Function at 0x10018040
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b800
mov eax, dword fs:[0]
push eax
sub esp, 0x9d4
mov eax, dword [0x1008f0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x410
push 0
lea eax, [ebp - 0x458]
push eax
call fcn.10026310
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x458]
push ecx
call fcn.1001e800
add esp, 8
movzx edx, al
test edx, edx
jne 0x100180a8
mov eax, 0x10300001
jmp 0x1001899a
push 0x410
push 0
lea eax, [ebp - 0x868]
push eax
call fcn.10026310
add esp, 0xc
mov ecx, 0x104
lea esi, [ebp - 0x458]
lea edi, [ebp - 0x868]
rep movsd dword es:[edi], dword [esi]
push 0x100890c4
push 0x410
lea ecx, [ebp - 0x868]
push ecx
call fcn.10012690
lea edx, [ebp - 0x868]
push edx
call fcn.1001e500
add esp, 4
movzx eax, al
test eax, eax
je 0x1001810a
lea ecx, [ebp - 0x868]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xb0
lea ecx, [ebp - 0x988]
call fcn.10005020
push 1
push 0x40
push 0xa
lea edx, [ebp - 0x868]
push edx
lea ecx, [ebp - 0x988]
call fcn.10019b30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x988]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x988]
call fcn.10004d60
and eax, 2
je 0x10018185
lea ecx, [ebp - 0x988]
call fcn.10019aa0
mov dword [ebp - 0x998], 0x10300002
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x998]
jmp 0x1001899a
push 0x40
push 0x3000
push 0x1000
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x98c], eax
cmp dword [ebp - 0x98c], 0
jne 0x100181e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
lea ecx, [ebp - 0x988]
call fcn.10019aa0
mov dword [ebp - 0x99c], 0x10300003
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x99c]
jmp 0x1001899a
mov dword [ebp - 0x8c4], 0
lea edx, [ebp - 0x8c4]
push edx
push str.CallNextHookEx
push 0x100890cc
mov eax, dword [ebp + 8]
push eax
call fcn.10011ec0
add esp, 0x10
cmp dword [ebp - 0x8c4], 0
jne 0x10018258
push 0x8000
push 0
mov ecx, dword [ebp - 0x98c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x9a0], 0x10300004
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9a0]
jmp 0x1001899a
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x47], 0
mov byte [ebp - 0x46], 0
mov byte [ebp - 0x45], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x43], 0
mov byte [ebp - 0x42], 0
mov byte [ebp - 0x41], 0
mov byte [ebp - 0x40], 0x55
mov byte [ebp - 0x3f], 0x8b
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], 0xff
mov byte [ebp - 0x3c], 0x75
mov byte [ebp - 0x3b], 0x10
mov byte [ebp - 0x3a], 0xff
mov byte [ebp - 0x39], 0x75
mov byte [ebp - 0x38], 0xc
mov byte [ebp - 0x37], 0xff
mov byte [ebp - 0x36], 0x75
mov byte [ebp - 0x35], 8
mov byte [ebp - 0x34], 0x6a
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0xe8
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0
mov byte [ebp - 0x2d], 0xeb
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x2b], 0x50
mov byte [ebp - 0x2a], 0x53
mov byte [ebp - 0x29], 0xbb
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x26], 0
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 0xc6
mov byte [ebp - 0x23], 0x43
mov byte [ebp - 0x22], 0x1c
mov byte [ebp - 0x21], 0x14
mov byte [ebp - 0x20], 0xff
mov byte [ebp - 0x1f], 0x33
mov byte [ebp - 0x1e], 0xff
mov byte [ebp - 0x1d], 0x53
mov byte [ebp - 0x1c], 4
mov byte [ebp - 0x1b], 0x89
mov byte [ebp - 0x1a], 3
mov byte [ebp - 0x19], 0x5b
mov byte [ebp - 0x18], 0x58
mov byte [ebp - 0x17], 0x5d
mov byte [ebp - 0x16], 0xc2
mov byte [ebp - 0x15], 0xc
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x990], 8
mov eax, dword [ebp - 0x990]
add eax, 0x14
mov dword [ebp - 0x9c0], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x990]
mov ecx, dword [ebp - 0x98c]
lea edx, [ecx + eax + 0xe]
mov eax, dword [ebp - 0x8c4]
sub eax, edx
sub eax, 5
mov ecx, dword [ebp - 0x990]
mov dword [ebp + ecx - 0x39], eax
mov edx, dword [ebp - 0x990]
mov eax, dword [ebp - 0x98c]
mov dword [ebp + edx - 0x30], eax
push 0
push 0x35
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x98c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x100183ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x8000
push 0
mov edx, dword [ebp - 0x98c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x9a4], 0x10300005
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9a4]
jmp 0x1001899a
push 0x1001cc80
mov ecx, dword [ebp - 0x98c]
add ecx, dword [ebp - 0x990]
push ecx
push 0x10017520
push 0x21
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 0x10017500
lea ecx, [ebp - 0x988]
call fcn.10019dd0
mov ecx, eax
call fcn.10019c40
push eax
call fcn.1001c980
add esp, 8
mov ecx, eax
call fcn.10019dd0
mov ecx, eax
call fcn.10019c40
mov ecx, eax
call fcn.10019e00
lea ecx, [ebp - 0x988]
call fcn.10019aa0
push 0x100890c8
push 0x410
lea eax, [ebp - 0x458]
push eax
call fcn.10012690
xor ecx, ecx
mov dword [ebp - 0x8d8], ecx
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8d0], ecx
mov dword [ebp - 0x8cc], ecx
push 0x44
push 0
lea edx, [ebp - 0x8b8]
push edx
call fcn.10026310
add esp, 0xc
mov dword [ebp - 0x8b8], 0x44
mov dword [ebp - 0x88c], 1
xor eax, eax
mov word [ebp - 0x888], ax
cmp dword [ebp + 0x18], 0xffffffff
je 0x1001873b
mov dword [ebp - 0x8bc], 0
lea ecx, [ebp - 0x8bc]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x10018524
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x8000
push 0
mov edx, dword [ebp - 0x98c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x9a8], 0x10300006
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9a8]
jmp 0x1001899a
mov dword [ebp - 0x8c0], 0
lea ecx, [ebp - 0x8c0]
push ecx
push 1
push 1
push 0
push 0x2000000
mov edx, dword [ebp - 0x8bc]
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x100185a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x8bc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov eax, dword [ebp - 0x98c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x9dc], 0x10300007
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9dc]
jmp 0x1001899a
mov dword [ebp - 0x874], 0
xor edx, edx
mov dword [ebp - 0x8c8], edx
lea eax, [ebp - 0x874]
push eax
push 4
lea ecx, [ebp - 0x8c8]
push ecx
push 0x13
mov edx, dword [ebp - 0x8c0]
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x10018641
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x8c0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8bc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov ecx, dword [ebp - 0x98c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x9e0], 0x10300008
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9e0]
jmp 0x1001899a
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x994], eax
mov dword [ebp - 0x8b8], 0x44
mov dword [ebp - 0x88c], 1
xor ecx, ecx
mov word [ebp - 0x888], cx
lea edx, [ebp - 0x8d8]
push edx
lea eax, [ebp - 0x8b8]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x458]
push ecx
mov edx, dword [ebp - 0x994]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10018712
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x994]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x8bc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov edx, dword [ebp - 0x98c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x9ac], 0x10300009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9ac]
jmp 0x1001899a
mov ecx, dword [ebp - 0x994]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x8c0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8bc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100187b5
lea ecx, [ebp - 0x8d8]
push ecx
lea edx, [ebp - 0x8b8]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100187b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x8000
push 0
mov edx, dword [ebp - 0x98c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x9b0], 0x10300009
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9b0]
jmp 0x1001899a
push 0x4e20
mov ecx, dword [ebp - 0x8d8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x9b4], eax
cmp dword [ebp - 0x9b4], 0
je 0x10018817
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
push 0
mov eax, dword [ebp - 0x8d8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x9b8], 0x1030000a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9b8]
jmp 0x1001899a
mov dword [ebp - 0x870], 0
lea ecx, [ebp - 0x870]
push ecx
mov edx, dword [ebp - 0x8d8]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x8d8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x8d4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x870], 0
je 0x10018899
push 0x8000
push 0
mov edx, dword [ebp - 0x98c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x870]
mov dword [ebp - 0x9bc], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9bc]
jmp 0x1001899a
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x9d0], eax
mov dword [ebp - 0x9cc], edx
mov byte [ebp - 0x869], 0
movzx edx, byte [ebp - 0x869]
test edx, edx
jne 0x10018947
push 0
push 1
lea eax, [ebp - 0x869]
push eax
mov ecx, dword [ebp - 0x98c]
add ecx, dword [ebp - 0x9c0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [ebp - 0x9d0]
sbb edx, dword [ebp - 0x9cc]
mov dword [ebp - 0x9d8], eax
mov dword [ebp - 0x9d4], edx
cmp dword [ebp - 0x9d4], 0
ja 0x1001891e
cmp dword [ebp - 0x9d8], 0x4e20
jbe 0x10018942
mov dword [ebp - 0x9c4], 0x1030000b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9c4]
jmp 0x1001899a
jmp 0x100188b2
push 0
push 4
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 0x98c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x8000
push 0
mov eax, dword [ebp - 0x98c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 0x9c8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.100189c0
mov eax, dword [ebp - 0x9c8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10023850
mov esp, ebp
pop ebp
ret