Function at 0x100d93b0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check os version
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Get common file path
Get number of processors
Spawn thread to rwx shellcode
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177300
mov eax, dword fs:[0]
push eax
sub esp, 0xc2c
mov eax, dword [0x101cfdb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100d9000
push dword [sym.imp.KERNEL32.dll_CreateFileA]
call fcn.100020f0
push 0
push 0
push 0
push 0x100dc050
push 0
push 0
mov dword [0x102710ac], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push eax
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0xab0]
call fcn.10046250
push ecx
push 0x101aed4c
lea ecx, [ebp - 0xab0]
call fcn.10045ea0
push eax
push 0
lea eax, [ebp - 0xae8]
push eax
lea ecx, [ebp - 0xab0]
call fcn.10045dd0
lea ecx, [ebp - 0xab0]
call fcn.100432e0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100d947b
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.100479d0
add esp, 8
mov ecx, 0x102a2d38
call fcn.100432e0
mov eax, dword [0x102a2d50]
cmp eax, 0x10
jb 0x100d94d5
inc eax
push eax
push dword [0x102a2d3c]
call fcn.100479d0
add esp, 8
lea eax, [ebp - 0xae8]
mov dword [0x102a2d4c], 0
push eax
mov ecx, 0x102a2d38
mov dword [0x102a2d50], 0xf
mov byte [0x102a2d3c], 0
call fcn.10046f40
lea ecx, [ebp - 0xae8]
call fcn.100432e0
mov eax, dword [ebp - 0xad0]
cmp eax, 0x10
jb 0x100d9527
inc eax
push eax
push dword [ebp - 0xae4]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xae8]
push 8
push eax
mov dword [ebp - 0xad4], 0
mov dword [ebp - 0xad0], 0xf
mov byte [ebp - 0xae4], 0
mov dword [ebp - 0xae8], 0
call fcn.100479d0
movaps xmm0, xmmword [0x101b7720]
add esp, 8
movups xmmword [ebp - 0xae0], xmm0
mov word [ebp - 0xad0], 0x213c
xor ecx, ecx
mov byte [ebp - 0xace], 0
nop dword [eax]
mov al, byte [ebp - 0xae0]
xor byte [ebp + ecx - 0xadf], al
inc ecx
cmp ecx, 0x11
jb 0x100d9580
mov edx, dword [0x102a2d4c]
lea ecx, [ebp - 0xadf]
mov byte [ebp - 0xace], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d95b0
mov edi, 0x7fffffff
sub ecx, esi
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x100da8b8
cmp dword [0x102a2d50], 0x10
mov eax, 0x102a2d3c
push ecx
cmovae eax, dword [0x102a2d3c]
lea ecx, [ebp - 0xadf]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xacc]
call fcn.10047c30
cmp dword [ebp - 0xab4], 0x10
lea eax, [ebp - 0xac8]
lea ecx, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xac8]
sub esp, 8
push 1
push eax
call fcn.10045b30
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xd0]
mov eax, dword [eax + 4]
mov ebx, dword [ebp + eax - 0xc4]
call fcn.10043ff0
test bl, 6
je 0x100d97c7
mov cl, 0x78
mov dword [ebp - 0xa8c], 0xa0a3d78
mov word [ebp - 0xa88], 0xa17
xor eax, eax
mov byte [ebp - 0xa86], 0
xor byte [ebp + eax - 0xa8b], cl
inc eax
cmp eax, 5
jae 0x100d9675
mov cl, byte [ebp - 0xa8c]
jmp 0x100d9660
movaps xmm0, xmmword [0x101b82a0]
xor ecx, ecx
mov byte [ebp - 0xa86], 0
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xaa0], 0x7e713f7a
mov dword [ebp - 0xa9c], 0x763f7a72
mov dword [ebp - 0xa98], 0x737e6971
mov word [ebp - 0xa94], 0x7b76
mov byte [ebp - 0xa92], 0
nop word [eax + eax]
mov al, byte [ebp - 0xab0]
xor byte [ebp + ecx - 0xaaf], al
inc ecx
cmp ecx, 0x1d
jb 0x100d96c0
lea eax, [ebp - 0xa8b]
mov byte [ebp - 0xa92], 0
push 0x30
push eax
lea eax, [ebp - 0xaaf]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov esi, esp
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.10047940
add esp, 4
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [esi + 0x14], 0
push 0
mov dword [esi + 0x18], 0xf
push 0x101aec64
mov byte [esi + 4], 0
call fcn.10046d30
call fcn.100d8de0
add esp, 0x1c
lea ecx, [ebp - 0xacc]
call fcn.100432e0
mov eax, dword [ebp - 0xab4]
cmp eax, 0x10
jb 0x100d9775
inc eax
push eax
push dword [ebp - 0xac8]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xacc]
push 8
push eax
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0xab4], 0xf
mov byte [ebp - 0xac8], 0
mov dword [ebp - 0xacc], 0
call fcn.100479d0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101163c0
mov esp, ebp
pop ebp
ret
push 0
push 2
xor bl, bl
mov dword [ebp - 0xc30], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xc30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x100d99ac
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0xc30]
push eax
push esi
call edi
cmp eax, 1
jne 0x100d99a7
nop
push 8
mov byte [ebp - 0xc31], bl
mov dword [ebp - 0xab0], 0
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0
call fcn.10047940
lea ecx, [ebp - 0xab0]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0xc0c]
mov dword [eax + 4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d9881
sub ecx, edx
lea eax, [ebp - 0xc0c]
push ecx
push eax
lea ecx, [ebp - 0xab0]
call fcn.10046d30
movaps xmm0, xmmword [0x101b7370]
xor ecx, ecx
movups xmmword [ebp - 0xae0], xmm0
mov word [ebp - 0xad0], 0xd
nop word [eax + eax]
mov al, byte [ebp - 0xae0]
xor byte [ebp + ecx - 0xadf], al
inc ecx
cmp ecx, 0x10
jb 0x100d98c0
lea edx, [ebp - 0xadf]
mov byte [ebp - 0xacf], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100d98e3
sub edx, ecx
lea eax, [ebp - 0xadf]
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xaac]
push edx
cmovae ecx, dword [ebp - 0xaac]
mov edx, dword [ebp - 0xa9c]
push eax
push 0
call fcn.10084d50
lea ecx, [ebx + 1]
add esp, 0xc
movzx ebx, cl
cmp eax, 0xffffffff
movzx ecx, byte [ebp - 0xc31]
cmove ebx, ecx
lea ecx, [ebp - 0xab0]
call fcn.100432e0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100d9951
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.100479d0
add esp, 8
lea eax, [ebp - 0xc30]
push eax
push esi
call edi
cmp eax, 1
je 0x100d9810
cmp bl, 3
jbe 0x100d99a7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, 0x7fffffff
mov cl, 0x5e
mov dword [ebp - 0xa90], 0x71c025e
mov dword [ebp - 0xa8c], 0xd1d1f0c
xor eax, eax
mov dword [ebp - 0xa88], 0x32323a70
mov byte [ebp - 0xa84], 0
xor byte [ebp + eax - 0xa8f], cl
inc eax
cmp eax, 0xb
jae 0x100d99ea
mov cl, byte [ebp - 0xa90]
jmp 0x100d99d5
mov edx, dword [0x102a2d4c]
lea ecx, [ebp - 0xa8f]
mov byte [ebp - 0xa84], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d9a00
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100da8b8
cmp dword [0x102a2d50], 0x10
mov eax, 0x102a2d3c
push ecx
cmovae eax, dword [0x102a2d3c]
lea ecx, [ebp - 0xa8f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xab0]
call fcn.10047c30
lea ecx, [ebp - 0xacc]
call fcn.100432e0
mov eax, dword [ebp - 0xab4]
cmp eax, 0x10
jb 0x100d9a6a
inc eax
push eax
push dword [ebp - 0xac8]
call fcn.100479d0
add esp, 8
lea eax, [ebp - 0xab0]
mov dword [ebp - 0xab8], 0
push eax
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xab4], 0xf
mov byte [ebp - 0xac8], 0
call fcn.10046f40
lea ecx, [ebp - 0xab0]
call fcn.100432e0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100d9abd
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.100479d0
cmp dword [ebp - 0xab4], 0x10
lea eax, [ebp - 0xac8]
push 1
cmovae eax, dword [ebp - 0xac8]
lea ecx, [ebp - 0xd0]
push eax
call fcn.10045b30
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xd0]
mov eax, dword [eax + 4]
mov ebx, dword [ebp + eax - 0xc4]
call fcn.10043ff0
test bl, 6
je 0x100d9be3
movaps xmm0, xmmword [0x101b7ae0]
xor ecx, ecx
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xaa0], 0x5c387651
mov dword [ebp - 0xa9c], 0x7b7d6a71
mov dword [ebp - 0xa98], 0x616a776c
mov byte [ebp - 0xa94], 0
nop dword [eax + eax]
mov al, byte [ebp - 0xab0]
xor byte [ebp + ecx - 0xaaf], al
inc ecx
cmp ecx, 0x1b
jb 0x100d9b70
mov byte [ebp - 0xa94], 0
mov cl, 0x49
mov dword [ebp - 0xa90], 0x100b1549
xor eax, eax
mov dword [ebp - 0xa8c], 0x1a0a081b
mov dword [ebp - 0xa88], 0x25252d67
mov byte [ebp - 0xa84], 0
xor byte [ebp + eax - 0xa8f], cl
inc eax
cmp eax, 0xb
jae 0x100d9bc8
mov cl, byte [ebp - 0xa90]
jmp 0x100d9bb3
lea eax, [ebp - 0xaaf]
mov byte [ebp - 0xa84], 0
push 0x30
push eax
lea eax, [ebp - 0xa8f]
jmp 0x100d96e9
push 0x64
lea eax, [ebp - 0x280]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push 8
mov dword [ebp - 0xb00], 0
call fcn.10047940
lea ecx, [ebp - 0xb04]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0x280]
mov dword [eax + 4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d9c51
sub ecx, edx
lea eax, [ebp - 0x280]
push ecx
push eax
lea ecx, [ebp - 0xb04]
call fcn.10046d30
push 0x558
call fcn.101166d0
mov edx, dword [0x102a2d4c]
mov cl, 0x6a
mov dword [ebp - 0xa88], eax
mov al, 0x36
xor cl, al
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x17], cl
sub esp, 0x18
lea ecx, [ebp - 0x17]
mov byte [ebp - 0x18], al
mov byte [ebp - 0x16], 0
lea esi, [ecx + 1]
mov dword [ebp - 0xc38], esp
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d9ca6
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100da8b8
cmp dword [0x102a2d50], 0x10
mov eax, 0x102a2d3c
push ecx
cmovae eax, dword [0x102a2d3c]
lea ecx, [ebp - 0x17]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
mov ecx, dword [ebp - 0xc38]
call fcn.10047c30
mov ecx, dword [ebp - 0xa88]
call fcn.100cab00
push 0x30
mov dword [0x102710b4], eax
call fcn.101166d0
mov edx, dword [0x102a2d4c]
mov esi, eax
mov al, 0x7b
mov byte [ebp - 0x16], 0
mov cl, 0x27
mov byte [ebp - 0x18], al
add esp, 4
mov dword [ebp - 0xc38], esi
xor cl, al
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x17], cl
lea ecx, [ebp - 0x17]
lea eax, [ecx + 1]
mov dword [ebp - 0xa88], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d9d30
sub ecx, dword [ebp - 0xa88]
sub edi, edx
cmp edi, ecx
jb 0x100da8bd
cmp dword [0x102a2d50], 0x10
mov eax, 0x102a2d3c
push ecx
cmovae eax, dword [0x102a2d3c]
lea ecx, [ebp - 0x17]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xab0]
call fcn.10047c30
lea edi, [esi + 8]
mov dword [ebp - 4], 0
push 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.10047940
add esi, 0x24
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [eax + 4], 0
mov dword [edi], eax
mov dword [eax], edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10047940
add esp, 4
mov dword [eax], esi
mov dword [eax + 4], 0
push 0x40
mov dword [esi], eax
call fcn.10047940
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 4], eax
lea eax, [ebp - 0xab0]
cmp edi, eax
je 0x100d9e39
cmp dword [ebp - 0xa98], 0x10
lea eax, [ebp - 0xaac]
push dword [ebp - 0xa9c]
cmovae eax, dword [ebp - 0xaac]
mov ecx, edi
push eax
call fcn.10046d30
lea ecx, [ebp - 0xab0]
call fcn.100432e0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100d9e5f
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.100479d0
mov eax, dword [ebp - 0xc38]
add esp, 8
mov dword [0x102710b0], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0xa88], eax
mov edx, dword [ebp - 0xa88]
mov ecx, dword [0x102a2b80]
push str.BYRACS_Log.txt
mov eax, dword [edx + 0xa4]
mov dword [ecx + 0xe8], eax
mov eax, dword [edx + 0xa8]
mov dword [ecx + 0xec], eax
movzx eax, word [edx + 0xac]
mov word [ecx + 0xf0], ax
movzx eax, word [edx + 0xae]
mov word [ecx + 0xf2], ax
mov eax, dword [edx + 0xbc]
mov dword [ecx + 0x100], eax
mov eax, dword [edx + 0xb8]
mov dword [ecx + 0xfc], eax
mov eax, dword [edx + 0xb0]
mov dword [ecx + 0xf4], eax
mov eax, dword [edx + 0xb4]
mov dword [ecx + 0xf8], eax
call fcn.10136a40
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x218]
add esp, 4
push eax
push 0x200
call esi
push str.hostfix.bat
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.10138560
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x218]
push 0x101b4898
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10137890
mov eax, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
je 0x100d9fa3
push eax
call fcn.1012cbc0
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.101373e1
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.10136a40
add esp, 4
push 0x200
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.101193b0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x200
call esi
push str.ws2_32.dll
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.10138560
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x218]
push 0x101b4898
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10137890
mov eax, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
je 0x100da01e
push eax
call fcn.1012cbc0
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.10136a40
add esp, 4
push 0x400
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.101193b0
add esp, 0xc
push 0
push str.Oyun_ba
call fcn.100a2be0
push str.Mon_Sep__9_01:47:07_2024
push str.A510225
lea eax, [ebp - 0xa80]
push str.BYRACS_s
push eax
call fcn.100d55d0
add esp, 0x10
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.100a2be0
mov ecx, dword [0x102a2b80]
movzx eax, word [ecx + 0xf2]
push eax
movzx eax, word [ecx + 0xf0]
push eax
push dword [ecx + 0xec]
lea eax, [ebp - 0xa80]
push dword [ecx + 0xe8]
push str.Windows_s
push eax
call fcn.100d55d0
add esp, 0x18
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.100a2be0
push 0
push str.Ana_i
call fcn.100a2be0
push 0x400
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.101193b0
mov eax, dword [0x102a2b80]
add esp, 0xc
add eax, 0x25
xor eax, 0xffffffbb
imul eax, eax, 0xffffff94
and eax, 0xcc
push eax
lea eax, [ebp - 0x680]
push str._KK___x_
push eax
call fcn.100d55d0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
mov eax, dword [0x102a2b80]
mov eax, dword [eax + 0xb0]
xor eax, 0x2c
imul eax, eax, 0xfffffff5
and eax, 0x5d
push eax
lea eax, [ebp - 0x680]
push str._SZ1___x_
push eax
call fcn.10051760
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
mov eax, dword [0x102a2b80]
mov eax, dword [eax + 0xac]
xor eax, 0xfffffff2
imul eax, eax, 0xfffffff6
and eax, 0x14
push eax
lea eax, [ebp - 0x680]
push str._SZ2___x_
push eax
call fcn.100d55d0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
mov eax, dword [0x102a2b80]
mov eax, dword [eax + 0xb4]
xor eax, 0xffffffde
imul eax, eax, 0xfffffff1
and eax, 0x4e
push eax
lea eax, [ebp - 0x680]
push str._SZ3___x_
push eax
call fcn.100d55d0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
mov eax, dword [0x102a2b80]
push dword [eax + 0xc]
lea eax, [ebp - 0x680]
push str.CSRSS_process_id:__i
push eax
call fcn.100d55d0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
mov eax, dword [0x102a2b80]
push dword [eax + 0x10]
lea eax, [ebp - 0x680]
push str.WLG_process_id:__i
push eax
call fcn.100d55d0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
mov eax, dword [0x102a2b80]
mov eax, dword [eax + 0xa0]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x680]
push str._SM1___x_
push eax
call fcn.100d55d0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
mov eax, dword [0x102a2b80]
mov eax, dword [eax + 0x14]
xor eax, 0x67
imul eax, eax, 0xffffff88
and eax, 0xe3
push eax
lea eax, [ebp - 0x680]
push str._SM2___x_
push eax
call fcn.100d55d0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x102710a4], eax
test eax, eax
je 0x100da29f
lea eax, [ebp - 0x18]
push eax
call ebx
push eax
call dword [0x102710a4]
cmp dword [ebp - 0x18], 0
je 0x100da2c9
push 0
push str._x64__sistem_belirlendi
call fcn.100a2be0
push 0
push 0x101b59a0
call fcn.100a2be0
push 0
push str.Sistem_servisi_ba
call fcn.100a2be0
push 0
push str.Islemci_calisma_kumesi_olusturuldu.
call fcn.100a2be0
push 0
push str.Bellek_arayuzu_entegrasyonu_basladi
call fcn.100a2be0
push 0
push str.Bellek_arayuzu_entegrasyonu_tamamlandi
call fcn.100a2be0
push 0
push str.Essiz_kimlik_olusturuldu
call fcn.100a2be0
mov eax, dword [0x102a2b80]
mov eax, dword [eax + 0x2c]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x680]
push str.Yans
push eax
call fcn.100d55d0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a2be0
push 0
push str.AA_sistemi_aktif_edildi
call fcn.100a2be0
push 0
push str.Haklar_al
call fcn.100a2be0
lea eax, [ebp - 0x18]
push eax
push 0x20
call ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100da8a5
lea eax, [ebp - 0xa8c]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
test eax, eax
je 0x100da8d5
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xa88]
push 0
push 0x10
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xadc]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xad0], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100da8c2
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Haklar_elde_edildi
call fcn.100a2be0
push 0
push str.Sistem_ayarlar
call fcn.100a2be0
push 0x101b4e08
push str.kernel32.dll
call fcn.100a2ce0
push 0x101b4e1c
push str.kernel32.dll
call fcn.100a2ce0
push 0x101b5a70
push str.kernel32.dll
call fcn.100a2ce0
push 0x101b4e40
push str.kernel32.dll
call fcn.100a2ce0
push 0x101b4e30
push str.kernel32.dll
call fcn.100a2ce0
push 0x101b5ad4
push str.kernel32.dll
call fcn.100a2ce0
push 0x101b5aec
push str.Winmm.dll
call fcn.100a2ce0
push 0
push str.Sistem_segmentleri_kontrol_ediliyor
call fcn.100a2be0
mov ecx, dword [0x102710b4]
call fcn.100931c0
push 0
push str.Log_sistemi_aktif_ediliyor
call fcn.100a2be0
push 0
push str.Adres_y
call fcn.100a2be0
push 0
push str.Kimlik_y
call fcn.100a2be0
push 0
push str.Geni
call fcn.100a2be0
call fcn.100db060
push 0
push 0x101b5bd4
call fcn.100a2be0
push 0x3c
call fcn.101166d0
add esp, 4
mov ecx, eax
call fcn.100440f0
mov dword [0x10271090], eax
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
cmp esi, edi
je 0x100da576
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [eax]
push esi
lea ecx, [ebp - 0xab0]
call fcn.10046370
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xa88]
push ecx
push 0xf003f
lea eax, [ebp - 0xaac]
cmovae eax, dword [ebp - 0xaac]
push 0
push eax
push connect
call ebx
lea ecx, [ebp - 0xab0]
cmp eax, 2
jne 0x100da721
call fcn.100432e0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100da535
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.100479d0
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100da4d0
xor bh, bh
mov eax, dword [0x10271090]
mov esi, dword [eax + 0x14]
mov edi, dword [eax + 0x18]
cmp esi, edi
je 0x100da624
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0xab0]
call fcn.10046370
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xaac]
cmovae ecx, dword [ebp - 0xaac]
call fcn.10043fb0
lea ecx, [ebp - 0xab0]
test al, al
jne 0x100da77e
call fcn.100432e0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100da5e3
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.100479d0
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100da590
xor bl, bl
push 0
push str.PC_ban_sistemi_kontrol_ediliyor.
call fcn.100a2be0
test bh, bh
jne 0x100da7db
test bl, bl
jne 0x100da7db
mov eax, dword [0x101b58b4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x18], eax
mov ax, word [0x101b58b8]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xa88]
push eax
push 0x40
push 5
push 0x510de7
call esi
mov ecx, 0x510de7
mov byte [ebp - 0x18], 0xe9
mov eax, 0x100d9370
sub eax, 0x510dec
mov dword [ebp - 0x17], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
mov al, byte [ebp - 0x14]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc38]
push eax
push dword [ebp - 0xa88]
push 5
push ecx
call esi
push 0
push 0
push 0
push 0x100dbcf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.ClientPlugin_aktif_edildi.
call fcn.100a2be0
lea ecx, [ebp - 0xb04]
call fcn.100432e0
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x100da6e6
inc eax
push eax
push dword [ebp - 0xb00]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xb04]
push 8
push eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
call fcn.100479d0
add esp, 8
jmp 0x100d974f
call fcn.100432e0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100da741
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.100479d0
add esp, 8
mov bh, 1
jmp 0x100da578
call fcn.100432e0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100da79e
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.100479d0
add esp, 8
mov bl, 1
jmp 0x100da626
push 1
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
call fcn.100a2be0
sub esp, 0x1c
mov esi, esp
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.10047940
add esp, 4
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
push 0x39
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
call fcn.10046d30
call fcn.100d8de0
add esp, 0x1c
lea ecx, [ebp - 0xb04]
call fcn.100432e0
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x100da86a
inc eax
push eax
push dword [ebp - 0xb00]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0xb04]
push 8
push eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
call fcn.100479d0
add esp, 8
jmp 0x100d974f
push 0
push str.Haklar_elde_edilemedi
call fcn.100a2be0
push 0
call fcn.10135f80
call fcn.10043330
call fcn.10043330
push 0
push str.Haklar_elde_edilemedi__yetersiz_yetkilendirme
call fcn.100a2be0
push 0
call fcn.10135f80
push str.Haklar_elde_edilemedi__yetersiz_yetki_alani
call fcn.100a2be0
push 0
call fcn.10135f80
int3