Function at 0x10006f50
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check for time delay via gettickcount
Create thread
Encode data using xor
Execute shellcode via indirect call
Get memory capacity
Initialize winsock library
Link many functions at runtime
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x668
mov eax, dword [0x10030040]
xor eax, esp
mov dword [esp + 0x664], eax
push esi
push edi
push str.____________________________________________________________________________________________________
push 0
push 0x10130ac0
call fcn.100083d0
add esp, 0xc
lea eax, [esp + 0x54]
push 0x90
push 0
push eax
call fcn.1000e330
add esp, 0xc
mov dword [esp + 0x50], 0x94
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x100
push 0
push 0x1013c168
call fcn.1000e330
movaps xmm1, xmmword [0x1002c660]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor eax, eax
nop
movups xmm0, xmmword [eax + 0x10027d08]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c168], xmm0
movups xmm0, xmmword [eax + 0x10027d18]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c178], xmm0
movups xmm0, xmmword [eax + 0x10027d28]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c188], xmm0
movups xmm0, xmmword [eax + 0x10027d38]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c198], xmm0
add eax, 0x40
cmp eax, 0x100
jb 0x10006fe0
mov esi, dword [esp + 0x18]
mov ecx, esi
mov edx, dword [esp + 0x1c]
mov eax, edx
shrd ecx, eax, 0x14
sub esi, dword [esp + 0x20]
push ecx
sbb edx, dword [esp + 0x28]
shrd esi, edx, 0x14
push esi
push dword [esp + 0x64]
push dword [esp + 0x64]
push dword [esp + 0x64]
push 0x1002af08
push 0x1013c168
push 0
push 0x10130ac0
call fcn.100083d0
add esp, 0x20
mov ecx, 0x10135c30
call fcn.1000a030
test al, al
je 0x10007c1a
push str.LdrLoadDll
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x100070b8
lea ecx, [eax + 0x13]
jmp 0x10007c1f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 6
push edi
call esi
mov eax, dword [0x1013bcdc]
mov dword [edi], eax
mov ax, word [0x1013bce0]
mov word [edi + 4], ax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 6
push edi
call esi
call fcn.1000ac80
test al, al
jne 0x100070fc
mov ecx, 0x14
jmp 0x10007c1f
mov ecx, str.SeDebugPrivilege
call fcn.1000be10
test al, al
jne 0x10007114
mov ecx, 0x15
jmp 0x10007c1f
mov ecx, str.SeShutdownPrivilege
call fcn.1000be10
test al, al
jne 0x1000712c
mov ecx, 0x15
jmp 0x10007c1f
call fcn.1000a470
test al, al
jne 0x1000713f
mov ecx, 0x16
jmp 0x10007c1f
push 0
push 0x10135aec
push 0x104
push 0x10135cd6
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x10007162
lea ecx, [eax + 0x17]
jmp 0x10007c1f
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
push eax
lea eax, [esp + 0x454]
push str.PMBL_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x450]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.LdrLoadDll
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x1002b144
push str.kernel32.dll
mov dword [0x10135bf0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
push str.LoadLibraryW
push str.kernel32.dll
mov dword [0x10135bf4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov dword [0x10135bf8], eax
mov eax, dword [0x10135bf0]
mov dword [0x10135bfc], eax
call fcn.10002180
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10002660
push 0x100092b0
push 0x10135bfc
call fcn.10001c30
call fcn.100021f0
push str.LocalHACK_VERIFY_FILE_MAPPING
push 0x1810
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x1013bcf4], eax
test eax, eax
je 0x10007c13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1810
push 0
push 0
push 0xf001f
push dword [0x1013bcf4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x1013bcf0], eax
test eax, eax
je 0x10007c13
cmp esi, 0xb7
je 0x1000728d
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0xc08], 0
mov dword [eax + 0xc0c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [0x1013bcec], eax
mov dword [esp + 0x450], 0x1002b194
mov dword [esp + 0x454], 0
mov dword [esp + 0x458], 0
mov dword [esp + 0x45c], 0
call edi
push eax
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x24
push 0x40
lea ecx, [esp + 0x458]
mov dword [esp + 0x10], eax
call fcn.10009f70
test al, al
mov eax, dword [esp + 0x454]
je 0x1000733d
test eax, eax
je 0x10007357
lea edi, [eax + 8]
test edi, edi
je 0x1000733d
cmp dword [eax], 0
mov dword [esp + 0xc], 0
jbe 0x1000733d
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [edi + 4], eax
jne 0x10007324
mov eax, dword [esp + 8]
cmp dword [edi + 8], eax
je 0x10007361
mov eax, dword [esp + 0xc]
add edi, 0x1c
mov ecx, dword [esp + 0x454]
inc eax
mov dword [esp + 0xc], eax
cmp eax, dword [ecx]
jb 0x10007310
mov eax, ecx
test eax, eax
je 0x10007357
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [esp + 0x454]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x2e
jmp 0x10007c1f
movzx eax, word [edi + 0x12]
mov dword [0x1013bce8], eax
mov eax, dword [edi]
mov dword [0x1013bce4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [esp + 0x454]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [esp + 0x50]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10007bdf
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x10030924], eax
cmp eax, 0xffffffff
je 0x10007bdf
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x10030928], eax
test eax, eax
je 0x10007bdf
push 0x10135c76
push 5
mov dword [0x10130934], 0x10004a60
call fcn.10008890
push eax
lea eax, [esp + 0x570]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x568]
xor edx, edx
push 0
push eax
push ecx
mov ecx, 0x1013aa68
call fcn.1000bac0
movzx eax, word [0x10135c74]
add esp, 0xc
push eax
push 0x10135c54
call fcn.100035a0
test al, al
jne 0x1000742f
push 0x1388
push 6
jmp 0x10007be6
call fcn.10005660
call esi
mov dword [esp + 8], eax
nop word [eax + eax]
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x1f4
jae 0x10007463
nop
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, 0x1f4
jb 0x10007450
call esi
sub eax, dword [esp + 8]
cmp eax, 0xea60
ja 0x10007bd6
cmp dword [0x10030924], 0xffffffff
je 0x10007486
cmp byte [0x10130958], 0
jne 0x100074e8
lea eax, [esp + 0x50]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100074e8
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x10030924], eax
cmp eax, 0xffffffff
je 0x100074e8
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [0x10030928], eax
test eax, eax
je 0x100074e8
movzx eax, word [0x10135c74]
push eax
push 0x10135c54
mov dword [0x10130934], 0x10004a60
call fcn.100035a0
test al, al
je 0x100074e8
call fcn.10005660
jmp 0x10007440
cmp dword [0x1013bc88], 0
je 0x10007440
cmp dword [0x1013bc84], 0
je 0x10007440
cmp dword [0x1013bc80], 0
je 0x10007440
cmp dword [0x1013bc7c], 0
je 0x10007440
cmp dword [0x1013bc78], 0
je 0x10007440
mov ecx, dword [0x10130aa0]
mov eax, 0x7d8c42b3
sub ecx, dword [0x10130a9c]
imul ecx
mov ecx, dword [0x10130aac]
mov eax, 0x7e07e07f
sub ecx, dword [0x10130aa8]
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
imul ecx
mov ecx, dword [0x10130a94]
mov eax, 0x3e0f83e1
sub ecx, dword [0x10130a90]
sar edx, 5
add esi, edx
mov edi, edx
imul ecx
mov ecx, dword [0x10130a88]
mov eax, 0x38e38e39
sub ecx, dword [0x10130a84]
shr edi, 0x1f
add edi, esi
sar edx, 6
add edi, edx
mov esi, edx
imul ecx
mov eax, dword [0x1013bc6c]
shr esi, 0x1f
add esi, edi
sar edx, 4
mov edi, dword [0x1013bc68]
mov ecx, edx
add eax, edi
shr ecx, 0x1f
add eax, dword [0x1013bc70]
add esi, edx
add eax, dword [0x1013bc74]
add ecx, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ecx, eax
jne 0x10007440
push 0x100
push 0
push 0x1013c168
call fcn.1000e330
movaps xmm1, xmmword [0x1002c660]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor eax, eax
nop
movups xmm0, xmmword [eax + 0x10029508]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c168], xmm0
movups xmm0, xmmword [eax + 0x10029518]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c178], xmm0
movups xmm0, xmmword [eax + 0x10029528]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c188], xmm0
movups xmm0, xmmword [eax + 0x10029538]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c198], xmm0
add eax, 0x40
cmp eax, 0x100
jb 0x100075f0
push edi
push dword [0x1013bc6c]
push dword [0x1013bc70]
push dword [0x1013bc74]
push 0x1013c168
push 0
push 0x10130ac0
call fcn.100083d0
add esp, 0x1c
call fcn.1000ac80
test al, al
jne 0x1000768a
push 0x1388
push 0x14
jmp 0x10007be6
xor eax, eax
xorps xmm1, xmm1
xorps xmm2, xmm2
movq xmm0, qword [eax + 0x10135c34]
punpcklbw xmm0, xmm0
psraw xmm0, 8
paddw xmm1, xmm0
movq xmm0, qword [eax + 0x10135c3c]
punpcklbw xmm0, xmm0
add eax, 0x10
psraw xmm0, 8
paddw xmm2, xmm0
cmp eax, 0x20
jb 0x10007692
paddw xmm1, xmm2
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmm1
psrldq xmm0, 8
paddw xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddw xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
paddw xmm1, xmm0
movd eax, xmm1
push str.recv
push str.Ws2_32.dll
movzx ecx, ax
mov al, cl
shr ecx, 8
add al, byte [0x1013bc90]
add cl, byte [0x1013bc8c]
mov byte [0x1013bc0a], al
mov byte [0x1013bc09], cl
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.send
push str.Ws2_32.dll
mov dword [0x1013bca0], eax
call edi
push eax
call esi
push 0x1002afc8
push str.Kernel32.dll
mov dword [0x1013bc9c], eax
call edi
push eax
call esi
cmp dword [0x1013bc90], 0
mov edi, eax
mov edx, dword [0x1013bca0]
mov esi, dword [0x1013bc9c]
mov dword [0x1013bcc0], edx
mov dword [0x1013bcbc], esi
mov ecx, dword [edx]
mov dword [0x1013bcb4], ecx
mov cl, byte [edx + 4]
mov byte [0x1013bcb8], cl
mov eax, dword [esi]
mov dword [0x1013bcac], eax
mov al, byte [esi + 4]
mov byte [0x1013bcb0], al
mov eax, dword [edi]
mov dword [0x1013bca4], eax
mov al, byte [edi + 4]
mov dword [0x1013bc98], edi
mov byte [0x1013bca8], al
jne 0x100077b3
cmp dword [0x1013bc8c], 0
je 0x10007827
call fcn.10002180
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call fcn.10002660
push 0x10006580
push 0x1013bcc0
call fcn.10001c30
call fcn.100021f0
call fcn.10002180
call edi
push eax
call fcn.10002660
push 0x100066e0
push 0x1013bcbc
call fcn.10001c30
call fcn.100021f0
mov ecx, dword [0x1013bca0]
mov eax, dword [ecx]
mov dword [0x1013bcb4], eax
mov al, byte [ecx + 4]
mov ecx, dword [0x1013bc9c]
mov byte [0x1013bcb8], al
mov eax, dword [ecx]
mov dword [0x1013bcac], eax
mov al, byte [ecx + 4]
mov byte [0x1013bcb0], al
jmp 0x1000782d
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [0x10135cf8], 0
je 0x1000791d
push 0x104
lea eax, [esp + 0x464]
push 0
push eax
call fcn.1000e330
add esp, 0xc
lea eax, [esp + 0x460]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10007872
lea ecx, [eax + 0x21]
jmp 0x10007c1f
lea ecx, [esp + 0x460]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007880
sub ecx, edx
test ecx, ecx
jle 0x100078bd
nop dword [eax]
cmp byte [esp + ecx + 0x460], 0x5c
je 0x100078a1
dec ecx
test ecx, ecx
jg 0x10007890
jmp 0x100078bd
lea eax, [esp + 0x461]
add eax, ecx
push eax
push 0x104
push 0x1013c028
call fcn.1001033b
add esp, 0xc
push 0x10135c96
push 0x1013c028
call fcn.1001209c
add esp, 8
test eax, eax
je 0x100078dd
mov ecx, 0x22
jmp 0x10007c1f
lea ecx, [esp + 0x50]
call fcn.100032d0
push ecx
lea eax, [esp + 0xc]
push eax
push 0x10135c96
lea ecx, [esp + 0x5c]
call fcn.10003400
test al, al
jne 0x10007908
mov ecx, 0x23
jmp 0x10007c1f
mov eax, dword [0x10135cf8]
cmp eax, dword [esp + 8]
je 0x1000791d
mov ecx, 0x24
jmp 0x10007c1f
cmp dword [0x10135d00], 0
je 0x10007966
lea ecx, [esp + 0x50]
call fcn.100032d0
push ecx
lea eax, [esp + 0xc]
push eax
push 0x10135cd6
lea ecx, [esp + 0x5c]
call fcn.10003400
test al, al
jne 0x10007951
mov ecx, 0x28
jmp 0x10007c1f
mov eax, dword [0x10135d00]
cmp eax, dword [esp + 8]
je 0x10007966
mov ecx, 0x29
jmp 0x10007c1f
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1013ae00
push 0
push 0
push 0x10006a20
push 0
push 0
call esi
push 0x1013ae04
push 0
push 0
push 0x10006930
push 0
push 0
mov dword [0x1013bcc4], eax
call esi
push 0x1013ae08
push 0
push 0
push 0x10006830
push 0
push 0
mov dword [0x1013bcc8], eax
call esi
push 2
push dword [0x1013bcc4]
mov dword [0x1013bccc], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x7d0
push 1
push 0x1013bcc4
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [0x1013bc5c], 0
je 0x10007a12
mov eax, dword [0x1013bcd0]
xorps xmm0, xmm0
push 0x1013ae0c
push 0
push 0x10130cdc
push 0x10008740
push 0
push 0
mov dword [0x10130ce0], eax
movups xmmword [0x10130ce8], xmm0
call esi
mov dword [0x10130ce4], eax
mov byte [0x1013ade4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1013bbf4]
mov dword [0x1013ade8], eax
test ecx, ecx
je 0x10007a84
mov eax, dword [0x1013bbf0]
test eax, eax
je 0x10007a84
mov dword [0x10130a74], ecx
mov dword [0x10130a78], eax
call fcn.10002180
call edi
push eax
call fcn.10002660
push 0x10004840
push 0x10130a74
call fcn.10001c30
call fcn.100021f0
call fcn.10002180
call edi
push eax
call fcn.10002660
push 0x100049d0
push 0x10130a78
call fcn.10001c30
call fcn.100021f0
mov eax, dword [0x1013aa6c]
test eax, eax
je 0x10007ab6
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x1013bcd0]
mov dword [0x1013aa6c], 0
push dword [0x1013aa84]
call dword [sym.imp.USER32.dll_UnregisterClassA]
cmp dword [0x10135cfc], 0
je 0x10007b2a
lea ecx, [esp + 0x50]
call fcn.100032d0
push ecx
lea eax, [esp + 0xc]
push eax
push 0x10135cb6
lea ecx, [esp + 0x5c]
call fcn.10003400
test al, al
jne 0x10007aea
mov ecx, 0x25
jmp 0x10007c1f
mov eax, dword [0x10135cfc]
cmp eax, dword [esp + 8]
je 0x10007aff
mov ecx, 0x26
jmp 0x10007c1f
push 0x10135cb6
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10007b16
lea ecx, [eax + 0x27]
jmp 0x10007c1f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002b198
push eax
call esi
test eax, eax
je 0x10007b2a
call eax
push 0x100
push 0
push 0x1013c168
call fcn.1000e330
movaps xmm1, xmmword [0x1002c660]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor eax, eax
nop
movups xmm0, xmmword [eax + 0x1002a908]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c168], xmm0
movups xmm0, xmmword [eax + 0x1002a918]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c178], xmm0
movups xmm0, xmmword [eax + 0x1002a928]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c188], xmm0
movups xmm0, xmmword [eax + 0x1002a938]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax + 0x1013c198], xmm0
add eax, 0x40
cmp eax, 0x100
jb 0x10007b50
push 0x1013c168
push 0
push 0x10130ac0
call fcn.100083d0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x664]
xor ecx, esp
call fcn.1000c666
mov esp, ebp
pop ebp
ret
push 0x1388
push 7
jmp 0x10007be6
push 0x1388
push 4
call fcn.10008890
push eax
push ecx
mov edx, 2
mov ecx, 0x1013acb8
call fcn.1000bac0
mov ecx, dword [esp + 0x678]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.1000c666
mov esp, ebp
pop ebp
ret
mov ecx, 0x2d
jmp 0x10007c1f
mov ecx, 0x12
call fcn.1000bd80
push eax
push 0
push 0x10130ac0
call fcn.100083d0
add esp, 0xc
call fcn.1000b560
int3