [0x101134a3], 0x4c
xor byte [0x101134a4], 0x4c
xor byte [0x101134a5], 0x4c
xor byte [0x101134a6], 0x4c
xor byte [0x101134a7], 0x4c
xor al, 0x4c
mov byte [0x101134a8], al
push 9
push 0x101134a0
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x1002c7b6
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [0x1004117c]
push 0x40
push 0xa
add eax, 0xd3b84
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x101130f8]
mov dword [ebp - 0x1010], 0x627f627c
mov word [ebp - 0x100c], 0x4c7b
cmp eax, dword [esi + 4]
jle 0x1002c761
push 0x101130f8
call fcn.10031abc
add esp, 4
cmp dword [0x101130f8], 0xffffffff
jne 0x1002c761
mov eax, dword [ebp - 0x1010]
mov dword [0x10112594], eax
mov ax, word [ebp - 0x100c]
push 0x10034b30
mov word [0x10112598], ax
call fcn.10031ee1
add esp, 4
push 0x101130f8
call fcn.10031a72
add esp, 4
mov al, byte [0x10112599]
test al, al
je 0x1002c794
xor byte [0x10112594], 0x4c
xor byte [0x10112595], 0x4c
xor byte [0x10112596], 0x4c
xor byte [0x10112597], 0x4c
xor byte [0x10112598], 0x4c
xor al, 0x4c
mov byte [0x10112599], al
mov edx, dword [0x1004117c]
mov ecx, 0x10112594
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 0xd3b83], al
test al, al
jne 0x1002c7a1
jmp 0x1002cb39
mov ebx, dword [0x10111820]
mov eax, dword [0x10113200]
add ebx, 0xa170
mov dword [ebp - 0x1010], 0x3f2d6266
mov word [ebp - 0x100c], 0x4c25
cmp eax, dword [esi + 4]
jle 0x1002c82a
push 0x10113200
call fcn.10031abc
add esp, 4
cmp dword [0x10113200], 0xffffffff
jne 0x1002c82a
mov eax, dword [ebp - 0x1010]
mov dword [0x10112fc0], eax
mov ax, word [ebp - 0x100c]
push 0x10034b20
mov word [0x10112fc4], ax
call fcn.10031ee1
add esp, 4
push 0x10113200
call fcn.10031a72
add esp, 4
mov al, byte [0x10112fc5]
test al, al
je 0x1002c85d
xor byte [0x10112fc0], 0x4c
xor byte [0x10112fc1], 0x4c
xor byte [0x10112fc2], 0x4c
xor byte [0x10112fc3], 0x4c
xor byte [0x10112fc4], 0x4c
xor al, 0x4c
mov byte [0x10112fc5], al
push 6
push 0x10112fc0
push ebx
call edi
add esp, 0xc
test eax, eax
jne 0x1002c955
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [0x1004117c]
push 0x40
push 0xa
add eax, 0xd3b84
push eax
call ebx
mov eax, dword [0x10112c04]
mov dword [ebp - 0x1010], 0x627f627c
mov word [ebp - 0x100c], 0x4c7b
cmp eax, dword [esi + 4]
jle 0x1002c8f8
push 0x10112c04
call fcn.10031abc
add esp, 4
cmp dword [0x10112c04], 0xffffffff
jne 0x1002c8f8
mov eax, dword [ebp - 0x1010]
mov dword [0x10113010], eax
mov ax, word [ebp - 0x100c]
push 0x10034b10
mov word [0x10113014], ax
call fcn.10031ee1
add esp, 4
push 0x10112c04
call fcn.10031a72
add esp, 4
mov al, byte [0x10113015]
test al, al
je 0x1002c92b
xor byte [0x10113010], 0x4c
xor byte [0x10113011], 0x4c
xor byte [0x10113012], 0x4c
xor byte [0x10113013], 0x4c
xor byte [0x10113014], 0x4c
xor al, 0x4c
mov byte [0x10113015], al
mov edx, dword [0x1004117c]
mov ecx, 0x10113010
sub edx, ecx
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx + 0xd3b83], al
test al, al
jne 0x1002c940
jmp 0x1002ca40
mov ecx, dword [0x10111820]
lea ecx, [ecx + 0xa170]
call fcn.10005f70
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [0x1004117c]
push 0x40
push 0xa
add eax, 0xd3b84
push eax
call ebx
mov eax, dword [0x10112d3c]
mov dword [ebp - 0x1010], 0x62786279
mov word [ebp - 0x100c], 0x4c7d
cmp eax, dword [esi + 4]
jle 0x1002c9ec
push 0x10112d3c
call fcn.10031abc
add esp, 4
cmp dword [0x10112d3c], 0xffffffff
jne 0x1002c9ec
mov eax, dword [ebp - 0x1010]
mov dword [0x10112f5c], eax
mov ax, word [ebp - 0x100c]
push 0x10034b00
mov word [0x10112f60], ax
call fcn.10031ee1
add esp, 4
push 0x10112d3c
call fcn.10031a72
add esp, 4
mov al, byte [0x10112f61]
test al, al
je 0x1002ca1f
xor byte [0x10112f5c], 0x4c
xor byte [0x10112f5d], 0x4c
xor byte [0x10112f5e], 0x4c
xor byte [0x10112f5f], 0x4c
xor byte [0x10112f60], 0x4c
xor al, 0x4c
mov byte [0x10112f61], al
mov edx, dword [0x1004117c]
mov ecx, 0x10112f5c
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx + 0xd3b83], al
test al, al
jne 0x1002ca30
lea eax, [ebp - 0x100c]
push eax
push 0x40
push 4
push 0xc1704c
call ebx
sub esp, 8
mov dword [0xc1704c], 0x1ef
lea edx, [ebp - 0x1008]
mov byte [0xbab318], 0
mov ecx, 0x53e94c
mov byte [ebp - 0x1008], 0
push 1
call fcn.10005fc0
mov eax, dword [0x1011300c]
add esp, 0xc
mov dword [ebp - 0x1010], 0x62081904
mov dword [ebp - 0x100c], 0x4c081418
cmp eax, dword [esi + 4]
jle 0x1002cae3
push 0x1011300c
call fcn.10031abc
add esp, 4
cmp dword [0x1011300c], 0xffffffff
jne 0x1002cae3
movq xmm0, qword [ebp - 0x1010]
push 0x10034af0
movq qword [0x101128dc], xmm0
call fcn.10031ee1
add esp, 4
push 0x1011300c
call fcn.10031a72
add esp, 4
mov al, byte [0x101128e3]
test al, al
je 0x1002cb24
xor byte [0x101128dc], 0x4c
xor byte [0x101128dd], 0x4c
xor byte [0x101128de], 0x4c
xor byte [0x101128df], 0x4c
xor byte [0x101128e0], 0x4c
xor byte [0x101128e1], 0x4c
xor byte [0x101128e2], 0x4c
xor al, 0x4c
mov byte [0x101128e3], al
push 8
push 0x101128dc
push 0x86a664
call edi
add esp, 0xc
test eax, eax
jne 0x1002cb41
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x100c]
push eax
push 0x40
push 0xa
push 0x86a664
call ebx
mov eax, dword [0x10112ee8]
mov dword [ebp - 0x1010], 0x6216180d
mov dword [ebp - 0x100c], 0x4c283438
cmp eax, dword [esi + 4]
jle 0x1002cbb4
push 0x10112ee8
call fcn.10031abc
add esp, 4
cmp dword [0x10112ee8], 0xffffffff
jne 0x1002cbb4
movq xmm0, qword [ebp - 0x1010]
push 0x10034ae0
movq qword [0x10112a20], xmm0
call fcn.10031ee1
add esp, 4
push 0x10112ee8
call fcn.10031a72
add esp, 4
mov al, byte [0x10112a27]
test al, al
je 0x1002cbf5
xor byte [0x10112a20], 0x4c
xor byte [0x10112a21], 0x4c
xor byte [0x10112a22], 0x4c
xor byte [0x10112a23], 0x4c
xor byte [0x10112a24], 0x4c
xor byte [0x10112a25], 0x4c
xor byte [0x10112a26], 0x4c
xor al, 0x4c
mov byte [0x10112a27], al
mov ecx, 0x10112a20
mov edx, 0x86a664
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1002cc01
movaps xmm0, xmmword [0x1003b830]
mov eax, dword [0x10113128]
movups xmmword [ebp - 0x1038], xmm0
mov dword [ebp - 0x1028], 0x180d6c2b
mov dword [ebp - 0x1024], 0x282d1e16
mov dword [ebp - 0x1020], 0x25283e2d
mov word [ebp - 0x101c], 0x2f3f
mov byte [ebp - 0x101a], 0x4c
cmp eax, dword [esi + 4]
jle 0x1002cc9d
push 0x10113128
call fcn.10031abc
add esp, 4
cmp dword [0x10113128], 0xffffffff
jne 0x1002cc9d
push 0x1f
lea eax, [ebp - 0x1038]
push eax
push 0x101127d4
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push 0x10034ab0
call fcn.10031ee1
add esp, 4
push 0x10113128
call fcn.10031a72
add esp, 4
cmp byte [0x101127f2], 0
je 0x1002ccd1
movups xmm0, xmmword [0x101127d4]
mov eax, 0x10
movaps xmm1, xmmword [0x1003be00]
pxor xmm1, xmm0
movups xmmword [0x101127d4], xmm1
xor byte [eax + 0x101127d4], 0x4c
inc eax
cmp eax, 0x1f
jb 0x1002ccc4
push 0x101127d4
call fcn.1002cfa0
add esp, 4
lea eax, [ebp - 0x100c]
push eax
push 0x40
push 0xa
push 0x86a4b4
call ebx
mov eax, dword [0x10113444]
mov dword [ebp - 0x1014], 0x1e16180d
mov dword [ebp - 0x1010], 0x3e2d282d
mov word [ebp - 0x100c], 0x4c2f
cmp eax, dword [esi + 4]
jle 0x1002cd67
push 0x10113444
call fcn.10031abc
add esp, 4
cmp dword [0x10113444], 0xffffffff
jne 0x1002cd67
movq xmm0, qword [ebp - 0x1014]
mov ax, word [ebp - 0x100c]
push 0x10034a90
movq qword [0x101128e4], xmm0
mov word [0x101128ec], ax
call fcn.10031ee1
add esp, 4
push 0x10113444
call fcn.10031a72
add esp, 4
mov al, byte [0x101128ed]
test al, al
je 0x1002cdb6
xor byte [0x101128e4], 0x4c
xor byte [0x101128e5], 0x4c
xor byte [0x101128e6], 0x4c
xor byte [0x101128e7], 0x4c
xor byte [0x101128e8], 0x4c
xor byte [0x101128e9], 0x4c
xor byte [0x101128ea], 0x4c
xor byte [0x101128eb], 0x4c
xor byte [0x101128ec], 0x4c
xor al, 0x4c
mov byte [0x101128ed], al
mov ecx, 0x101128e4
mov edx, 0x86a4b4
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1002cdc2
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031912
mov esp, ebp
pop ebp
ret