Function at 0x1001a740
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x100a900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100b0038]
push ebx
push esi
push edi
mov ecx, dword [eax]
mov eax, dword [ecx + 0x7425c]
cmp eax, dword [str.1.10]
jne 0x1001afd0
mov eax, dword [ecx + 0x74260]
cmp eax, dword [0x1009da5c]
jne 0x1001afd0
mov eax, dword [0x100bab40]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x34]
push eax
call fcn.10001c70
mov esi, eax
cmp esi, 0x100b02d0
je 0x1001a7d0
mov ecx, 0x100b02d0
call fcn.10021440
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [0x100b02d0], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x100b02e0], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x34]
call fcn.10021440
mov eax, dword [0x100bab40]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x34]
push eax
call fcn.10001a10
push eax
mov ecx, 0x100b0098
call fcn.10020f70
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x1001a82d
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001a823
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001a823
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1007516e
add esp, 8
mov ecx, dword [0x100b02e0]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 5
jb 0x1001aff5
cmp dword [0x100b02e4], 8
mov eax, 0x100b02d0
push 5
cmovae eax, dword [0x100b02d0]
push str..json
push ecx
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.10027840
mov ecx, 0x100b0478
call fcn.10021440
movups xmm0, xmmword [ebp - 0x34]
xor eax, eax
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
movups xmmword [0x100b0478], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [0x100b0488], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
call fcn.10021440
push ecx
call fcn.10017030
cmp dword [0x100b02e4], 8
mov eax, 0x100b02d0
mov byte [0x100bab3c], 1
cmovae eax, dword [0x100b02d0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x100bab3c], 0
call fcn.1000a240
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0x10000
push 0x100bab48
call esi
mov eax, dword [0x100b0038]
mov dword [ebp - 0x24], 0xa
mov edi, dword [eax]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
lea ebx, [edi + 0x2c930]
push ebx
mov dword [ebp - 0x28], ebx
call esi
mov esi, dword [0x100b003c]
mov eax, 0x5251
push 0xa
push ebx
mov word [esi], ax
lea eax, [esi + 0xb]
push eax
mov byte [esi + 2], 0xb8
mov dword [esi + 3], 0x1001e620
mov dword [esi + 7], 0x595ad0ff
call sub.VCRUNTIME140.dll_memmove
mov eax, 0x25ff
lea ecx, [esi + 0x1b]
mov word [esi + 0x15], ax
add esp, 0xc
mov dword [esi + 0x17], ecx
lea eax, [ebx + 0xa]
mov dword [ecx], eax
mov eax, 0xe0ff
add dword [0x100b003c], 0x1f
mov word [ebx + 5], ax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
mov byte [ebx], 0xb8
push dword [ebp - 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x28]
mov dword [edi + 0x2c931], esi
call ebx
cmp byte [0x100a9159], 0
je 0x1001affa
mov esi, 0x100a914c
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001a9a0
sub esi, ecx
cmp byte [0x100a9089], al
je 0x1001b026
mov ecx, 0x100a907c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001a9c0
push esi
sub ecx, edx
push 0x100a914c
push ecx
mov ecx, dword [0x100cab4c]
push 0x100a907c
call fcn.100023c0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001aa0a
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
push esi
call ebx
test eax, eax
je 0x1001aa0a
lea eax, [ebp - 0x50]
mov dword [esi], 0x1001e770
push eax
push dword [ebp - 0x50]
push 4
push esi
call ebx
call fcn.10016980
mov al, byte [0x100b0189]
mov byte [0x100b018a], al
test al, al
je 0x1001ab77
call dword [sym.imp.KERNEL32.dll_AllocConsole]
cmp eax, 1
je 0x1001aa4d
push 0x2010
mov edx, 0x232a
lea ecx, [ebp - 0x18]
call fcn.10006160
add esp, 4
mov byte [0x100b0188], 0
jmp 0x1001ab77
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
cmp byte [0x100b01a0], 0
mov esi, eax
mov dword [0x100b0184], esi
je 0x1001aa8e
mov ecx, dword [0x100b019c]
mov edx, dword [0x100b0194]
sub ecx, edx
mov eax, dword [0x100b0198]
push 0x14
push ecx
mov ecx, dword [0x100b0190]
sub eax, ecx
push eax
push edx
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, 0x100b0180
call fcn.10009a20
push 0x10099510
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp byte [0x100b018b], 0
mov dword [0x100b0180], eax
je 0x1001aad7
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [ebp - 0x14]
or eax, 4
push eax
push dword [0x100b0180]
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp byte [0x100b018c], 0
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
je 0x1001ab07
push 0
call edi
add esp, 4
push eax
push 0x10099520
lea eax, [ebp - 0x50]
push str.CONIN_
push eax
call esi
add esp, 0x10
push 2
call edi
add esp, 4
push eax
push 0x1009952c
lea eax, [ebp - 0x50]
push str.CONOUT_
push eax
call esi
push 1
call edi
add esp, 0x14
push eax
push 0x1009952c
lea eax, [ebp - 0x50]
push str.CONOUT_
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
add esp, 0x10
push 0xf0
push dword [0x100b0180]
call esi
push 0
lea eax, [ebp - 0x14]
push eax
push 0xa
push str.patch.aul_n
push dword [0x100b0180]
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push 7
push dword [0x100b0180]
call esi
mov byte [0x100b0188], 1
call fcn.1000a790
mov eax, dword [0x100b0038]
lea ecx, [ebp - 0x20]
push ecx
push 0x40
push 4
mov eax, dword [eax]
add eax, 0x22187
mov dword [ebp - 0x24], 4
push eax
mov dword [ebp - 0x28], eax
call ebx
mov eax, dword [ebp - 0x28]
mov dword [eax], str.1.10__patched_r43_ss_36_
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call ebx
mov al, byte [0x100b02c8]
mov byte [0x100b02c9], al
test al, al
je 0x1001ac0e
mov eax, dword [0x100b0038]
lea ecx, [ebp - 0x38]
push ecx
push 0x40
push 6
mov eax, dword [eax]
add eax, 0x331c2
mov dword [ebp - 0x3c], 6
push eax
mov dword [ebp - 0x40], eax
call ebx
mov eax, dword [ebp - 0x40]
mov ecx, 0xe890
mov word [eax], cx
mov ecx, 0x1005cae0
mov eax, dword [ebp - 0x40]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call ebx
movzx eax, byte [0x100b01d0]
mov byte [0x100b01d1], al
mov al, byte [0x100b02b0]
mov byte [0x100b02b1], al
test al, al
je 0x1001ac9c
mov eax, dword [0x100b0038]
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 0x23
mov eax, dword [eax]
add eax, 0x2a68
mov dword [ebp - 0x18], 0x23
push eax
mov dword [ebp - 0x1c], eax
call ebx
mov eax, dword [ebp - 0x1c]
mov ecx, 0xe856
mov word [eax], cx
mov ecx, 0x10011890
mov eax, dword [ebp - 0x1c]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov ecx, 0x5018
mov eax, dword [ebp - 0x1c]
mov dword [eax + 6], 0x2444895e
mov eax, dword [ebp - 0x1c]
mov word [eax + 0xa], cx
mov ecx, 0xe983
mov eax, dword [ebp - 0x1c]
mov word [eax + 0x20], cx
mov eax, dword [ebp - 0x1c]
mov byte [eax + 0x22], 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call ebx
mov al, byte [0x100b02f8]
mov byte [0x100b02f9], al
test al, al
je 0x1001acf8
mov eax, dword [0x100b0038]
lea ecx, [ebp - 0x44]
push ecx
push 0x40
push 6
mov eax, dword [eax]
add eax, 0x1c47a
mov dword [ebp - 0x48], 6
push eax
mov dword [ebp - 0x4c], eax
call ebx
mov eax, dword [ebp - 0x4c]
mov ecx, 0xb890
mov word [eax], cx
mov eax, dword [0x100b0038]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x4c]
add ecx, 0xb87b0
mov dword [eax + 2], ecx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call ebx
mov al, byte [0x100b02b8]
mov byte [0x100b02b9], al
test al, al
je 0x1001ae55
mov eax, dword [0x100b0038]
mov dword [ebp - 0xc], 4
mov ecx, dword [eax]
mov eax, dword [ecx + 0x2d0fe]
add ecx, 0x2d0fe
mov dword [0x100b9ad0], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ecx
mov dword [ebp - 0x10], ecx
call ebx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x1005d490
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100b0038]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 4
mov eax, dword [eax]
add eax, 0x23119
mov dword [ebp - 0xc], 4
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x1005d400
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100b0038]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 6
mov eax, dword [eax]
add eax, 0x40ffd
mov dword [ebp - 0xc], 6
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0xe956
mov edx, dword [0x100b0038]
mov word [eax], cx
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov eax, dword [0x100b003c]
mov dword [eax], 0xfac1d003
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 3
mov eax, dword [0x100b003c]
inc eax
mov dword [0x100b003c], eax
mov dword [eax], 0x8f0fd285
mov ecx, dword [0x100b003c]
add ecx, 4
mov dword [0x100b003c], ecx
mov eax, dword [edx]
sub eax, ecx
add eax, 0x40fff
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
inc ecx
mov dword [0x100b003c], ecx
mov eax, dword [edx]
sub eax, ecx
add eax, 0x41057
mov dword [ecx], eax
lea eax, [ebp - 8]
add dword [0x100b003c], 4
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov al, byte [0x100b02b4]
mov byte [0x100b02b5], al
test al, al
je 0x1001afe4
mov eax, dword [0x100b0038]
lea ecx, [ebp - 8]
push ecx
push 0x40
push 5
mov eax, dword [eax]
add eax, 0x28ca3
mov dword [ebp - 0xc], 5
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, dword [0x100b0038]
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov ecx, dword [0x100b003c]
movups xmm0, xmmword [0x1009e144]
movups xmmword [ecx], xmm0
movq xmm0, qword [0x1009e154]
movq qword [ecx + 0x10], xmm0
mov ax, word [0x1009e15c]
mov word [ecx + 0x18], ax
mov al, byte [0x1009e15e]
mov byte [ecx + 0x1a], al
mov eax, dword [0x100b003c]
add eax, 0x1b
mov dword [0x100b003c], eax
mov dword [eax], 0x1009ce08
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0x8b66c033
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 2
mov eax, dword [0x100b003c]
inc eax
mov dword [0x100b003c], eax
mov dword [eax], 0x840fc83b
mov ecx, dword [0x100b003c]
add ecx, 4
mov dword [0x100b003c], ecx
mov eax, dword [edx]
sub eax, ecx
add eax, 0x28d99
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0x8102c283
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xfa
mov eax, dword [0x100b003c]
inc eax
mov dword [0x100b003c], eax
mov dword [eax], 0x1009ce0e
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xe8bea7c
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xe9e0458d
mov ecx, dword [0x100b003c]
add ecx, 4
mov dword [0x100b003c], ecx
mov eax, dword [edx]
sub eax, ecx
add eax, 0x28ca4
mov dword [ecx], eax
lea eax, [ebp - 8]
add dword [0x100b003c], 4
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007491a
mov esp, ebp
pop ebp
ret
push 0x30
push 0x1009936c
push str.patch.aul_requires_AviUtl_1.10._nAviUtl_version_1.10
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007491a
mov esp, ebp
pop ebp
ret
call fcn.10001a00
xor esi, esi
xor edi, edi
nop
mov ecx, edi
lea esi, [esi + 1]
and ecx, 7
mov dl, 0x2d
rol dl, cl
add edi, 3
xor byte [esi + 0x100a914b], dl
cmp edi, 0x27
jb 0x1001b000
mov byte [0x100a9159], 1
jmp 0x1001a994
xor edi, edi
xor ebx, ebx
nop word [eax + eax]
mov ecx, ebx
lea edi, [edi + 1]
and ecx, 7
mov dl, 0x2d
rol dl, cl
add ebx, 3
xor byte [edi + 0x100a907b], dl
cmp ebx, 0x27
jb 0x1001b030
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x100a9089], 1
jmp 0x1001a9b5