Function at 0x100e2fa0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check os version
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Get common file path
Get number of processors
Spawn thread to rwx shellcode
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10181680
mov eax, dword fs:[0]
push eax
sub esp, 0xc2c
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100e2bc0
push dword [sym.imp.KERNEL32.dll_CreateFileA]
call fcn.100020f0
push 0
push 0
push 0
push 0x100e5d70
push 0
push 0
mov dword [0x1027c0ac], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push eax
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0xab0]
call fcn.10047830
push ecx
push 0x101b8d5c
lea ecx, [ebp - 0xab0]
call fcn.10047480
push eax
push 0
lea eax, [ebp - 0xae8]
push eax
lea ecx, [ebp - 0xab0]
call fcn.100473b0
lea ecx, [ebp - 0xab0]
call fcn.100448c0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e306b
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10049010
add esp, 8
mov ecx, 0x102add38
call fcn.100448c0
mov eax, dword [0x102add50]
cmp eax, 0x10
jb 0x100e30c5
inc eax
push eax
push dword [0x102add3c]
call fcn.10049010
add esp, 8
lea eax, [ebp - 0xae8]
mov dword [0x102add4c], 0
push eax
mov ecx, 0x102add38
mov dword [0x102add50], 0xf
mov byte [0x102add3c], 0
call fcn.10048560
lea ecx, [ebp - 0xae8]
call fcn.100448c0
mov eax, dword [ebp - 0xad0]
cmp eax, 0x10
jb 0x100e3117
inc eax
push eax
push dword [ebp - 0xae4]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xae8]
push 8
push eax
mov dword [ebp - 0xad4], 0
mov dword [ebp - 0xad0], 0xf
mov byte [ebp - 0xae4], 0
mov dword [ebp - 0xae8], 0
call fcn.10049010
movaps xmm0, xmmword [str.g___t]
add esp, 8
movups xmmword [ebp - 0xae0], xmm0
mov word [ebp - 0xad0], 0x21f
xor ecx, ecx
mov byte [ebp - 0xace], 0
nop dword [eax]
mov al, byte [ebp - 0xae0]
xor byte [ebp + ecx - 0xadf], al
inc ecx
cmp ecx, 0x11
jb 0x100e3170
mov edx, dword [0x102add4c]
lea ecx, [ebp - 0xadf]
mov byte [ebp - 0xace], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e31a0
mov edi, 0x7fffffff
sub ecx, esi
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x100e44a8
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0xadf]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xacc]
call fcn.10049270
cmp dword [ebp - 0xab4], 0x10
lea eax, [ebp - 0xac8]
lea ecx, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xac8]
sub esp, 8
push 1
push eax
call fcn.10047110
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xd0]
mov eax, dword [eax + 4]
mov ebx, dword [ebp + eax - 0xc4]
call fcn.100455d0
test bl, 6
je 0x100e33b7
mov cl, 0x59
mov dword [ebp - 0xa8c], 0x2b2b1c59
mov word [ebp - 0xa88], 0x2b36
xor eax, eax
mov byte [ebp - 0xa86], 0
xor byte [ebp + eax - 0xa8b], cl
inc eax
cmp eax, 5
jae 0x100e3265
mov cl, byte [ebp - 0xa8c]
jmp 0x100e3250
movaps xmm0, xmmword [0x101c2310]
xor ecx, ecx
mov byte [ebp - 0xa86], 0
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xaa0], 0x3f307e3b
mov dword [ebp - 0xa9c], 0x377e3b33
mov dword [ebp - 0xa98], 0x323f2830
mov word [ebp - 0xa94], 0x3a37
mov byte [ebp - 0xa92], 0
nop word [eax + eax]
mov al, byte [ebp - 0xab0]
xor byte [ebp + ecx - 0xaaf], al
inc ecx
cmp ecx, 0x1d
jb 0x100e32b0
lea eax, [ebp - 0xa8b]
mov byte [ebp - 0xa92], 0
push 0x30
push eax
lea eax, [ebp - 0xaaf]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov esi, esp
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.10048f80
add esp, 4
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [esi + 0x14], 0
push 0
mov dword [esi + 0x18], 0xf
push 0x101b8c74
mov byte [esi + 4], 0
call fcn.10048350
call fcn.100e29a0
add esp, 0x1c
lea ecx, [ebp - 0xacc]
call fcn.100448c0
mov eax, dword [ebp - 0xab4]
cmp eax, 0x10
jb 0x100e3365
inc eax
push eax
push dword [ebp - 0xac8]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xacc]
push 8
push eax
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0xab4], 0xf
mov byte [ebp - 0xac8], 0
mov dword [ebp - 0xacc], 0
call fcn.10049010
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101204c0
mov esp, ebp
pop ebp
ret
push 0
push 2
xor bl, bl
mov dword [ebp - 0xc30], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xc30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x100e359c
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0xc30]
push eax
push esi
call edi
cmp eax, 1
jne 0x100e3597
nop
push 8
mov byte [ebp - 0xc31], bl
mov dword [ebp - 0xab0], 0
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0
call fcn.10048f80
lea ecx, [ebp - 0xab0]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0xc0c]
mov dword [eax + 4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e3471
sub ecx, edx
lea eax, [ebp - 0xc0c]
push ecx
push eax
lea ecx, [ebp - 0xab0]
call fcn.10048350
movaps xmm0, xmmword [0x101c32c0]
xor ecx, ecx
movups xmmword [ebp - 0xae0], xmm0
mov word [ebp - 0xad0], 0x63
nop word [eax + eax]
mov al, byte [ebp - 0xae0]
xor byte [ebp + ecx - 0xadf], al
inc ecx
cmp ecx, 0x10
jb 0x100e34b0
lea edx, [ebp - 0xadf]
mov byte [ebp - 0xacf], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100e34d3
sub edx, ecx
lea eax, [ebp - 0xadf]
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xaac]
push edx
cmovae ecx, dword [ebp - 0xaac]
mov edx, dword [ebp - 0xa9c]
push eax
push 0
call fcn.10086ca0
lea ecx, [ebx + 1]
add esp, 0xc
movzx ebx, cl
cmp eax, 0xffffffff
movzx ecx, byte [ebp - 0xc31]
cmove ebx, ecx
lea ecx, [ebp - 0xab0]
call fcn.100448c0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e3541
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10049010
add esp, 8
lea eax, [ebp - 0xc30]
push eax
push esi
call edi
cmp eax, 1
je 0x100e3400
cmp bl, 3
jbe 0x100e3597
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, 0x7fffffff
mov cl, 0x62
mov dword [ebp - 0xa90], 0x3b203e62
mov dword [ebp - 0xa8c], 0x31212330
xor eax, eax
mov dword [ebp - 0xa88], 0xe0e064c
mov byte [ebp - 0xa84], 0
xor byte [ebp + eax - 0xa8f], cl
inc eax
cmp eax, 0xb
jae 0x100e35da
mov cl, byte [ebp - 0xa90]
jmp 0x100e35c5
mov edx, dword [0x102add4c]
lea ecx, [ebp - 0xa8f]
mov byte [ebp - 0xa84], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e35f0
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100e44a8
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0xa8f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xab0]
call fcn.10049270
lea ecx, [ebp - 0xacc]
call fcn.100448c0
mov eax, dword [ebp - 0xab4]
cmp eax, 0x10
jb 0x100e365a
inc eax
push eax
push dword [ebp - 0xac8]
call fcn.10049010
add esp, 8
lea eax, [ebp - 0xab0]
mov dword [ebp - 0xab8], 0
push eax
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xab4], 0xf
mov byte [ebp - 0xac8], 0
call fcn.10048560
lea ecx, [ebp - 0xab0]
call fcn.100448c0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e36ad
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10049010
cmp dword [ebp - 0xab4], 0x10
lea eax, [ebp - 0xac8]
push 1
cmovae eax, dword [ebp - 0xac8]
lea ecx, [ebp - 0xd0]
push eax
call fcn.10047110
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xd0]
mov eax, dword [eax + 4]
mov ebx, dword [ebp + eax - 0xc4]
call fcn.100455d0
test bl, 6
je 0x100e37d3
movaps xmm0, xmmword [str._nEED]
xor ecx, ecx
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xaa0], 0x64004e69
mov dword [ebp - 0xa9c], 0x43455249
mov dword [ebp - 0xa98], 0x59524f54
mov byte [ebp - 0xa94], 0
nop dword [eax + eax]
mov al, byte [ebp - 0xab0]
xor byte [ebp + ecx - 0xaaf], al
inc ecx
cmp ecx, 0x1b
jb 0x100e3760
mov byte [ebp - 0xa94], 0
mov cl, 0x26
mov dword [ebp - 0xa90], 0x7f647a26
xor eax, eax
mov dword [ebp - 0xa8c], 0x75656774
mov dword [ebp - 0xa88], 0x4a4a4208
mov byte [ebp - 0xa84], 0
xor byte [ebp + eax - 0xa8f], cl
inc eax
cmp eax, 0xb
jae 0x100e37b8
mov cl, byte [ebp - 0xa90]
jmp 0x100e37a3
lea eax, [ebp - 0xaaf]
mov byte [ebp - 0xa84], 0
push 0x30
push eax
lea eax, [ebp - 0xa8f]
jmp 0x100e32d9
push 0x64
lea eax, [ebp - 0x280]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push 8
mov dword [ebp - 0xb00], 0
call fcn.10048f80
lea ecx, [ebp - 0xb04]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0x280]
mov dword [eax + 4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e3841
sub ecx, edx
lea eax, [ebp - 0x280]
push ecx
push eax
lea ecx, [ebp - 0xb04]
call fcn.10048350
push 0x558
call fcn.101207d0
mov edx, dword [0x102add4c]
mov cl, 0x77
mov dword [ebp - 0xa88], eax
mov al, 0x2b
xor cl, al
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x17], cl
sub esp, 0x18
lea ecx, [ebp - 0x17]
mov byte [ebp - 0x18], al
mov byte [ebp - 0x16], 0
lea esi, [ecx + 1]
mov dword [ebp - 0xc38], esp
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e3896
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100e44a8
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0x17]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
mov ecx, dword [ebp - 0xc38]
call fcn.10049270
mov ecx, dword [ebp - 0xa88]
call fcn.100d4670
push 0x30
mov dword [0x1027c0b4], eax
call fcn.101207d0
mov edx, dword [0x102add4c]
mov esi, eax
mov al, 0x24
mov byte [ebp - 0x16], 0
mov cl, 0x78
mov byte [ebp - 0x18], al
add esp, 4
mov dword [ebp - 0xc38], esi
xor cl, al
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x17], cl
lea ecx, [ebp - 0x17]
lea eax, [ecx + 1]
mov dword [ebp - 0xa88], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e3920
sub ecx, dword [ebp - 0xa88]
sub edi, edx
cmp edi, ecx
jb 0x100e44ad
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0x17]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xab0]
call fcn.10049270
lea edi, [esi + 8]
mov dword [ebp - 4], 0
push 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.10048f80
add esi, 0x24
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [eax + 4], 0
mov dword [edi], eax
mov dword [eax], edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10048f80
add esp, 4
mov dword [eax], esi
mov dword [eax + 4], 0
push 0x40
mov dword [esi], eax
call fcn.10048f80
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 4], eax
lea eax, [ebp - 0xab0]
cmp edi, eax
je 0x100e3a29
cmp dword [ebp - 0xa98], 0x10
lea eax, [ebp - 0xaac]
push dword [ebp - 0xa9c]
cmovae eax, dword [ebp - 0xaac]
mov ecx, edi
push eax
call fcn.10048350
lea ecx, [ebp - 0xab0]
call fcn.100448c0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e3a4f
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10049010
mov eax, dword [ebp - 0xc38]
add esp, 8
mov dword [0x1027c0b0], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0xa88], eax
mov edx, dword [ebp - 0xa88]
mov ecx, dword [0x102adb80]
push str.BYRACS_Log.txt
mov eax, dword [edx + 0xa4]
mov dword [ecx + 0xe8], eax
mov eax, dword [edx + 0xa8]
mov dword [ecx + 0xec], eax
movzx eax, word [edx + 0xac]
mov word [ecx + 0xf0], ax
movzx eax, word [edx + 0xae]
mov word [ecx + 0xf2], ax
mov eax, dword [edx + 0xbc]
mov dword [ecx + 0x100], eax
mov eax, dword [edx + 0xb8]
mov dword [ecx + 0xfc], eax
mov eax, dword [edx + 0xb0]
mov dword [ecx + 0xf4], eax
mov eax, dword [edx + 0xb4]
mov dword [ecx + 0xf8], eax
call fcn.10140b60
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x218]
add esp, 4
push eax
push 0x200
call esi
push str.hostfix.bat
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.10142680
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x218]
push 0x101be394
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101419b0
mov eax, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
je 0x100e3b93
push eax
call fcn.10136cc0
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.10141501
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.10140b60
add esp, 4
push 0x200
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.101234b0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x200
call esi
push str.ws2_32.dll
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.10142680
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x218]
push 0x101be394
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101419b0
mov eax, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
je 0x100e3c0e
push eax
call fcn.10136cc0
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.10140b60
add esp, 4
push 0x400
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.101234b0
add esp, 0xc
push 0
push str.Oyun_ba
call fcn.100a4be0
push str.Sat_Oct_26_15:41:51_2024
push str.A510225
lea eax, [ebp - 0xa80]
push str.BYRACS_s
push eax
call fcn.100df190
add esp, 0x10
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.100a4be0
mov ecx, dword [0x102adb80]
movzx eax, word [ecx + 0xf2]
push eax
movzx eax, word [ecx + 0xf0]
push eax
push dword [ecx + 0xec]
lea eax, [ebp - 0xa80]
push dword [ecx + 0xe8]
push str.Windows_s
push eax
call fcn.100df190
add esp, 0x18
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.100a4be0
push 0
push str.Ana_i
call fcn.100a4be0
push 0x400
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.101234b0
mov eax, dword [0x102adb80]
add esp, 0xc
add eax, 0x25
xor eax, 0xffffffbb
imul eax, eax, 0xffffff94
and eax, 0xcc
push eax
lea eax, [ebp - 0x680]
push str._KK___x_
push eax
call fcn.100df190
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xb0]
xor eax, 0x2c
imul eax, eax, 0xfffffff5
and eax, 0x5d
push eax
lea eax, [ebp - 0x680]
push str._SZ1___x_
push eax
call fcn.10052fe0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xac]
xor eax, 0xfffffff2
imul eax, eax, 0xfffffff6
and eax, 0x14
push eax
lea eax, [ebp - 0x680]
push str._SZ2___x_
push eax
call fcn.100df190
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xb4]
xor eax, 0xffffffde
imul eax, eax, 0xfffffff1
and eax, 0x4e
push eax
lea eax, [ebp - 0x680]
push str._SZ3___x_
push eax
call fcn.100df190
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
mov eax, dword [0x102adb80]
push dword [eax + 0xc]
lea eax, [ebp - 0x680]
push str.CSRSS_process_id:__i
push eax
call fcn.100df190
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
mov eax, dword [0x102adb80]
push dword [eax + 0x10]
lea eax, [ebp - 0x680]
push str.WLG_process_id:__i
push eax
call fcn.100df190
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xa0]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x680]
push str._SM1___x_
push eax
call fcn.100df190
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0x14]
xor eax, 0x67
imul eax, eax, 0xffffff88
and eax, 0xe3
push eax
lea eax, [ebp - 0x680]
push str._SM2___x_
push eax
call fcn.100df190
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1027c0a4], eax
test eax, eax
je 0x100e3e8f
lea eax, [ebp - 0x18]
push eax
call ebx
push eax
call dword [0x1027c0a4]
cmp dword [ebp - 0x18], 0
je 0x100e3eb9
push 0
push str._x64__sistem_belirlendi
call fcn.100a4be0
push 0
push str.Sistem_servisi_ba
call fcn.100a4be0
push 0
push 0x101bfeb8
call fcn.100a4be0
push 0
push str.Islemci_calisma_kumesi_olusturuldu.
call fcn.100a4be0
push 0
push str.Bellek_arayuzu_entegrasyonu_basladi
call fcn.100a4be0
push 0
push str.Bellek_arayuzu_entegrasyonu_tamamlandi
call fcn.100a4be0
push 0
push str.Essiz_kimlik_olusturuldu
call fcn.100a4be0
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0x2c]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x680]
push str.Yans
push eax
call fcn.100df190
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4be0
push 0
push str.AA_sistemi_aktif_edildi
call fcn.100a4be0
push 0
push str.Haklar_al
call fcn.100a4be0
lea eax, [ebp - 0x18]
push eax
push 0x20
call ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100e4495
lea eax, [ebp - 0xa8c]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
test eax, eax
je 0x100e44c5
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xa88]
push 0
push 0x10
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xadc]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xad0], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100e44b2
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Haklar_elde_edildi
call fcn.100a4be0
push 0
push str.Sistem_ayarlar
call fcn.100a4be0
push 0x101bf380
push str.kernel32.dll
call fcn.100a4ce0
push 0x101bf394
push str.kernel32.dll
call fcn.100a4ce0
push 0x101c0024
push str.kernel32.dll
call fcn.100a4ce0
push 0x101bf3b8
push str.kernel32.dll
call fcn.100a4ce0
push 0x101bf3a8
push str.kernel32.dll
call fcn.100a4ce0
push 0x101c0034
push str.kernel32.dll
call fcn.100a4ce0
push 0x101c000c
push str.Winmm.dll
call fcn.100a4ce0
push 0
push str.Sistem_segmentleri_kontrol_ediliyor
call fcn.100a4be0
mov ecx, dword [0x1027c0b4]
call fcn.100951c0
push 0
push str.Log_sistemi_aktif_ediliyor
call fcn.100a4be0
push 0
push str.Adres_y
call fcn.100a4be0
push 0
push str.Kimlik_y
call fcn.100a4be0
push 0
push str.Geni
call fcn.100a4be0
call fcn.100e4c90
push 0
push 0x101c0154
call fcn.100a4be0
push 0x3c
call fcn.101207d0
add esp, 4
mov ecx, eax
call fcn.100456d0
mov dword [0x1027c090], eax
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
cmp esi, edi
je 0x100e4166
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [eax]
push esi
lea ecx, [ebp - 0xab0]
call fcn.10047950
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xa88]
push ecx
push 0xf003f
lea eax, [ebp - 0xaac]
cmovae eax, dword [ebp - 0xaac]
push 0
push eax
push connect
call ebx
lea ecx, [ebp - 0xab0]
cmp eax, 2
jne 0x100e4311
call fcn.100448c0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e4125
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10049010
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100e40c0
xor bh, bh
mov eax, dword [0x1027c090]
mov esi, dword [eax + 0x14]
mov edi, dword [eax + 0x18]
cmp esi, edi
je 0x100e4214
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0xab0]
call fcn.10047950
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xaac]
cmovae ecx, dword [ebp - 0xaac]
call fcn.10045590
lea ecx, [ebp - 0xab0]
test al, al
jne 0x100e436e
call fcn.100448c0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e41d3
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10049010
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100e4180
xor bl, bl
push 0
push str.PC_ban_sistemi_kontrol_ediliyor.
call fcn.100a4be0
test bh, bh
jne 0x100e43cb
test bl, bl
jne 0x100e43cb
mov eax, dword [0x101bfe3c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x18], eax
mov ax, word [0x101bfe40]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xa88]
push eax
push 0x40
push 5
push 0x510de7
call esi
mov ecx, 0x510de7
mov byte [ebp - 0x18], 0xe9
mov eax, 0x100e2f30
sub eax, 0x510dec
mov dword [ebp - 0x17], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
mov al, byte [ebp - 0x14]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc38]
push eax
push dword [ebp - 0xa88]
push 5
push ecx
call esi
push 0
push 0
push 0
push 0x100e5a10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.ClientPlugin_aktif_edildi.
call fcn.100a4be0
lea ecx, [ebp - 0xb04]
call fcn.100448c0
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x100e42d6
inc eax
push eax
push dword [ebp - 0xb00]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xb04]
push 8
push eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
call fcn.10049010
add esp, 8
jmp 0x100e333f
call fcn.100448c0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e4331
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10049010
add esp, 8
mov bh, 1
jmp 0x100e4168
call fcn.100448c0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e438e
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10049010
add esp, 8
mov bl, 1
jmp 0x100e4216
push 1
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
call fcn.100a4be0
sub esp, 0x1c
mov esi, esp
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.10048f80
add esp, 4
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
push 0x39
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
call fcn.10048350
call fcn.100e29a0
add esp, 0x1c
lea ecx, [ebp - 0xb04]
call fcn.100448c0
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x100e445a
inc eax
push eax
push dword [ebp - 0xb00]
call fcn.10049010
add esp, 8
mov eax, dword [ebp - 0xb04]
push 8
push eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
call fcn.10049010
add esp, 8
jmp 0x100e333f
push 0
push str.Haklar_elde_edilemedi
call fcn.100a4be0
push 0
call fcn.101400a0
call fcn.10044910
call fcn.10044910
push 0
push str.Haklar_elde_edilemedi__yetersiz_yetkilendirme
call fcn.100a4be0
push 0
call fcn.101400a0
push str.Haklar_elde_edilemedi__yetersiz_yetki_alani
call fcn.100a4be0
push 0
call fcn.101400a0
int3