Function at 0x1000df40
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10039140]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x466aaa
mov dword [ebp - 0x14], 0x1b8
mov word [ebp - 0x10], 0xc300
call edi
test eax, eax
je 0x1000df96
mov eax, dword [ebp - 0x14]
mov ecx, 0x466aaa
mov dword [ecx], eax
mov ax, word [ebp - 0x10]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x87c36f
call edi
test eax, eax
je 0x1000dfc0
lea eax, [ebp - 8]
mov byte [0x87c36f], 0x70
push eax
push dword [ebp - 8]
push 1
push 0x87c36f
call edi
push dword [0x10039094]
call fcn.10007c10
mov dword [0x1003a100], eax
lea eax, [ebp - 0x2c]
push 0x1003a618
push eax
call fcn.1000d6c0
mov esi, eax
add esp, 0xc
cmp esi, 0x10039034
je 0x1000e01d
mov ecx, 0x10039034
call fcn.10004af0
movups xmm0, xmmword [esi]
movups xmmword [0x10039034], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x10039044], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x1000e051
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000e047
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e9b9
push ecx
push edx
call fcn.1001307f
add esp, 8
cmp dword [0x10039048], 0xf
mov eax, 0x10039034
mov ecx, 0x1003a12c
cmova eax, dword [0x10039034]
mov dword [0x1003a134], eax
call fcn.100087c0
push 0xe9
push 0x10011fb0
push 0x40e5f7
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011680
push 0x419605
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011770
push 0x408b0c
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010af0
push 0x43840b
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010c00
push 0x4220b1
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011280
push 0x40427d
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100118c0
push 0x41248b
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011430
push 0x4045e3
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010e90
push 0x433343
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011ce0
push 0x41f488
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100111f0
push 0x40e0ca
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011540
push 0x4302e7
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100115e0
push 0x412341
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011830
push 0x41ff0f
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010690
push 0x40e4e9
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100108c0
push 0x4154d3
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011bc0
push 0x433203
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011c50
push 0x4166da
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011390
push 0x41ceea
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010d10
push 0x43bd18
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010de0
push 0x407473
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011150
push 0x428358
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100105a0
push 0x4045bb
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011b70
push 0x40b89d
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011a60
push 0x407d56
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011ab0
push 0x404331
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011b30
push 0x40dfe4
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011af0
push 0x436a84
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10011a20
push 0x40a1d2
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100119d0
push 0x4340d1
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010600
push 0x434734
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010510
push 0x4059ac
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010170
push 0x431949
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 1
push 0x1003a138
push 5
push 0xe9
push 0x1000af60
push 0x430431
call fcn.1000de50
mov ecx, eax
call fcn.1000c870
push 0xe9
push 0x1000aee0
push 0x465237
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000b280
push 0x414d58
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000bc60
push 0x40940d
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10003090
push 0x427b38
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100034b0
push 0x404ebc
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10002ee0
push 0x41dbb0
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 1
push 0x1003a13c
push 5
push 0xe9
push 0x10010140
push 0x42b4a4
call fcn.1000de50
mov ecx, eax
call fcn.1000c870
push 1
push 0x1003a140
push 5
push 0xe9
push 0x10010100
push 0x40b1b8
call fcn.1000de50
mov ecx, eax
call fcn.1000c870
push 0xe9
push 0x10001090
push 0x40aa10
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100026f0
push 0x432c40
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10002aa0
push 0x438433
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100010c0
push 0x419119
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10002070
push 0x401e5b
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10002700
push 0x40fa1a
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10002300
push 0x4011bd
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100027b0
push 0x404598
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10002800
push 0x42d2d1
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10002970
push 0x4011ef
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000def0
push 0x40aa10
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000ec90
push 0x430bc5
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000eda0
push 0x40c9a5
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000ee20
push 0x43615b
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000eee0
push 0x434699
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10010000
push 0x42986b
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100087f0
push 0x42f2de
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10008ba0
push 0x40e5e8
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10009700
push 0x43890b
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000e9c0
push 0x4206f8
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000c660
push 0x404fb6
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x1000c1f0
push 0x4051a0
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10012260
push 0x414b1e
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x10005460
push 0x429555
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100054d0
push 0x41ae29
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push 0xe9
push 0x100054e0
push 0x431930
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x6ce7ce
call edi
lea eax, [ebp - 8]
mov dword [0x6ce7ce], 0x9013f883
push eax
push dword [ebp - 8]
push 4
push 0x6ce7ce
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x6ce7d2
call edi
lea eax, [ebp - 8]
mov esi, 0x9090
push eax
mov word [0x6ce7d2], si
push dword [ebp - 8]
push 2
push 0x6ce7d2
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x6ce4bb
call edi
lea eax, [ebp - 8]
mov dword [0x6ce4bb], 0x9013fb83
push eax
push dword [ebp - 8]
push 4
push 0x6ce4bb
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 2
push 0x6ce4bf
call edi
lea eax, [ebp - 8]
mov word [0x6ce4bf], si
push eax
push dword [ebp - 8]
push 2
push 0x6ce4bf
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x556673
call edi
lea eax, [ebp - 8]
mov byte [0x556673], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x556673
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x551225
call edi
lea eax, [ebp - 8]
mov dword [0x551225], 0x45160000
push eax
push dword [ebp - 8]
push 4
push 0x551225
call edi
push 0xe9
push 0x1000ea40
push 0x41740e
call fcn.1000de50
mov ecx, eax
call fcn.1000c800
push str.SeDebugPrivilege
call fcn.1000ada0
add esp, 4
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x14
push 0x43d30c
call edi
mov dword [0x43d30c], 0x4c470000
lea eax, [ebp - 0xc]
mov dword [0x43d310], 0x47460000
mov dword [0x43d314], 0x44520000
push eax
mov dword [0x43d318], 0x4d420000
mov dword [0x43d31c], 0x5333
push dword [ebp - 0xc]
push 0x14
push 0x43d30c
call edi
push str.NoPing1.exe
call fcn.1000ae40
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, 0xffffffff
je 0x1000e959
push 0x30
push str.Processo_Encontrado
push str.Uso_de_Proxy_Proibido
push 0
call esi
push 0
push 0xffffffffffffffff
call edi
push str.Pingzapper1.exe
call fcn.1000ae40
add esp, 4
cmp eax, 0xffffffff
je 0x1000e981
push 0x30
push str.Processo_Encontrado
push str.Uso_de_Proxy_Proibido
push 0
call esi
push 0
push 0xffffffffffffffff
call edi
push str.ExitLag1.exe
call fcn.1000ae40
add esp, 4
cmp eax, 0xffffffff
je 0x1000e9a9
push 0x30
push str.Processo_Encontrado
push str.Uso_de_Proxy_Proibido
push 0
call esi
push 0
push 0xffffffffffffffff
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10013092
mov esp, ebp
pop ebp
ret
call fcn.10017e9f
int3