Function at 0x6cda90
Capabilities:
Encode data using xor
Resolve function by parsing pe exports
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x770311
mov eax, dword fs:[0]
push eax
sub esp, 0x55c
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x558], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x69bc80]
xor eax, esp
push eax
lea eax, [esp + 0x570]
mov dword fs:[0], eax
mov eax, dword [0x788c90]
test al, 1
jne 0x6ce6ca
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x9c
or eax, 1
push 0
mov dword [0x788c90], eax
mov dword [0x7cacf4], 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
test ebx, ebx
jne 0x6cdb1b
push 0x12
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
call esi
jmp 0x6cdb21
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov dword [ebx], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x6cdb47
push ebx
push eax
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xff
call edi
push eax
call esi
push 1
call fcn.007571ab
add esp, 4
test eax, eax
jne 0x6cdb5c
push 0x1c
call edi
push eax
call esi
call fcn.0075765f
test eax, eax
jne 0x6cdb6c
push 0x10
call edi
push eax
call esi
call fcn.007577ec
test eax, eax
jge 0x6cdb7f
push 0x1b
call fcn.00757abe
add esp, 4
push 1
call fcn.00757b7d
add esp, 4
test eax, eax
je 0x6cdb96
push eax
call fcn.00757abe
add esp, 4
call fcn.006afd90
mov ebp, eax
lea edi, [ebp + 0x30]
mov ecx, 0x27
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
call fcn.006e1700
mov ecx, ebp
call fcn.006e1720
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.006ad030
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
mov dword [edi + 0x1c], eax
call eax
mov dword [ebp + 0x2c], eax
mov eax, 0x601
cmp word [ebp + 6], ax
mov ecx, 0x602
setae al
mov byte [edi + 0x99], al
cmp word [ebp + 6], cx
push 0x400
setae al
mov byte [edi + 0x9a], al
mov esi, 0x788c90
sub esi, dword [0x788c9c]
lea edx, [esp + 0x170]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x16c]
push eax
lea ecx, [ebp + 8]
mov dword [ebp + 0x28], esi
call fcn.006ebe80
push 0xf0
lea ecx, [esp + 0x6c]
push 0
push ecx
mov dword [esp + 0x164], 0xe
call fcn.00755e40
add esp, 0xc
mov al, 0xe3
lea edx, [esp + 0x15c]
push edx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x57c], 0
mov byte [esp + 0x160], 0xd6
mov byte [esp + 0x161], 0xa5
mov byte [esp + 0x162], al
mov byte [esp + 0x163], 0x74
mov byte [esp + 0x164], 0x36
mov byte [esp + 0x165], 0xf2
mov byte [esp + 0x166], al
mov byte [esp + 0x167], 0x18
mov byte [esp + 0x168], 0xa6
mov byte [esp + 0x169], 0xab
mov byte [esp + 0x16a], 0xcc
mov byte [esp + 0x16b], 0xa4
mov byte [esp + 0x16c], 0x76
mov byte [esp + 0x16d], 0x95
mov byte [esp + 0x16e], 0x69
mov byte [esp + 0x16f], 0x73
call fcn.006f5ed0
lea ecx, [esp + 0x58]
call fcn.006f5380
push 0x40f50
push 0x788da0
push 0x788da0
lea ecx, [esp + 0x64]
call fcn.006f58d0
push 0x788da0
lea ecx, [esp + 0x5c]
call fcn.006f5ed0
lea ecx, [esp + 0x58]
call fcn.006f5380
push 0x30
push 0x78ac24
push 0x78ac24
lea ecx, [esp + 0x64]
call fcn.006f58d0
mov ecx, edi
call fcn.006cebe0
test al, al
jne 0x6cdd58
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x788c90]
shr eax, 0xa
test al, 1
je 0x6cddd5
cmp dword [edi + 0x218], 0
je 0x6cddd5
lea ecx, [esp + 0x16c]
push ecx
lea ecx, [esp + 0x3c]
call fcn.006f3070
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x57c], 1
call fcn.006f31e0
cmp dword [eax + 0x1c], 0x10
mov byte [esp + 0x578], 2
jb 0x6cdda7
mov eax, dword [eax + 8]
jmp 0x6cddaa
add eax, 8
push eax
mov eax, dword [edi + 0x218]
call eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x578], 1
call fcn.007158a0
lea ecx, [esp + 0x38]
mov byte [esp + 0x578], 0
call fcn.007158a0
call fcn.006c9120
mov ebx, 0x800000
test dword [0x78ac24], ebx
jne 0x6cde3a
mov esi, dword [0x7cad00]
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0xc]
add esi, 0x98
mov ecx, esi
call eax
int3
mov ecx, ebp
call fcn.006e16a0
mov ecx, dword [0x788c90]
shr ecx, 1
test cl, 1
jne 0x6cde79
mov edx, 0xd6a5e374
mov eax, 0x788ca0
mov esi, 0x40
lea ecx, [ecx]
mov ecx, dword [eax]
mov ebx, ecx
xor ebx, edx
mov dword [eax], ebx
add eax, 4
sub esi, 1
mov edx, ecx
jne 0x6cde60
or dword [0x788c90], 2
call fcn.006b6570
test dword [0x78ac24], 0x800000
mov ebx, eax
jne 0x6cdeb0
mov esi, dword [0x7cad00]
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0xc]
add esi, 0x98
mov ecx, esi
call eax
invalid
push 0x788c90
mov ecx, ebx
call fcn.006c9290
test al, al
jne 0x6cdf4f
mov ecx, dword [0x7cad6c]
xor esi, esi
cmp ecx, esi
je 0x6cdede
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x7cad6c], esi
mov ecx, dword [0x7cad24]
cmp ecx, esi
je 0x6cdef6
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x7cad24], esi
mov ecx, dword [0x7cad70]
cmp ecx, esi
je 0x6cdf0e
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x7cad70], esi
mov ecx, dword [0x7cad68]
cmp ecx, esi
je 0x6cdf26
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x7cad68], esi
mov ecx, dword [0x7cbdcc]
cmp ecx, esi
je 0x6ce7a9
mov edi, ecx
call fcn.00736320
push edi
call fcn.00755e35
add esp, 4
mov dword [0x7cbdcc], esi
jmp 0x6ce7a9
mov ecx, dword [0x788c90]
shr ecx, 8
test cl, 1
jne 0x6cdf8a
mov edx, dword [ebx + 0x54]
shr edx, 0x17
test dl, 1
jne 0x6cdf8a
cmp dword [edi + 0xb0], 0
je 0x6cdf8a
mov eax, dword [edi + 0xb8]
push 0
call eax
mov ecx, dword [edi + 0xb0]
push 0x6cbda0
push 1
call ecx
test dword [0x78ac24], 0x800000
jne 0x6cdfba
mov esi, dword [0x7cad00]
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0xc]
add esi, 0x98
mov ecx, esi
call eax
invalid
cmp dword [0x788db0], 0
jbe 0x6ce4c7
mov esi, dword [0x788db4]
mov ecx, dword [ebp + 0x2c]
lea esi, [esi + 0x7b7cf0]
mov dword [esi], ecx
mov dword [esi + 4], 0x6cbc10
mov dword [esi + 8], 0x6cb2e0
mov dword [esi + 0xc], 0x6cda70
test dword [0x78ac24], 0x800000
jne 0x6ce01b
mov eax, dword [0x7cad00]
mov edx, dword [eax + 0x98]
lea edi, [eax + 0x98]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
int3
mov dword [esi + 0x10], 0x6e3a90
mov dword [esi + 0x14], fcn.006e2fb0
mov dword [esi + 0x18], 0x6e3ab0
mov dword [esi + 0x1c], fcn.006e3020
mov dword [esi + 0x20], 0x6e3ad0
mov dword [esi + 0x24], fcn.006e3090
mov dword [esi + 0x28], 0x6e3af0
mov dword [esi + 0x2c], fcn.006e3130
mov dword [esi + 0x30], 0x6e3b10
mov dword [esi + 0x34], fcn.006e3190
mov dword [esi + 0x38], 0x6e25a0
mov dword [esi + 0x3c], 0x6e3b30
mov dword [esi + 0x40], fcn.006e3280
mov dword [esi + 0x44], 0x6e3b50
mov dword [esi + 0x48], fcn.006e32f0
mov dword [esi + 0x4c], fcn.006e3360
mov dword [esi + 0x50], 0x6e33e0
mov dword [esi + 0x54], fcn.006e3450
mov dword [esi + 0x58], 0x6e34d0
mov dword [esi + 0x5c], 0x6e3540
mov dword [esi + 0x60], 0x6e3b70
mov dword [esi + 0x64], fcn.006e3570
mov dword [esi + 0x68], 0x6e3b90
mov dword [esi + 0x6c], fcn.006e35f0
mov dword [esi + 0x70], fcn.006e3670
mov dword [esi + 0x74], fcn.006e3750
mov dword [esi + 0x78], fcn.006e3820
mov dword [esi + 0x7c], fcn.006e38c0
mov dword [esi + 0x80], 0x6f00e0
mov dword [esi + 0x84], 0x6f1110
mov dword [esi + 0x88], 0x6ef7e0
mov dword [esi + 0x8c], 0x6f0b10
mov dword [esi + 0x90], 0x6ef900
mov dword [esi + 0x94], 0x6f0430
mov dword [esi + 0x98], 0x6f0540
mov dword [esi + 0x9c], 0x6f1240
mov dword [esi + 0xa0], 0x6ee3e0
mov dword [esi + 0xa4], 0x6edde0
mov dword [esi + 0xa8], 0x6edf00
mov dword [esi + 0xac], fcn.006f0650
mov dword [esi + 0xb0], 0x6f09f0
mov dword [esi + 0xb4], 0x6edc20
mov dword [esi + 0xb8], 0x6f0e90
mov dword [esi + 0xbc], 0x6ef240
mov dword [esi + 0xc0], fcn.006ef360
mov dword [esi + 0xc4], 0x6ef480
mov dword [esi + 0xc8], 0x6ef5a0
mov dword [esi + 0xcc], 0x6ef120
mov dword [esi + 0xd0], 0x6f1360
mov dword [esi + 0xd4], 0x6f15e0
mov dword [esi + 0xd8], fcn.006f1700
mov dword [esi + 0xdc], fcn.006f1b70
mov dword [esi + 0xe0], fcn.006f1bf0
mov dword [esi + 0xe4], 0x6f1820
mov dword [esi + 0xe8], 0x6f0d50
mov dword [esi + 0xec], 0x6efa20
mov dword [esi + 0xf0], 0x6ee500
mov dword [esi + 0xf4], 0x6f0c30
mov dword [esi + 0xf8], 0x6f1940
mov dword [esi + 0xfc], 0x6f1a60
mov dword [esi + 0x100], 0x6eec50
mov dword [esi + 0x104], fcn.006ee030
mov dword [esi + 0x108], fcn.006f0320
mov dword [esi + 0x10c], 0x6edcc0
mov dword [esi + 0x110], 0x6ef6c0
mov dword [esi + 0x114], fcn.006edc80
mov dword [esi + 0x118], 0x6ee8f0
mov dword [esi + 0x11c], 0x6ee170
mov dword [esi + 0x120], 0x6efb40
mov dword [esi + 0x124], fcn.006f0fb0
mov dword [esi + 0x128], fcn.006f0200
mov dword [esi + 0x12c], fcn.006f1bf0
mov dword [esi + 0x130], 0x6ee640
mov dword [esi + 0x134], 0x6ee780
mov dword [esi + 0x138], 0x6eea10
mov dword [esi + 0x13c], 0x6eeb30
mov dword [esi + 0x140], 0x6eed70
mov dword [esi + 0x144], 0x6eeea0
mov dword [esi + 0x148], 0x6ee2a0
mov dword [esi + 0x14c], 0x6efc70
mov dword [esi + 0x150], 0x6eefd0
mov dword [esi + 0x154], 0x6f06e0
mov dword [esi + 0x158], 0x6edc50
mov dword [esi + 0x15c], 0x6f14a0
mov dword [esi + 0x160], fcn.006efd90
mov dword [esi + 0x164], fcn.006efed0
mov dword [esi + 0x168], fcn.006effe0
mov dword [esi + 0x16c], 0x6f1d10
mov dword [esi + 0x170], 0x6f1e10
mov dword [esi + 0x174], 0x6f1f00
mov dword [esi + 0x178], 0x74ade0
mov dword [esi + 0x17c], 0x74b410
mov dword [esi + 0x180], 0x74b400
mov dword [esi + 0x184], 0x74b410
mov dword [esi + 0x188], 0x74b400
mov dword [esi + 0x18c], 0x74b420
mov dword [esi + 0x190], 0x74b800
mov dword [esi + 0x194], 0x74c6a0
mov dword [esi + 0x198], 0x74ce40
mov dword [esi + 0x19c], 0x74da70
mov dword [esi + 0x1a0], 0x74db10
mov dword [esi + 0x1a4], 0x74a610
mov dword [esi + 0x1a8], 0x74a7e0
mov dword [esi + 0x1ac], 0x74a3d0
mov dword [esi + 0x1b0], 0x74daf0
mov dword [esi + 0x1b4], 0x74e590
mov dword [esi + 0x1b8], 0x74b830
mov dword [esi + 0x1bc], 0x74e8e0
mov dword [esi + 0x1c0], fcn.0074c300
mov dword [esi + 0x1c4], fcn.0074ae00
mov dword [esi + 0x1c8], 0x74cc10
mov dword [esi + 0x1cc], 0x74e450
mov dword [esi + 0x1d0], 0x74e7d0
mov dword [esi + 0x1d4], 0x74b0e0
mov dword [esi + 0x1d8], 0x74b4f0
mov dword [esi + 0x1dc], 0x74b570
mov dword [esi + 0x1e0], 0x74adf0
mov dword [esi + 0x1e4], 0x74e220
mov dword [esi + 0x1e8], 0x74e2a0
mov dword [esi + 0x1ec], 0x74e320
mov dword [esi + 0x1f0], 0x74e3c0
mov dword [esi + 0x1f4], fcn.0074b9d0
mov dword [esi + 0x1f8], fcn.0074bee0
mov dword [esi + 0x1fc], 0x74a340
mov dword [esi + 0x200], fcn.0074b7b0
mov dword [esi + 0x204], 0x74de90
mov dword [esi + 0x208], 0x74dfc0
mov dword [esi + 0x20c], 0x74e0f0
test dword [0x78ac24], 0x800000
jne 0x6ce4fc
mov esi, dword [0x7cad00]
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0xc]
add esi, 0x98
mov ecx, esi
call eax
mov byte [0], 0x54
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ecx, dword [ebx + 0x54]
mov edx, dword [0x788da8]
mov eax, dword [0x788dac]
shr ecx, 0x11
and cl, 1
push edx
lea ecx, [eax + 0x7b7cf0]
sete dl
push ecx
mov ecx, dword [0x788de4]
movzx eax, dl
push eax
push ecx
call fcn.006cda00
mov ecx, eax
call fcn.006de430
xor esi, esi
mov ecx, ebx
mov dword [0x788de4], esi
mov dword [0x788da8], esi
call fcn.006b75c0
mov edx, dword [ebx + 0x54]
shr edx, 2
test dl, 1
je 0x6ce589
mov eax, dword [0x788dc0]
mov ecx, dword [0x788dc4]
push eax
mov eax, dword [0x78ac44]
lea edx, [ecx + 0x7b7cf0]
push edx
push eax
call fcn.006cd960
mov ecx, eax
call fcn.006d6740
mov dword [0x78ac44], esi
mov dword [0x788dc0], esi
mov dword [0x788dc4], esi
mov eax, dword [ebx + 0x54]
mov ecx, eax
shr ecx, 3
test cl, 1
je 0x6ce5a6
mov ebx, eax
shr ebx, 0x12
and bl, 1
call fcn.006ca350
mov byte [eax + 5], bl
cmp dword [ebp + 0x40], 1
jne 0x6ce5dd
test dword [0x78ac24], 0x800000
jne 0x6ce5dd
mov esi, dword [0x7cad00]
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0xc]
add esi, 0x98
mov ecx, esi
call eax
in ax, 0x64
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ecx, dword [0x788dd0]
mov edx, dword [0x788dcc]
mov eax, dword [0x788dc8]
push ecx
push edx
push eax
push 0x788ca0
call fcn.006cb300
mov ecx, eax
call fcn.006cb7e0
test dword [0x788dd4], 0x10000000
je 0x6ce633
mov ecx, dword [0x7cc75c]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
inc dword [eax + 0xe5138]
push 0xd
call fcn.007552be
add esp, 4
mov dword [0x788dc8], eax
xor eax, eax
test dword [0x78ac24], 0x800000
mov dword [0x788dcc], eax
mov dword [0x788dd0], eax
jne 0x6ce674
mov esi, dword [0x7cad00]
mov eax, dword [esi + 0x98]
mov edx, dword [eax + 0xc]
add esi, 0x98
mov ecx, esi
call edx
mov byte [0], 0x58
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
call fcn.006afd90
mov eax, dword [eax + 0x28]
add eax, dword [0x788de0]
mov dword [0x7cacf0], eax
cmp dword [ebp + 0x40], 1
jne 0x6ce7b3
test dword [0x78ac24], 0x800000
jne 0x6ce7b3
mov eax, dword [0x7cad00]
mov edx, dword [eax + 0x98]
lea esi, [eax + 0x98]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
in ax, 0x64
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
jmp 0x6ce7b3
shr eax, 8
test al, 1
je 0x6ce7b3
mov ecx, dword [0x78ac24]
shr ecx, 4
test cl, 1
jne 0x6ce7b3
cmp dword [esp + 0x580], 0
jne 0x6ce7b3
call fcn.006ca350
mov ecx, eax
call fcn.006ba3a0
mov ecx, dword [0x7cad30]
test ecx, ecx
je 0x6ce710
call fcn.006dda20
cmp dword [0x7cad24], 0
je 0x6ce727
call fcn.006b6570
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
call fcn.006c9a00
call fcn.006ca130
call fcn.006c9ac0
call fcn.006c9ae0
call fcn.006c9aa0
call fcn.006c9a40
call fcn.006c9a20
call fcn.006c9b30
call fcn.006c9f60
call fcn.006c99c0
call fcn.006c99e0
cmp dword [0x7cc754], 0
jne 0x6ce76c
call fcn.00757d44
cmp dword [esp + 0x584], 0
jne 0x6ce7b3
or esi, 0xffffffff
cmp dword [0x69bcf4], esi
je 0x6ce79f
call fcn.006ad030
mov eax, dword [eax + 0xd0]
test eax, eax
je 0x6ce799
mov ecx, dword [0x69bcf4]
push ecx
call eax
mov dword [0x69bcf4], esi
call fcn.006c9b00
call fcn.00757a40
call fcn.00757379
call fcn.007571db
mov ecx, dword [esp + 0x570]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x558]
xor ecx, esp
call fcn.007562ca
add esp, 0x568
ret