Function at 0x10006030
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101003d1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2f0
mov eax, dword [0x1017d040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xc4], esi
cmp dword [esi + 0x2c], 0xa
jne 0x10006b8e
cmp dword [esi + 0x44], 0x40
jne 0x10006b8e
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
push str.Hello_world
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x5c], 0
movups xmmword [ebp - 0x70], xmm0
call fcn.1000a670
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0xa0], 0x3a243d77
mov dword [ebp - 0x9c], 0x3c3e2430
mov word [ebp - 0x98], 0x64
mov byte [ebp - 0x96], 1
mov dword [ebp - 0xd4], 0x39323c77
mov dword [ebp - 0xd0], 0x1006b30
mov dword [ebp - 0xcc], 0x27323a77
mov dword [ebp - 0xc8], 0x1006b3d
mov dword [ebp - 0xb0], 0x26362477
mov word [ebp - 0xac], 0x68
mov byte [ebp - 0xaa], 1
mov dword [ebp - 0xbc], 0x31232b25
mov dword [ebp - 0xb8], 0x31393f68
mov word [ebp - 0xb4], 0x2d
mov byte [ebp - 0xb2], 1
mov al, cl
add al, 0x51
xor byte [ebp + ecx - 0xb0], al
inc ecx
cmp ecx, 5
jb 0x10006144
push ecx
lea eax, [ebp - 0xab]
mov byte [ebp - 0xaa], 0
push eax
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x40]
call fcn.1000a080
mov byte [ebp - 4], 1
cmp byte [ebp - 0xb2], 0
je 0x1000619a
xor ecx, ecx
mov al, cl
add al, 0x51
xor byte [ebp + ecx - 0xbc], al
inc ecx
cmp ecx, 9
jb 0x10006182
mov byte [ebp - 0xb2], 0
push ecx
lea eax, [ebp - 0xb3]
push eax
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x88]
call fcn.1000a080
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x104]
call fcn.1000b6c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x74]
cmp ecx, 0xf
jbe 0x1000620f
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006205
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100065d4
push ecx
push edx
call fcn.100fec39
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10006247
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000623d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100065d4
push ecx
push edx
call fcn.100fec39
add esp, 8
lea eax, [esi + 0x4c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x104]
call fcn.10008960
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xcc]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x14c]
call fcn.10006dd0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 5
lea edx, [ebp - 0x70]
cmp dword [ebp - 0x5c], 0xf
mov ecx, dword [esi + 0x10]
cmova edx, dword [ebp - 0x70]
mov eax, dword [esi + 0x14]
mov edi, dword [ebp - 0x60]
sub eax, ecx
mov dword [ebp - 0xc0], ecx
cmp edi, eax
ja 0x100062f9
cmp dword [esi + 0x14], 0xf
lea eax, [ecx + edi]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [ebp - 0xd8], esi
jbe 0x100062da
mov eax, dword [esi]
mov dword [ebp - 0xd8], eax
push edi
add eax, ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0xd8]
add esp, 0xc
add eax, dword [ebp - 0xc0]
mov byte [eax + edi], 0
jmp 0x10006312
push edi
push edx
mov byte [ebp - 0xc0], 0
mov ecx, esi
push dword [ebp - 0xc0]
push edi
call fcn.1000a510
mov esi, eax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x17c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x16c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x17c]
lea ecx, [ebp - 0x134]
call fcn.10006dd0
add esp, 4
mov byte [ebp - 4], 7
mov edi, dword [ebp - 0xc4]
lea ecx, [edi + 4]
push ecx
mov ecx, eax
call fcn.10008960
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x164], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x154], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0x164]
lea ecx, [ebp - 0x11c]
call fcn.10006ef0
add esp, 4
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 9
push ecx
mov ecx, eax
call fcn.10008960
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x78], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x108]
cmp ecx, 0xf
jbe 0x10006427
mov edx, dword [ebp - 0x11c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000641d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100065d4
push ecx
push edx
call fcn.100fec39
add esp, 8
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0xf
mov byte [ebp - 0x11c], 0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x150]
cmp ecx, 0xf
jbe 0x10006480
mov edx, dword [ebp - 0x164]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006476
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100065d4
push ecx
push edx
call fcn.100fec39
add esp, 8
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x120]
cmp ecx, 0xf
jbe 0x100064be
mov edx, dword [ebp - 0x134]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100064b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100065d4
push ecx
push edx
call fcn.100fec39
add esp, 8
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0xf
mov byte [ebp - 0x134], 0
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x168]
cmp ecx, 0xf
jbe 0x10006517
mov edx, dword [ebp - 0x17c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000650d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100065d4
push ecx
push edx
call fcn.100fec39
add esp, 8
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x138]
cmp ecx, 0xf
jbe 0x10006555
mov edx, dword [ebp - 0x14c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000654b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100065d4
push ecx
push edx
call fcn.100fec39
add esp, 8
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0xf
mov byte [ebp - 0x14c], 0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x100065a4
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000659a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100065d4
push ecx
push edx
call fcn.100fec39
add esp, 8
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0xf0]
cmp ecx, 0xf
jbe 0x100065e4
mov edx, dword [ebp - 0x104]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100065da
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100065da
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100fec39
add esp, 8
sub esp, 0x18
mov dword [ebp - 0xf4], 0
lea eax, [edi + 0x7c]
mov dword [ebp - 0xc4], esp
mov ecx, esp
mov dword [ebp - 0xf0], 0xf
mov byte [ebp - 0x104], 0
push eax
call fcn.10008af0
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea eax, [edi + 0x64]
mov dword [ebp - 0xc0], esp
mov ecx, esp
push eax
call fcn.10008af0
sub esp, 0x18
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x88]
mov ecx, esp
push eax
call fcn.10008af0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x11
call fcn.10007fa0
add esp, 0x48
mov byte [ebp - 4], 0x14
mov esi, 0x54
movaps xmm0, xmmword [0x10173790]
movaps xmm4, xmmword [0x10173750]
movups xmmword [ebp - 0xec], xmm0
mov byte [ebp - 0xdc], 1
lea eax, [esi - 1]
movd xmm2, esi
lea edx, [esi - 3]
movd xmm0, eax
movd xmm3, edx
lea ecx, [esi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [ebp + esi - 0x140]
punpcklbw xmm0, xmm0
movd xmm1, ecx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebp + esi - 0x140], xmm3
add esi, 4
cmp esi, 0x60
jb 0x10006674
mov ecx, 0xc
mov al, cl
add al, 0x51
xor byte [ebp + ecx - 0xec], al
inc ecx
cmp ecx, 0xf
jb 0x100066d3
cmp dword [ebp - 0x44], 0xf
lea eax, [ebp - 0x58]
mov byte [ebp - 0xdc], 0
lea ecx, [ebp - 0xec]
cmova eax, dword [ebp - 0x58]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10006720
test dl, dl
je 0x1000671c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10006720
add eax, 2
add ecx, 2
test dl, dl
jne 0x10006700
xor eax, eax
jmp 0x10006725
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006bfa
sub esp, 0x28
lea edx, [ebp - 0x58]
mov eax, esp
lea ecx, [ebp - 0x28]
push 0
push 1
mov dword [eax + 0x24], 0
call fcn.1000a1a0
add esp, 0x30
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0xa8]
call fcn.10008520
push str.success
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x16
call fcn.10009ce0
mov ecx, eax
call fcn.10009ff0
push str.message
lea ecx, [ebp - 0xa8]
mov byte [edi + 0x1c4], al
call fcn.10009ce0
push eax
lea ecx, [edi + 0x1c8]
call fcn.10009e40
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x15
call fcn.100084c0
push str.success
lea ecx, [ebp - 0x28]
call fcn.10009ce0
mov ecx, eax
call fcn.10009ff0
lea ecx, [ebp - 0x28]
test al, al
je 0x10006952
push str.sessionid
mov byte [edi + 2], 1
call fcn.10009ce0
push eax
lea ecx, [edi + 0x1e0]
call fcn.10009e40
push str.appinfo
lea ecx, [ebp - 0x28]
call fcn.10009ce0
push eax
lea ecx, [ebp - 0xa8]
call fcn.10008520
push str.numUsers
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x17
call fcn.10009ce0
push eax
lea ecx, [edi + 0xb0]
call fcn.10009e40
push str.numOnlineUsers
lea ecx, [ebp - 0xa8]
call fcn.10009ce0
push eax
lea ecx, [edi + 0xc8]
call fcn.10009e40
push str.numKeys
lea ecx, [ebp - 0xa8]
call fcn.10009ce0
push eax
lea ecx, [edi + 0xe0]
call fcn.10009e40
push str.version
lea ecx, [ebp - 0xa8]
call fcn.10009ce0
push eax
lea ecx, [edi + 0xf8]
call fcn.10009e40
push str.customerPanelLink
lea ecx, [ebp - 0xa8]
call fcn.10009ce0
push eax
lea ecx, [edi + 0x110]
call fcn.10009e40
lea ecx, [ebp - 0xa8]
call fcn.100084c0
lea ecx, [ebp - 0x28]
call fcn.100084c0
mov ecx, dword [ebp - 0x44]
cmp ecx, 0xf
jbe 0x100068d3
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100068c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000694c
push ecx
push edx
call fcn.100fec39
add esp, 8
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp ecx, 0xf
jbe 0x10006918
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000690e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000694c
push ecx
push edx
call fcn.100fec39
add esp, 8
mov eax, dword [ebp - 0x5c]
cmp eax, 0xf
jbe 0x10006b70
mov edx, dword [ebp - 0x70]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x10006b66
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10006b66
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push str.message
call fcn.10009ce0
mov edi, eax
mov byte [ebp - 4], 0x18
xorps xmm0, xmm0
push 0x18
movq qword [ebp - 0xa0], xmm0
mov byte [ebp - 0xa8], 3
call fcn.100fe8ef
add esp, 4
mov esi, eax
xorps xmm0, xmm0
mov ecx, esi
push 0xa
movups xmmword [esi], xmm0
push str.invalidver
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.1000a670
lea edx, [ebp - 0xa8]
mov dword [ebp - 0xa0], esi
mov ecx, edi
call fcn.1000b2f0
lea ecx, [ebp - 0xa8]
mov byte [ebp - 0x89], al
call fcn.100084c0
cmp byte [ebp - 0x89], 0
mov byte [ebp - 4], 0x15
je 0x10006897
push str.download
lea ecx, [ebp - 0x28]
call fcn.10009ce0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.10009ef0
mov edx, 0x1011425f
lea ecx, [ebp - 0x40]
call fcn.10009ca0
test al, al
je 0x10006b42
movaps xmm0, xmmword [0x101737b0]
lea ecx, [ebp - 0x300]
movups xmmword [ebp - 0x300], xmm0
push 0x10
movaps xmm0, xmmword [0x101737e0]
movups xmmword [ebp - 0x2f0], xmm0
push 0
movaps xmm0, xmmword [0x10173e50]
movups xmmword [ebp - 0x2e0], xmm0
mov dword [ebp - 0x1d0], 0xfdeff6e2
movaps xmm0, xmmword [0x10173ea0]
movups xmmword [ebp - 0x2d0], xmm0
mov word [ebp - 0x1cc], 0xab
movaps xmm0, xmmword [0x10173e80]
movups xmmword [ebp - 0x2c0], xmm0
mov byte [ebp - 0x1ca], 1
movaps xmm0, xmmword [0x10173e70]
movups xmmword [ebp - 0x2b0], xmm0
movaps xmm0, xmmword [0x10173e90]
movups xmmword [ebp - 0x2a0], xmm0
movaps xmm0, xmmword [0x10173e60]
movups xmmword [ebp - 0x290], xmm0
movaps xmm0, xmmword [0x10173e00]
movups xmmword [ebp - 0x280], xmm0
movaps xmm0, xmmword [0x10173e40]
movups xmmword [ebp - 0x270], xmm0
movaps xmm0, xmmword [0x10173db0]
movups xmmword [ebp - 0x260], xmm0
movaps xmm0, xmmword [0x10173dc0]
movups xmmword [ebp - 0x250], xmm0
movaps xmm0, xmmword [0x10173d40]
movups xmmword [ebp - 0x240], xmm0
movaps xmm0, xmmword [0x10173cd0]
movups xmmword [ebp - 0x230], xmm0
movaps xmm0, xmmword [0x10173800]
movups xmmword [ebp - 0x220], xmm0
movaps xmm0, xmmword [0x10173810]
movups xmmword [ebp - 0x210], xmm0
movaps xmm0, xmmword [0x101737c0]
movups xmmword [ebp - 0x200], xmm0
movaps xmm0, xmmword [0x101737d0]
movups xmmword [ebp - 0x1f0], xmm0
movaps xmm0, xmmword [0x10173eb0]
movups xmmword [ebp - 0x1e0], xmm0
call fcn.10007010
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10006b5e
push 1
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.100088e0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push ecx
push edx
call fcn.100fec39
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100fe801
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
movaps xmm0, xmmword [0x10173cb0]
lea ecx, [ebp - 0x1c8]
movups xmmword [ebp - 0x1c8], xmm0
push 0x10
movaps xmm0, xmmword [0x10173da0]
movups xmmword [ebp - 0x1b8], xmm0
push 0
movaps xmm0, xmmword [0x10173ec0]
movups xmmword [ebp - 0x1a8], xmm0
mov dword [ebp - 0x188], 0xf7bdfcf8
movaps xmm0, xmmword [0x10173ed0]
movups xmmword [ebp - 0x198], xmm0
mov dword [ebp - 0x184], 0x100e6e5
call fcn.10006c30
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movaps xmm0, xmmword [0x101737a0]
lea ecx, [ebp - 0xa8]
sub esp, 0x18
mov word [ebp - 0x98], 0x15
movups xmmword [ebp - 0xa8], xmm0
mov byte [ebp - 0x96], 1
push esp
call fcn.100082b0
call fcn.10005fb0
int3