Function at 0x1006b720
Capabilities:
Encode data using xor
Execute command
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e57be
mov eax, dword fs:[0]
push eax
sub esp, 0x1f4
mov eax, dword [0x10276bc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movq xmm0, qword [str.C:DLL_KEy.lic]
xor eax, eax
mov word [ebp - 0x1a], ax
mov eax, dword [0x1025ed48]
mov dword [ebp - 0x20], eax
mov ax, word [0x1025ed4c]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0xe
push eax
mov dword [ebp - 0x14], 0xf
movq qword [ebp - 0x28], xmm0
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
mov ecx, dword [ebp - 0x14]
add esp, 8
test eax, eax
sete al
mov byte [ebp - 0x89], al
cmp ecx, 0x10
jb 0x1006b7da
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006b7ca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006b7ca
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101df293
mov al, byte [ebp - 0x89]
add esp, 8
test al, al
je 0x1006bc8d
sub esp, 8
lea ecx, [ebp - 0x150]
push 1
push str.C:DLL_KEy.lic
call fcn.10050390
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x150]
mov eax, dword [ebp - 0x150]
push 0xa
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
push eax
lea ecx, [ebp - 0x150]
call fcn.1007d7b0
add esp, 4
lea ecx, [ebp - 0x140]
call fcn.10050310
test eax, eax
jne 0x1006b84e
mov eax, dword [ebp - 0x150]
lea ecx, [ebp - 0x150]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
cmp dword [0x1027810c], 0
je 0x1006b87e
cmp dword [0x10278110], 0x10
mov ecx, 0x102780fc
mov edx, 0x102b6c30
cmovae ecx, dword [0x102780fc]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1006b871
sub esp, 0x18
mov ecx, esp
push 0x102780fc
call fcn.1004ee30
lea eax, [ebp - 0x28]
mov ecx, 0x102a21f8
push eax
call fcn.10066ea0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x1006b8a6
mov eax, dword [eax]
push 4
push str.Azef
push ecx
push eax
call fcn.100533a0
mov ecx, dword [ebp - 0x14]
add esp, 0x10
mov byte [ebp - 0x89], al
cmp ecx, 0x10
jb 0x1006b8f9
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006b8e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006b8e9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101df293
mov al, byte [ebp - 0x89]
add esp, 8
test al, al
je 0x1006bba4
mov ecx, 0x102783fc
cmp ecx, 0x102780fc
je 0x1006b92d
cmp dword [0x10278110], 0x10
mov eax, 0x102780fc
push dword [0x1027810c]
cmovae eax, dword [0x102780fc]
push eax
call fcn.100505b0
cmp dword [0x10278110], 0x10
mov ecx, 0x102780fc
mov edx, dword [0x1027810c]
cmovae ecx, dword [0x102780fc]
push 6
push str.GLITCH
push 0
call fcn.10079870
add esp, 0xc
cmp eax, 0xffffffff
je 0x1006b96a
mov byte [0x10280e40], 1
mov eax, str.Glitch_Bypass
jmp 0x1006b96f
mov eax, str.Normal_Bypass
push 0xd
push eax
mov ecx, 0x102780cc
call fcn.100505b0
push 0x102a2270
push str._a___d._m._Y__H:_M:_S
lea eax, [ebp - 0x78]
push 0x20
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x14], 0
add esp, 0x10
lea edx, [ecx + 1]
movups xmmword [ebp - 0x28], xmm0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006b9b0
sub ecx, edx
lea eax, [ebp - 0x78]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10052750
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
mov dword [ebp - 0x90], esp
push 6
movups xmmword [eax], xmm0
push str._Done_
push eax
mov dword [eax + 0x10], 6
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
sub esp, 0xc
mov byte [ebp - 4], 2
mov eax, esp
xorps xmm0, xmm0
push 5
movups xmmword [eax], xmm0
push str.Login
push eax
mov dword [eax + 0x10], 5
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [ebp - 4], 1
mov edx, 0xa
mov ecx, edx
call fcn.10069910
push 0x102780fc
lea eax, [ebp - 0x58]
push 0x1025ed2c
push eax
call fcn.10050fa0
add esp, 0x24
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x90], esp
push 0x1025ed28
push eax
push ecx
call fcn.10051050
sub esp, 0xc
mov byte [ebp - 4], 4
mov eax, esp
xorps xmm0, xmm0
push 5
movups xmmword [eax], xmm0
push str.Key
push eax
mov dword [eax + 0x10], 5
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
mov edx, 8
mov byte [ebp - 4], 3
add esp, 0xc
lea ecx, [edx + 2]
call fcn.10069910
add esp, 0x30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.1004a130
mov ecx, dword [ebp - 0x18]
mov eax, accept
sub eax, ecx
cmp eax, 1
jb 0x1006c17e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 1
push 0x1025ed2c
push ecx
push dword [ebp - 0x90]
lea ecx, [ebp - 0x40]
call fcn.10052ec0
sub esp, 0x18
mov byte [ebp - 4], 5
mov eax, esp
mov dword [ebp - 0x90], esp
lea ecx, [ebp - 0x40]
push 0x1025ed28
push ecx
push eax
call fcn.10051050
sub esp, 0xc
mov byte [ebp - 4], 6
mov eax, esp
xorps xmm0, xmm0
push 5
movups xmmword [eax], xmm0
push str.Exp
push eax
mov dword [eax + 0x10], 5
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
mov edx, 4
mov byte [ebp - 4], 5
add esp, 0xc
lea ecx, [edx + 6]
call fcn.10069910
add esp, 0x30
lea ecx, [ebp - 0x40]
call fcn.1004a130
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1006bb7d
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006bb73
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006bb73
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101df293
add esp, 8
lea ecx, [ebp - 0x150]
call fcn.1004a9e0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101dee0e
mov esp, ebp
pop ebp
ret
movq xmm0, qword [str.C:DLL_KEy.lic]
xor eax, eax
mov word [ebp - 0x1a], ax
mov eax, dword [0x1025ed48]
mov dword [ebp - 0x20], eax
mov ax, word [0x1025ed4c]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x28]
push 0x1025e7f8
push eax
mov dword [ebp - 0x18], 0xe
mov dword [ebp - 0x14], 0xf
movq qword [ebp - 0x28], xmm0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
test eax, eax
je 0x1006bc00
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov byte [ebp - 0x89], 1
jmp 0x1006bc07
mov byte [ebp - 0x89], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1006bc3d
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006bc33
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006bc33
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101df293
add esp, 8
cmp byte [ebp - 0x89], 0
je 0x1006bc54
push str.del_C:DLL_KEy.lic
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10069a90
lea ecx, [ebp - 0x98]
call fcn.1005c6f0
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.1005bdf0
cmp dword [ebp - 0x94], 0
je 0x1006bb7d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
movaps xmm0, xmmword [0x102633e0]
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x14], 0x1003f0f
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x38], 0x792a371a
xor ecx, ecx
mov dword [ebp - 0x34], 0x2c39130e
mov dword [ebp - 0x30], 0x6283c
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x90], esp
mov dword [ebp - 0x94], edx
nop dword [eax + eax]
mov al, cl
add al, 0x51
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x12
jb 0x1006bcd0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
mov ecx, edx
push 0x12
movups xmmword [edx], xmm0
push eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
call fcn.10052750
sub esp, 0x18
mov dword [ebp - 4], 8
mov esi, esp
mov dword [ebp - 0x94], esi
cmp byte [ebp - 0x2c], 0
je 0x1006bd32
xor ecx, ecx
nop dword [eax]
mov al, cl
add al, 0x51
xor byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0xb
jb 0x1006bd20
mov byte [ebp - 0x2c], 0
xorps xmm0, xmm0
lea eax, [ebp - 0x38]
push 0xb
movups xmmword [esi], xmm0
push eax
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.10052750
mov edx, 6
mov dword [ebp - 4], 0xffffffff
lea ecx, [edx + 4]
call fcn.10069910
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.10079380
add esp, 0x18
mov ecx, esp
push 0x102780fc
call fcn.1004ee30
lea eax, [ebp - 0x28]
mov ecx, 0x102a21f8
push eax
call fcn.10066ea0
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x1006bd9a
mov eax, dword [eax]
push 4
push str.Azef
push ecx
push eax
call fcn.100533a0
add esp, 0x10
mov byte [ebp - 0x89], al
lea ecx, [ebp - 0x28]
call fcn.1004a130
cmp byte [ebp - 0x89], 0
jne 0x1006be67
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.del_C:DLL_KEy.lic
call esi
sub esp, 0x14
xorps xmm0, xmm0
mov eax, esp
mov dword [ebp - 0x94], esp
push 7
movups xmmword [eax], xmm0
push str.__Fail_
push eax
mov dword [eax + 0x10], 7
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
sub esp, 0xc
mov dword [ebp - 4], 9
mov eax, esp
xorps xmm0, xmm0
push 5
movups xmmword [eax], xmm0
push str.Login
push eax
mov dword [eax + 0x10], 5
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
mov edx, 4
mov dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [edx + 6]
call fcn.10069910
add esp, 0x30
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.taskkill__F__im_AndroidEmulatorEn.exe
call esi
push str.taskkill__F__im_AndroidEmulatorEx.exe
call esi
add esp, 8
jmp 0x1006bb88
sub esp, 0x18
mov ecx, esp
push 0x102780fc
call fcn.1004ee30
lea eax, [ebp - 0x28]
mov ecx, 0x102a21f8
push eax
call fcn.10066ea0
mov edx, str.Azef
mov ecx, eax
call fcn.10052390
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x89], al
call fcn.1004a130
cmp byte [ebp - 0x89], 0
je 0x1006bb88
mov ecx, 0x102783fc
cmp ecx, 0x102780fc
je 0x1006bed7
cmp dword [0x10278110], 0x10
mov eax, 0x102780fc
push dword [0x1027810c]
cmovae eax, dword [0x102780fc]
push eax
call fcn.100505b0
cmp dword [0x10278110], 0x10
mov ecx, 0x102780fc
mov edx, dword [0x1027810c]
cmovae ecx, dword [0x102780fc]
push 6
push str.GLITCH
push 0
call fcn.10079870
add esp, 0xc
cmp eax, 0xffffffff
je 0x1006bf14
mov byte [0x10280e40], 1
mov eax, str.Glitch_Bypass
jmp 0x1006bf19
mov eax, str.Normal_Bypass
push 0xd
push eax
mov ecx, 0x102780cc
call fcn.100505b0
push 0x102a2270
push str._a___d._m._Y__H:_M:_S
lea eax, [ebp - 0x78]
push 0x20
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x14], 0
add esp, 0x10
lea edx, [ecx + 1]
movups xmmword [ebp - 0x28], xmm0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006bf60
sub ecx, edx
lea eax, [ebp - 0x78]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10052750
sub esp, 0x18
mov dword [ebp - 4], 0xa
mov eax, esp
mov dword [ebp - 0x94], esp
xorps xmm0, xmm0
push 6
movups xmmword [eax], xmm0
push str._Done_
push eax
mov dword [eax + 0x10], 6
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
sub esp, 0xc
mov byte [ebp - 4], 0xb
mov eax, esp
xorps xmm0, xmm0
push 5
movups xmmword [eax], xmm0
push str.Login
push eax
mov dword [eax + 0x10], 5
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [ebp - 4], 0xa
mov edx, 0xa
mov ecx, edx
call fcn.10069910
push 0x102780fc
lea eax, [ebp - 0x58]
push 0x1025ed2c
push eax
call fcn.10050fa0
add esp, 0x24
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x94], esp
push 0x1025ed28
push eax
push ecx
call fcn.10051050
sub esp, 0xc
mov byte [ebp - 4], 0xd
mov eax, esp
xorps xmm0, xmm0
push 5
movups xmmword [eax], xmm0
push str.Key
push eax
mov dword [eax + 0x10], 5
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
mov edx, 8
mov byte [ebp - 4], 0xc
add esp, 0xc
lea ecx, [edx + 2]
call fcn.10069910
add esp, 0x30
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
call fcn.1004a130
mov ecx, dword [ebp - 0x18]
mov eax, accept
sub eax, ecx
cmp eax, 1
jb 0x1006c183
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
push 1
push 0x1025ed2c
push ecx
push dword [ebp - 0x94]
lea ecx, [ebp - 0x58]
call fcn.10052ec0
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov eax, esp
mov dword [ebp - 0x94], esp
lea ecx, [ebp - 0x58]
push 0x1025ed28
push ecx
push eax
call fcn.10051050
sub esp, 0xc
mov byte [ebp - 4], 0xf
mov eax, esp
xorps xmm0, xmm0
push 5
movups xmmword [eax], xmm0
push str.Exp
push eax
mov dword [eax + 0x10], 5
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
mov edx, 4
mov byte [ebp - 4], 0xe
add esp, 0xc
lea ecx, [edx + 6]
call fcn.10069910
add esp, 0x30
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
call fcn.1004a130
sub esp, 8
lea ecx, [ebp - 0x200]
push 2
push str.C:DLL_KEy.lic
call fcn.100500a0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x200]
cmp dword [0x10278110], 0x10
mov edx, 0x102780fc
push dword [0x1027810c]
cmovae edx, dword [0x102780fc]
call fcn.1005d6d0
add esp, 4
lea ecx, [ebp - 0x200]
call fcn.1004d400
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.taskkill__F__im_AndroidEmulatorEn.exe
call esi
push str.taskkill__F__im_AndroidEmulatorEx.exe
call esi
add esp, 8
lea ecx, [ebp - 0x200]
call fcn.1004a890
lea ecx, [ebp - 0x28]
call fcn.1004a130
mov al, 1
jmp 0x1006bb8a
call fcn.10047970
call fcn.10047970
int3