Function at 0x10008390
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10021100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xe9
push 0x1000dbd0
push 0x40e5f7
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d2a0
push 0x419605
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d390
push 0x408b0c
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000c710
push 0x43840b
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000c820
push 0x4220b1
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000cea0
push 0x40427d
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d4e0
push 0x41248b
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d050
push 0x4045e3
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000cab0
push 0x433343
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d900
push 0x41f488
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000ce10
push 0x40e0ca
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d160
push 0x4302e7
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d200
push 0x412341
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d450
push 0x41ff0f
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000c2b0
push 0x40e4e9
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000c4e0
push 0x4154d3
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d7e0
push 0x433203
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d870
push 0x4166da
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000cfb0
push 0x41ceea
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000c930
push 0x43bd18
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000ca00
push 0x407473
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000cd70
push 0x428358
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000c1c0
push 0x4045bb
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d790
push 0x40b89d
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d680
push 0x407d56
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d6d0
push 0x404331
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d750
push 0x40dfe4
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d710
push 0x436a84
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d640
push 0x40a1d2
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000d5f0
push 0x4340d1
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000c220
push 0x434734
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000c130
push 0x4059ac
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000bd90
push 0x431949
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 1
push 0x10021a00
push 5
push 0xe9
push 0x10005bb0
push 0x430431
call fcn.10008290
mov ecx, eax
call fcn.100074c0
push 0xe9
push 0x10005b30
push 0x465237
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10005ed0
push 0x414d58
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100068b0
push 0x40940d
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000bd10
push 0x42685a
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003660
push 0x427b38
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003a80
push 0x404ebc
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100034b0
push 0x41dbb0
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 1
push 0x10021a04
push 5
push 0xe9
push 0x1000bae0
push 0x42b4a4
call fcn.10008290
mov ecx, eax
call fcn.100074c0
push 1
push 0x10021a08
push 5
push 0xe9
push 0x1000baa0
push 0x40b1b8
call fcn.10008290
mov ecx, eax
call fcn.100074c0
push 0xe9
push 0x1000bb10
push 0x417c10
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100014f0
push 0x40aa10
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10002cc0
push 0x432c40
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003070
push 0x438433
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10001520
push 0x419119
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100024d0
push 0x401e5b
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10002cd0
push 0x40fa1a
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100028d0
push 0x4011bd
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10002d80
push 0x404598
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10002dd0
push 0x42d2d1
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10002f40
push 0x4011ef
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100026a0
push 0x4047d7
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10008330
push 0x40aa10
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000a630
push 0x430bc5
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000a740
push 0x40c9a5
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000a7c0
push 0x43615b
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000a880
push 0x434699
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000b9a0
push 0x42986b
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10005180
push 0x41bb17
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10005220
push 0x4053da
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10009510
push 0x4206f8
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000e060
push 0x8d4e30
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000de80
push 0x42ce8a
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100014d0
push 0x40a12d
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100072b0
push 0x404fb6
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10006e40
push 0x4051a0
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100081f0
push 0x414b1e
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10005b10
push 0x42e843
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10005a20
push 0x427147
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100059f0
push 0x435b57
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x1000e190
push 0x414b1e
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003ed0
push 0x429555
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003f40
push 0x41ae29
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003f50
push 0x431930
call fcn.10008290
mov ecx, eax
call fcn.10007450
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x8d46fc
call esi
lea eax, [ebp - 0xc]
mov byte [0x8d46fc], 0x3c
push eax
push dword [ebp - 0xc]
push 1
push 0x8d46fc
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x484457
call esi
lea eax, [ebp - 0xc]
mov byte [0x484457], 0x3c
push eax
push dword [ebp - 0xc]
push 1
push 0x484457
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x484457
call esi
lea eax, [ebp - 8]
mov byte [0x484457], 0x41
push eax
push dword [ebp - 8]
push 1
push 0x484457
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x8d46fc
call esi
lea eax, [ebp - 8]
mov byte [0x8d46fc], 0x41
push eax
push dword [ebp - 8]
push 1
push 0x8d46fc
call esi
push 0xe9
push 0x10003e00
push 0x8d456c
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003df0
push 0x8d4703
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003be0
push 0x421828
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003cb0
push 0x4083c3
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10003e20
push 0x42fcfc
call fcn.10008290
mov ecx, eax
call fcn.10007450
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4843e5
call esi
lea eax, [ebp - 8]
mov dword [0x4843e5], 0x10021a10
push eax
push dword [ebp - 8]
push 4
push 0x4843e5
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4843fc
call esi
lea eax, [ebp - 8]
mov dword [0x4843fc], 0x10021a10
push eax
push dword [ebp - 8]
push 4
push 0x4843fc
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x48441d
call esi
lea eax, [ebp - 8]
mov dword [0x48441d], 0x10021a10
push eax
push dword [ebp - 8]
push 4
push 0x48441d
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x484474
call esi
lea eax, [ebp - 8]
mov dword [0x484474], 0x10021b00
push eax
push dword [ebp - 8]
push 4
push 0x484474
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x484464
call esi
lea eax, [ebp - 8]
mov dword [0x484464], 0x10021bf0
push eax
push dword [ebp - 8]
push 4
push 0x484464
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x484893
call esi
lea eax, [ebp - 8]
mov dword [0x484893], 0x10021bf0
push eax
push dword [ebp - 8]
push 4
push 0x484893
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4848b5
call esi
lea eax, [ebp - 8]
mov dword [0x4848b5], 0x10021bf0
push eax
push dword [ebp - 8]
push 4
push 0x4848b5
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x484a1f
call esi
lea eax, [ebp - 8]
mov dword [0x484a1f], 0x10021ce0
push eax
push dword [ebp - 8]
push 4
push 0x484a1f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4bc1a0
call esi
lea eax, [ebp - 8]
mov dword [0x4bc1a0], 0x10021ce0
push eax
push dword [ebp - 8]
push 4
push 0x4bc1a0
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4bc23a
call esi
lea eax, [ebp - 8]
mov dword [0x4bc23a], 0x10021ce0
push eax
push dword [ebp - 8]
push 4
push 0x4bc23a
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x484c77
call esi
lea eax, [ebp - 8]
mov dword [0x484c77], 0x10021dd0
push eax
push dword [ebp - 8]
push 4
push 0x484c77
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x8d4574
call esi
lea eax, [ebp - 8]
mov byte [0x8d4574], 0
push eax
push dword [ebp - 8]
push 1
push 0x8d4574
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x8d45ae
call esi
lea eax, [ebp - 8]
mov byte [0x8d45ae], 0
push eax
push dword [ebp - 8]
push 1
push 0x8d45ae
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x8d45bd
call esi
lea eax, [ebp - 8]
mov edi, 0xf0
push eax
mov word [0x8d45bd], di
push dword [ebp - 8]
push 2
push 0x8d45bd
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x8d45f8
call esi
lea eax, [ebp - 8]
mov word [0x8d45f8], di
push eax
push dword [ebp - 8]
push 2
push 0x8d45f8
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x8d45ff
call esi
lea eax, [ebp - 8]
mov edi, 0x1e0
push eax
mov word [0x8d45ff], di
push dword [ebp - 8]
push 2
push 0x8d45ff
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x8d463d
call esi
lea eax, [ebp - 8]
mov word [0x8d463d], di
push eax
push dword [ebp - 8]
push 2
push 0x8d463d
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x8d4678
call esi
lea eax, [ebp - 8]
mov edi, 0x2d0
push eax
mov word [0x8d4678], di
push dword [ebp - 8]
push 2
push 0x8d4678
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x8d46b3
call esi
lea eax, [ebp - 8]
mov word [0x8d46b3], di
push eax
push dword [ebp - 8]
push 2
push 0x8d46b3
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x8d46ba
call esi
lea eax, [ebp - 8]
mov edi, 0x3c0
push eax
mov word [0x8d46ba], di
push dword [ebp - 8]
push 2
push 0x8d46ba
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x8d46f5
call esi
lea eax, [ebp - 8]
mov word [0x8d46f5], di
push eax
push dword [ebp - 8]
push 2
push 0x8d46f5
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x6ce7ce
call esi
lea eax, [ebp - 8]
mov dword [0x6ce7ce], 0x9013f883
push eax
push dword [ebp - 8]
push 4
push 0x6ce7ce
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x6ce7d2
call esi
lea eax, [ebp - 8]
mov edi, 0x9090
push eax
mov word [0x6ce7d2], di
push dword [ebp - 8]
push 2
push 0x6ce7d2
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x6ce4bb
call esi
lea eax, [ebp - 8]
mov dword [0x6ce4bb], 0x9013fb83
push eax
push dword [ebp - 8]
push 4
push 0x6ce4bb
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x6ce4bf
call esi
lea eax, [ebp - 8]
mov word [0x6ce4bf], di
push eax
push dword [ebp - 8]
push 2
push 0x6ce4bf
call esi
push 0xe9
push 0x10009590
push 0x41740e
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100097e0
push 0x4107c1
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10007810
push 0x40996c
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10007af0
push 0x42b6d9
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10007e80
push 0x434739
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100076c0
push 0x42ffb8
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100075a0
push 0x410c0d
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10005730
push 0x40a54c
call fcn.10008290
mov ecx, eax
call fcn.10007450
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4da190
call esi
lea eax, [ebp - 8]
mov dword [0x4da190], 0x90909090
push eax
push dword [ebp - 8]
push 4
push 0x4da190
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x4da194
call esi
lea eax, [ebp - 8]
mov word [0x4da194], di
push eax
push dword [ebp - 8]
push 2
push 0x4da194
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x4da196
call esi
lea eax, [ebp - 8]
mov byte [0x4da196], 0x90
push eax
push dword [ebp - 8]
push 1
push 0x4da196
call esi
push 0xe9
push 0x10001010
push 0x41e4ed
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x100098b0
push 0x4da970
call fcn.10008290
mov ecx, eax
call fcn.10007450
push 0xe9
push 0x10004240
push 0x409467
call fcn.10008290
mov ecx, eax
call fcn.10007450
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x690647
call esi
lea eax, [ebp - 8]
mov word [0x690647], di
push eax
push dword [ebp - 8]
push 2
push 0x690647
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x690649
call esi
lea eax, [ebp - 8]
mov dword [0x690649], 0x90909090
push eax
push dword [ebp - 8]
push 4
push 0x690649
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x690630
call esi
lea eax, [ebp - 8]
mov word [0x690630], di
push eax
push dword [ebp - 8]
push 2
push 0x690630
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x690632
call esi
lea eax, [ebp - 8]
mov dword [0x690632], 0x90909090
push eax
push dword [ebp - 8]
push 4
push 0x690632
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x72bae2
call esi
lea eax, [ebp - 8]
mov dword [0x72bae2], 0
push eax
push dword [ebp - 8]
push 4
push 0x72bae2
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x484457
call esi
lea eax, [ebp - 8]
mov byte [0x484457], 0x3c
push eax
push dword [ebp - 8]
push 1
push 0x484457
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x8d46fc
call esi
lea eax, [ebp - 8]
mov byte [0x8d46fc], 0x3c
push eax
push dword [ebp - 8]
push 1
push 0x8d46fc
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x5daf3a
call esi
lea eax, [ebp - 8]
mov byte [0x5daf3a], 0x7f
push eax
push dword [ebp - 8]
push 1
push 0x5daf3a
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x5db06c
call esi
lea eax, [ebp - 8]
mov byte [0x5db06c], 0x7f
push eax
push dword [ebp - 8]
push 1
push 0x5db06c
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xb66ed8
call esi
lea eax, [ebp - 8]
mov dword [0xb66ed8], 0x1f4
push eax
push dword [ebp - 8]
push 4
push 0xb66ed8
call esi
push str.SeDebugPrivilege
call fcn.100058b0
add esp, 4
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x14
push 0x43d30c
call esi
mov dword [0x43d30c], 0x4c470000
mov dword [0x43d310], 0x47460000
mov dword [0x43d314], 0x44520000
mov dword [0x43d318], 0x4d420000
lea eax, [ebp - 0xc]
mov dword [0x43d31c], 0x5333
push eax
push dword [ebp - 0xc]
push 0x14
push 0x43d30c
call esi
push str.NoPing1.exe
call fcn.10005950
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 0xffffffff
je 0x100094af
push 0x30
push str.Process_found
push str.You_are_using_proxy._Please_contact_admin
push 0
call esi
push 0
push 0xffffffffffffffff
call edi
push str.Pingzapper1.exe
call fcn.10005950
add esp, 4
cmp eax, 0xffffffff
je 0x100094d7
push 0x30
push str.Process_found
push str.You_are_using_proxy._Please_contact_admin
push 0
call esi
push 0
push 0xffffffffffffffff
call edi
push str.ExitLag1.exe
call fcn.10005950
add esp, 4
cmp eax, 0xffffffff
je 0x100094ff
push 0x30
push str.Process_found
push str.You_are_using_proxy._Please_contact_admin
push 0
call esi
push 0
push 0xffffffffffffffff
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000e22a
mov esp, ebp
pop ebp
ret