Function at 0x100f2d50
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check os version
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Get common file path
Get number of processors
Spawn thread to rwx shellcode
Terminate process
Terminate process by name

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019ce70
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc70
mov eax, dword [0x101f6e00]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100f28e0
push dword [sym.imp.KERNEL32.dll_CreateFileA]
call fcn.100020f0
push 0
push 0
push 0
push 0x100f5860
push 0
push 0
mov dword [0x10297f78], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0xab8]
call fcn.100f2460
mov esi, eax
cmp esi, 0x102c9b9c
je 0x100f2de5
mov ecx, 0x102c9b9c
call fcn.100477d0
push esi
mov ecx, 0x102c9b9c
call fcn.10047a50
lea ecx, [ebp - 0xab8]
call fcn.100477d0
mov eax, dword [ebp - 0xab8]
push 8
push eax
mov dword [ebp - 0xab8], 0
call fcn.1013c8d0
movaps xmm0, xmmword [0x101deb70]
add esp, 8
movups xmmword [ebp - 0xb28], xmm0
mov word [ebp - 0xb18], 0x607d
xor ecx, ecx
mov byte [ebp - 0xb16], 0
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0xb27]
xor al, byte [ebp - 0xb28]
mov byte [ebp + ecx - 0xb27], al
inc ecx
cmp ecx, 0x11
jb 0x100f2e30
mov edx, dword [0x102c9bb0]
lea ecx, [ebp - 0xb27]
mov byte [ebp - 0xb16], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f2e60
mov edi, 0x7fffffff
sub ecx, esi
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x100f4090
cmp dword [0x102c9bb4], 0xf
mov eax, 0x102c9ba0
push ecx
cmova eax, dword [0x102c9ba0]
lea ecx, [ebp - 0xb27]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa8f]
lea ecx, [ebp - 0xb14]
call fcn.10048bc0
lea ecx, [ebp - 0xb14]
call fcn.100f2380
test al, al
jne 0x100f300c
mov dl, 0x6d
mov dword [ebp - 0xa94], 0x1f1f286d
mov word [ebp - 0xa90], 0x1f02
xor ecx, ecx
mov byte [ebp - 0xa8e], al
nop dword [eax]
xor byte [ebp + ecx - 0xa93], dl
inc ecx
cmp ecx, 5
jae 0x100f2ef5
mov dl, byte [ebp - 0xa94]
jmp 0x100f2ee0
movaps xmm0, xmmword [0x101df000]
xor ecx, ecx
mov byte [ebp - 0xa8e], 0
movups xmmword [ebp - 0xab8], xmm0
mov dword [ebp - 0xaa8], 0x606f2164
mov dword [ebp - 0xaa4], 0x6821646c
mov dword [ebp - 0xaa0], 0x6d60776f
mov word [ebp - 0xa9c], 0x6568
mov byte [ebp - 0xa9a], 0
nop word [eax + eax]
mov al, byte [ebp + ecx - 0xab7]
xor al, byte [ebp - 0xab8]
mov byte [ebp + ecx - 0xab7], al
inc ecx
cmp ecx, 0x1d
jb 0x100f2f40
lea eax, [ebp - 0xa93]
mov byte [ebp - 0xa9a], 0
push 0x30
push eax
lea eax, [ebp - 0xab7]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
xorps xmm0, xmm0
mov esi, esp
push 8
mov dword [esi], 0
movups xmmword [esi + 4], xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.1013ca30
add esp, 4
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
call fcn.100f26a0
add esp, 0x1c
lea ecx, [ebp - 0xb14]
call fcn.100477d0
mov eax, dword [ebp - 0xb14]
push 8
push eax
mov dword [ebp - 0xb14], 0
call fcn.1013c8d0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1013c8c0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
push 2
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0xc50], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xc50]
push eax
push esi
mov dword [ebp - 0xa90], esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x100f326c
lea eax, [ebp - 0xc50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x100f326c
nop word [eax + eax]
mov al, byte [ebp - 0x1c]
lea ecx, [ebp - 0xc2c]
xorps xmm0, xmm0
mov byte [ebp - 0xc51], al
mov dword [ebp - 0xab8], 0
lea edx, [ecx + 1]
movups xmmword [ebp - 0xab4], xmm0
mov dword [ebp - 0xaa4], 0
mov dword [ebp - 0xaa0], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f30a0
sub ecx, edx
lea eax, [ebp - 0xc2c]
push ecx
push eax
lea ecx, [ebp - 0xab8]
call fcn.100484d0
movaps xmm0, xmmword [0x101de850]
xor ecx, ecx
movups xmmword [ebp - 0xadc], xmm0
mov word [ebp - 0xacc], 0x56
nop word [eax + eax]
mov al, byte [ebp + ecx - 0xadb]
xor al, byte [ebp - 0xadc]
mov byte [ebp + ecx - 0xadb], al
inc ecx
cmp ecx, 0x10
jb 0x100f30e0
lea edx, [ebp - 0xadb]
mov byte [ebp - 0xacb], 0
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x100f3110
sub edx, ecx
lea eax, [ebp - 0xadb]
cmp dword [ebp - 0xaa0], 0xf
lea ecx, [ebp - 0xab4]
push edx
cmova ecx, dword [ebp - 0xab4]
mov edx, dword [ebp - 0xaa4]
push eax
push 0
call fcn.1008e0b0
mov cl, byte [ebp - 0xc51]
add esp, 0xc
inc cl
cmp eax, 0xffffffff
movzx edx, cl
movzx ecx, byte [ebp - 0xc51]
cmove edx, ecx
lea ecx, [ebp - 0xc60]
push 3
mov dword [ebp - 0x1c], edx
call fcn.10139310
mov ecx, dword [ebp - 0xab8]
test ecx, ecx
je 0x100f3192
mov eax, dword [ecx + 4]
mov dword [ecx + 4], 0
test eax, eax
je 0x100f3192
mov dword [eax], 0
mov eax, dword [eax + 4]
test eax, eax
jne 0x100f3185
lea ecx, [ebp - 0xc60]
call fcn.101393c0
mov eax, dword [ebp - 0xaa0]
cmp eax, 0xf
jbe 0x100f320c
mov edi, dword [ebp - 0xab4]
lea esi, [eax + 1]
test edi, edi
jne 0x100f31fc
test esi, esi
je 0x100f31fc
push str.null_pointer_cannot_point_to_a_block_of_non_zero_size
push 0x101d467c
push edi
push 0x3b4
push 0x101d4680
push 2
call fcn.10143d00
add esp, 0x18
cmp eax, 1
jne 0x100f31de
int3
push 0
push 0x3b4
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.40.33807includexmemory
push 0x101d47ac
push str._null_pointer_cannot_point_to_a_block_of_non_zero_size_
call fcn.10152640
add esp, 0x14
push esi
push edi
call fcn.10048760
mov esi, dword [ebp - 0xa90]
add esp, 8
mov eax, dword [ebp - 0xab8]
push 8
push eax
mov dword [ebp - 0xaa4], 0
mov dword [ebp - 0xaa0], 0xf
mov byte [ebp - 0xab4], 0
mov dword [ebp - 0xab8], 0
call fcn.1013c8d0
add esp, 8
lea eax, [ebp - 0xc50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x100f3060
cmp byte [ebp - 0x1c], 3
jbe 0x100f3267
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, 0x7fffffff
mov dl, 0x1e
mov dword [ebp - 0xac8], 0x475c421e
mov dword [ebp - 0xac4], 0x4d5d5f4c
xor ecx, ecx
mov dword [ebp - 0xac0], 0x72727a30
mov byte [ebp - 0xabc], 0
xor byte [ebp + ecx - 0xac7], dl
inc ecx
cmp ecx, 0xb
jae 0x100f32aa
mov dl, byte [ebp - 0xac8]
jmp 0x100f3295
mov edx, dword [0x102c9bb0]
lea ecx, [ebp - 0xac7]
mov byte [ebp - 0xabc], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f32c0
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100f4090
cmp dword [0x102c9bb4], 0xf
mov eax, 0x102c9ba0
push ecx
cmova eax, dword [0x102c9ba0]
lea ecx, [ebp - 0xac7]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa8f]
lea ecx, [ebp - 0xab8]
call fcn.10048bc0
lea ecx, [ebp - 0xb14]
call fcn.100477d0
lea eax, [ebp - 0xab8]
push eax
lea ecx, [ebp - 0xb14]
call fcn.10047a50
lea ecx, [ebp - 0xab8]
call fcn.100477d0
mov eax, dword [ebp - 0xab8]
push 8
push eax
mov dword [ebp - 0xab8], 0
call fcn.1013c8d0
add esp, 8
lea ecx, [ebp - 0xb14]
call fcn.100f2380
test al, al
jne 0x100f3410
movaps xmm0, xmmword [str.hCCB]
xor ecx, ecx
movups xmmword [ebp - 0xab8], xmm0
mov dword [ebp - 0xaa8], 0x6206486f
mov dword [ebp - 0xaa4], 0x4543544f
mov dword [ebp - 0xaa0], 0x5f544952
mov byte [ebp - 0xa9c], al
nop
mov al, byte [ebp + ecx - 0xab7]
xor al, byte [ebp - 0xab8]
mov byte [ebp + ecx - 0xab7], al
inc ecx
cmp ecx, 0x1b
jb 0x100f3390
mov byte [ebp - 0xa9c], 0
mov dl, 3
mov dword [ebp - 0xa98], 0x5a415f03
xor ecx, ecx
mov dword [ebp - 0xa94], 0x50404251
mov dword [ebp - 0xa90], 0x6f6f672d
mov byte [ebp - 0xa8c], 0
nop word [eax + eax]
xor byte [ebp + ecx - 0xa97], dl
inc ecx
cmp ecx, 0xb
jae 0x100f33f5
mov dl, byte [ebp - 0xa98]
jmp 0x100f33e0
lea eax, [ebp - 0xab7]
mov byte [ebp - 0xa8c], 0
push 0x30
push eax
lea eax, [ebp - 0xa97]
jmp 0x100f2f70
push 0x64
lea eax, [ebp - 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
xorps xmm0, xmm0
mov dword [ebp - 0xaf8], 0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xae4], 0
movups xmmword [ebp - 0xaf4], xmm0
mov dword [ebp - 0xae0], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f3460
sub ecx, edx
lea eax, [ebp - 0x88]
push ecx
push eax
lea ecx, [ebp - 0xaf8]
call fcn.100484d0
push 0x558
call fcn.1013ca30
mov edx, dword [0x102c9bb0]
mov cl, 0x10
mov dword [ebp - 0xc60], eax
mov al, 0x4c
xor cl, al
mov byte [ebp - 0xc56], 0
mov byte [ebp - 0xc57], cl
sub esp, 0x18
lea ecx, [ebp - 0xc57]
mov byte [ebp - 0xc58], al
mov byte [ebp - 0xc56], 0
lea esi, [ecx + 1]
mov dword [ebp - 0xa90], esp
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f34c4
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100f4090
cmp dword [0x102c9bb4], 0xf
mov eax, 0x102c9ba0
push ecx
cmova eax, dword [0x102c9ba0]
lea ecx, [ebp - 0xc57]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa8f]
mov ecx, dword [ebp - 0xa90]
call fcn.10048bc0
mov ecx, dword [ebp - 0xc60]
call fcn.100e18a0
push 0x30
mov dword [0x10297f7c], eax
call fcn.1013ca30
mov edx, dword [0x102c9bb0]
mov esi, eax
mov al, 0x25
mov byte [ebp - 0xc5a], 0
mov cl, 0x79
mov byte [ebp - 0xc5c], al
add esp, 4
mov dword [ebp - 0xc60], esi
xor cl, al
mov byte [ebp - 0xc5a], 0
mov byte [ebp - 0xc5b], cl
lea ecx, [ebp - 0xc5b]
lea eax, [ecx + 1]
mov dword [ebp - 0xa90], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f3560
sub ecx, dword [ebp - 0xa90]
sub edi, edx
cmp edi, ecx
jb 0x100f4095
cmp dword [0x102c9bb4], 0xf
mov eax, 0x102c9ba0
push ecx
cmova eax, dword [0x102c9ba0]
lea ecx, [ebp - 0xc5b]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa8f]
lea ecx, [ebp - 0xc80]
call fcn.10048bc0
lea edi, [esi + 8]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi], 0
movups xmmword [edi + 4], xmm0
push 8
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.1013ca30
add esi, 0x24
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [eax + 4], 0
mov dword [edi], eax
mov dword [eax], edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1013ca30
add esp, 4
mov dword [eax], esi
mov dword [eax + 4], 0
push 0x40
mov dword [esi], eax
call fcn.1013ca30
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 4], eax
lea eax, [ebp - 0xc80]
cmp edi, eax
je 0x100f366c
cmp dword [ebp - 0xc68], 0xf
lea eax, [ebp - 0xc7c]
push dword [ebp - 0xc6c]
cmova eax, dword [ebp - 0xc7c]
mov ecx, edi
push eax
call fcn.10047890
lea ecx, [ebp - 0xc80]
call fcn.100477d0
mov eax, dword [ebp - 0xc80]
push 8
push eax
mov dword [ebp - 0xc80], 0
call fcn.1013c8d0
mov eax, dword [ebp - 0xc60]
add esp, 8
mov dword [0x10297f5c], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0xa90], eax
mov edx, dword [ebp - 0xa90]
mov ecx, dword [0x102c99e0]
push str.BYRACS_Log.txt
mov eax, dword [edx + 0xa4]
mov dword [ecx + 0xe8], eax
mov eax, dword [edx + 0xa8]
mov dword [ecx + 0xec], eax
movzx eax, word [edx + 0xac]
mov word [ecx + 0xf0], ax
movzx eax, word [edx + 0xae]
mov word [ecx + 0xf2], ax
mov eax, dword [edx + 0xbc]
mov dword [ecx + 0x100], eax
mov eax, dword [edx + 0xb8]
mov dword [ecx + 0xfc], eax
mov eax, dword [edx + 0xb0]
mov dword [ecx + 0xf4], eax
mov eax, dword [edx + 0xb4]
mov dword [ecx + 0xf8], eax
call fcn.1015cdd0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x288]
add esp, 4
push eax
push 0x200
call esi
push str.hostfix.bat
lea eax, [ebp - 0x288]
push 0x200
push eax
call fcn.1015e8f0
add esp, 0xc
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x288]
push 0x101da8a4
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1015dc20
mov eax, dword [ebp - 0x1c]
add esp, 0xc
test eax, eax
je 0x100f37a0
push eax
call fcn.10153180
add esp, 4
lea eax, [ebp - 0x288]
push eax
call fcn.1015d771
add esp, 4
lea eax, [ebp - 0x288]
push eax
call fcn.1015cdd0
add esp, 4
push 0x200
lea eax, [ebp - 0x288]
push 0
push eax
call fcn.1013f8f0
add esp, 0xc
lea eax, [ebp - 0x288]
push eax
push 0x200
call esi
push str.ws2_32.dll
lea eax, [ebp - 0x288]
push 0x200
push eax
call fcn.1015e8f0
add esp, 0xc
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x288]
push 0x101da8a4
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1015dc20
mov eax, dword [ebp - 0x1c]
add esp, 0xc
test eax, eax
je 0x100f381b
push eax
call fcn.10153180
add esp, 4
lea eax, [ebp - 0x288]
push eax
call fcn.1015cdd0
add esp, 4
push 0x400
lea eax, [ebp - 0xa88]
push 0
push eax
call fcn.1013f8f0
add esp, 0xc
push 0
push str.Oyun_ba
call fcn.100b1280
push str.Tue_Sep_10_19:50:46_2024
push str.A510225
lea eax, [ebp - 0xa88]
push str.BYRACS_s
push eax
call fcn.100ecae0
add esp, 0x10
lea eax, [ebp - 0xa88]
push 0
push eax
call fcn.100b1280
mov ecx, dword [0x102c99e0]
movzx eax, word [ecx + 0xf2]
push eax
movzx eax, word [ecx + 0xf0]
push eax
push dword [ecx + 0xec]
lea eax, [ebp - 0xa88]
push dword [ecx + 0xe8]
push str.Windows_s
push eax
call fcn.100ecae0
add esp, 0x18
lea eax, [ebp - 0xa88]
push 0
push eax
call fcn.100b1280
push 0
push str.Ana_i
call fcn.100b1280
push 0x400
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.1013f8f0
mov eax, dword [0x102c99e0]
add esp, 0xc
add eax, 0x25
xor eax, 0xffffffbb
imul eax, eax, 0xffffff94
and eax, 0xcc
push eax
lea eax, [ebp - 0x688]
push str._KK___x_
push eax
call fcn.100ecae0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
mov eax, dword [0x102c99e0]
mov eax, dword [eax + 0xb0]
xor eax, 0x2c
imul eax, eax, 0xfffffff5
and eax, 0x5d
push eax
lea eax, [ebp - 0x688]
push str._SZ1___x_
push eax
call fcn.10052ea0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
mov eax, dword [0x102c99e0]
mov eax, dword [eax + 0xac]
xor eax, 0xfffffff2
imul eax, eax, 0xfffffff6
and eax, 0x14
push eax
lea eax, [ebp - 0x688]
push str._SZ2___x_
push eax
call fcn.100ecae0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
mov eax, dword [0x102c99e0]
mov eax, dword [eax + 0xb4]
xor eax, 0xffffffde
imul eax, eax, 0xfffffff1
and eax, 0x4e
push eax
lea eax, [ebp - 0x688]
push str._SZ3___x_
push eax
call fcn.100ecae0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
mov eax, dword [0x102c99e0]
push dword [eax + 0xc]
lea eax, [ebp - 0x688]
push str.CSRSS_process_id:__i
push eax
call fcn.100ecae0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
mov eax, dword [0x102c99e0]
push dword [eax + 0x10]
lea eax, [ebp - 0x688]
push str.WLG_process_id:__i
push eax
call fcn.100ecae0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
mov eax, dword [0x102c99e0]
mov eax, dword [eax + 0xa0]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x688]
push str._SM1___x_
push eax
call fcn.100ecae0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
mov eax, dword [0x102c99e0]
mov eax, dword [eax + 0x14]
xor eax, 0x67
imul eax, eax, 0xffffff88
and eax, 0xe3
push eax
lea eax, [ebp - 0x688]
push str._SM2___x_
push eax
call fcn.100ecae0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10297f70], eax
test eax, eax
je 0x100f3aa2
lea eax, [ebp - 0x1c]
push eax
call esi
push eax
call dword [0x10297f70]
cmp dword [ebp - 0x1c], 0
je 0x100f3acc
push 0
push str._x64__sistem_belirlendi
call fcn.100b1280
push 0
push 0x101dc3e4
call fcn.100b1280
push 0
push str.Sistem_servisi_ba
call fcn.100b1280
push 0
push str.Islemci_calisma_kumesi_olusturuldu.
call fcn.100b1280
push 0
push str.Bellek_arayuzu_entegrasyonu_basladi
call fcn.100b1280
push 0
push str.Bellek_arayuzu_entegrasyonu_tamamlandi
call fcn.100b1280
push 0
push str.Essiz_kimlik_olusturuldu
call fcn.100b1280
mov eax, dword [0x102c99e0]
mov eax, dword [eax + 0x2c]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x688]
push str.Yans
push eax
call fcn.100ecae0
add esp, 0xc
lea eax, [ebp - 0x688]
push 0
push eax
call fcn.100b1280
push 0
push str.AA_sistemi_aktif_edildi
call fcn.100b1280
push 0
push str.Haklar_al
call fcn.100b1280
lea eax, [ebp - 0x1c]
push eax
push 0x20
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100f407d
lea eax, [ebp - 0xa94]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
test eax, eax
je 0x100f40ad
mov eax, dword [ebp - 0xa94]
mov ecx, dword [ebp - 0xa90]
push 0
push 0x10
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xadc]
push eax
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xad0], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100f409a
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Haklar_elde_edildi
call fcn.100b1280
push 0
push str.Sistem_ayarlar
call fcn.100b1280
push 0x101db6fc
push str.kernel32.dll
call fcn.100b1380
push 0x101db710
push str.kernel32.dll
call fcn.100b1380
push 0x101dc4b4
push str.kernel32.dll
call fcn.100b1380
push 0x101db734
push str.kernel32.dll
call fcn.100b1380
push 0x101db724
push str.kernel32.dll
call fcn.100b1380
push 0x101dc518
push str.kernel32.dll
call fcn.100b1380
push 0x101dc530
push str.Winmm.dll
call fcn.100b1380
push 0
push str.Sistem_segmentleri_kontrol_ediliyor
call fcn.100b1280
mov ecx, dword [0x10297f7c]
call fcn.100a1860
push 0
push str.Log_sistemi_aktif_ediliyor
call fcn.100b1280
push 0
push str.Adres_y
call fcn.100b1280
push 0
push str.Kimlik_y
call fcn.100b1280
push 0
push str.Geni
call fcn.100b1280
call fcn.100f48e0
push 0
push 0x101dc618
call fcn.100b1280
push 0x3c
call fcn.1013ca30
add esp, 4
mov ecx, eax
call fcn.10044c20
mov dword [0x10297f58], eax
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
cmp esi, edi
je 0x100f3d40
nop word [eax + eax]
push esi
lea ecx, [ebp - 0xab8]
call fcn.10046cb0
cmp dword [ebp - 0xaa0], 0xf
lea ecx, [ebp - 0xa90]
push ecx
push 0xf003f
lea eax, [ebp - 0xab4]
cmova eax, dword [ebp - 0xab4]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0xab8]
cmp eax, 2
jne 0x100f3ea4
call fcn.100477d0
mov eax, dword [ebp - 0xab8]
push 8
push eax
mov dword [ebp - 0xab8], 0
call fcn.1013c8d0
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100f3cd0
mov byte [ebp - 0xc52], 0
mov eax, dword [0x10297f58]
mov esi, dword [eax + 0x14]
mov edi, dword [eax + 0x18]
cmp esi, edi
je 0x100f3dba
nop word [eax + eax]
push esi
lea ecx, [ebp - 0xab8]
call fcn.10046cb0
cmp dword [ebp - 0xaa0], 0xf
lea ecx, [ebp - 0xab4]
cmova ecx, dword [ebp - 0xab4]
call fcn.10044ac0
lea ecx, [ebp - 0xab8]
test al, al
jne 0x100f3ed0
call fcn.100477d0
mov eax, dword [ebp - 0xab8]
push 8
push eax
mov dword [ebp - 0xab8], 0
call fcn.1013c8d0
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100f3d60
mov byte [ebp - 0xc51], 0
push 0
push str.PC_ban_sistemi_kontrol_ediliyor.
call fcn.100b1280
cmp byte [ebp - 0xc52], 0
jne 0x100f3efc
cmp byte [ebp - 0xc51], 0
jne 0x100f3efc
mov eax, dword [0x101dc2f8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1c], eax
mov ax, word [0x101dc2fc]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0xa90]
push eax
push 0x40
push 5
push 0x510de7
call esi
mov ecx, 0x510de7
mov byte [ebp - 0x1c], 0xe9
mov eax, 0x100f2d10
sub eax, 0x510dec
mov dword [ebp - 0x1b], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
mov al, byte [ebp - 0x18]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc60]
push eax
push dword [ebp - 0xa90]
push 5
push ecx
call esi
push 0
push 0
push 0
push 0x100f5500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.ClientPlugin_aktif_edildi.
call fcn.100b1280
push 3
lea ecx, [ebp - 0xa90]
call fcn.10139310
mov ecx, dword [ebp - 0xaf8]
test ecx, ecx
je 0x100f3fcd
mov eax, dword [ecx + 4]
mov dword [ecx + 4], 0
test eax, eax
je 0x100f3fcd
mov dword [eax], 0
mov eax, dword [eax + 4]
test eax, eax
jne 0x100f3e92
jmp 0x100f3fcd
call fcn.100477d0
mov eax, dword [ebp - 0xab8]
push 8
push eax
mov dword [ebp - 0xab8], 0
call fcn.1013c8d0
add esp, 8
mov byte [ebp - 0xc52], 1
jmp 0x100f3d47
call fcn.100477d0
mov eax, dword [ebp - 0xab8]
push 8
push eax
mov dword [ebp - 0xab8], 0
call fcn.1013c8d0
add esp, 8
mov byte [ebp - 0xc51], 1
jmp 0x100f3dc1
push 1
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
call fcn.100b1280
sub esp, 0x1c
xorps xmm0, xmm0
mov esi, esp
push 8
mov dword [esi], 0
movups xmmword [esi + 4], xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.1013ca30
add esp, 4
mov dword [eax], esi
mov dword [eax + 4], 0
push 0x40
mov dword [esi], eax
call fcn.100490d0
mov dword [esi + 0x14], 0x39
mov ecx, eax
mov dword [esi + 4], ecx
add esp, 4
mov dword [esi + 0x18], 0x3f
movups xmm0, xmmword [str.Sorry__you_blocked_me_from_performing_an_unwanted_action.]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x101dc5d0]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x101dc5e0]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [0x101dc5f0]
movq qword [ecx + 0x30], xmm0
mov al, byte [0x101dc5f8]
mov byte [ecx + 0x38], al
mov byte [ecx + 0x39], 0
call fcn.100f26a0
add esp, 0x1c
lea ecx, [ebp - 0xa90]
push 3
call fcn.10139310
mov ecx, dword [ebp - 0xaf8]
test ecx, ecx
je 0x100f3fcd
mov eax, dword [ecx + 4]
mov dword [ecx + 4], 0
test eax, eax
je 0x100f3fcd
mov dword [eax], 0
mov eax, dword [eax + 4]
test eax, eax
jne 0x100f3fc0
lea ecx, [ebp - 0xa90]
call fcn.101393c0
mov eax, dword [ebp - 0xae0]
cmp eax, 0xf
jbe 0x100f4042
mov edi, dword [ebp - 0xaf4]
lea esi, [eax + 1]
test edi, edi
jne 0x100f4038
test esi, esi
je 0x100f4038
push str.null_pointer_cannot_point_to_a_block_of_non_zero_size
push 0x101d467c
push 0
push 0x3b4
push 0x101d4680
push 2
call fcn.10143d00
add esp, 0x18
cmp eax, 1
jne 0x100f401a
int3
push 0
push 0x3b4
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.40.33807includexmemory
push 0x101d47ac
push str._null_pointer_cannot_point_to_a_block_of_non_zero_size_
call fcn.10152640
add esp, 0x14
push esi
push edi
call fcn.10048760
add esp, 8
mov eax, dword [ebp - 0xaf8]
push 8
push eax
mov dword [ebp - 0xae4], 0
mov dword [ebp - 0xae0], 0xf
mov byte [ebp - 0xaf4], 0
mov dword [ebp - 0xaf8], 0
call fcn.1013c8d0
add esp, 8
jmp 0x100f2fc8
push 0
push str.Haklar_elde_edilemedi
call fcn.100b1280
push 0
call fcn.1015c310
call fcn.10043b90
call fcn.10043b90
push 0
push str.Haklar_elde_edilemedi__yetersiz_yetkilendirme
call fcn.100b1280
push 0
call fcn.1015c310
push str.Haklar_elde_edilemedi__yetersiz_yetki_alani
call fcn.100b1280
push 0
call fcn.1015c310
int3