Function at 0x100e2de0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check os version
Create thread
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Get common file path
Get number of processors
Spawn thread to rwx shellcode
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101813e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc2c
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100e2a30
push dword [sym.imp.KERNEL32.dll_CreateFileA]
call fcn.100020f0
push 0
push 0
push 0
push 0x100e5ac0
push 0
push 0
mov dword [0x1027c0ac], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push eax
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0xab0]
call fcn.10047720
push ecx
push 0x101b8d5c
lea ecx, [ebp - 0xab0]
call fcn.10047370
push eax
push 0
lea eax, [ebp - 0xae8]
push eax
lea ecx, [ebp - 0xab0]
call fcn.100472a0
lea ecx, [ebp - 0xab0]
call fcn.100447b0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e2eab
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048ea0
add esp, 8
mov ecx, 0x102add38
call fcn.100447b0
mov eax, dword [0x102add50]
cmp eax, 0x10
jb 0x100e2f05
inc eax
push eax
push dword [0x102add3c]
call fcn.10048ea0
add esp, 8
lea eax, [ebp - 0xae8]
mov dword [0x102add4c], 0
push eax
mov ecx, 0x102add38
mov dword [0x102add50], 0xf
mov byte [0x102add3c], 0
call fcn.10048410
lea ecx, [ebp - 0xae8]
call fcn.100447b0
mov eax, dword [ebp - 0xad0]
cmp eax, 0x10
jb 0x100e2f57
inc eax
push eax
push dword [ebp - 0xae4]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xae8]
push 8
push eax
mov dword [ebp - 0xad4], 0
mov dword [ebp - 0xad0], 0xf
mov byte [ebp - 0xae4], 0
mov dword [ebp - 0xae8], 0
call fcn.10048ea0
movaps xmm0, xmmword [0x101c29a0]
add esp, 8
movups xmmword [ebp - 0xae0], xmm0
mov word [ebp - 0xad0], 0x534e
xor ecx, ecx
mov byte [ebp - 0xace], 0
nop dword [eax]
mov al, byte [ebp - 0xae0]
xor byte [ebp + ecx - 0xadf], al
inc ecx
cmp ecx, 0x11
jb 0x100e2fb0
mov edx, dword [0x102add4c]
lea ecx, [ebp - 0xadf]
mov byte [ebp - 0xace], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2fe0
mov edi, 0x7fffffff
sub ecx, esi
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x100e42e8
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0xadf]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xacc]
call fcn.10049100
cmp dword [ebp - 0xab4], 0x10
lea eax, [ebp - 0xac8]
lea ecx, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xac8]
sub esp, 8
push 1
push eax
call fcn.10047000
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xd0]
mov eax, dword [eax + 4]
mov ebx, dword [ebp + eax - 0xc4]
call fcn.100454c0
test bl, 6
je 0x100e31f7
mov cl, 0x59
mov dword [ebp - 0xa8c], 0x2b2b1c59
mov word [ebp - 0xa88], 0x2b36
xor eax, eax
mov byte [ebp - 0xa86], 0
xor byte [ebp + eax - 0xa8b], cl
inc eax
cmp eax, 5
jae 0x100e30a5
mov cl, byte [ebp - 0xa8c]
jmp 0x100e3090
movaps xmm0, xmmword [0x101c1e90]
xor ecx, ecx
mov byte [ebp - 0xa86], 0
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xaa0], 0xd024c09
mov dword [ebp - 0xa9c], 0x54c0901
mov dword [ebp - 0xa98], 0xd1a02
mov word [ebp - 0xa94], 0x805
mov byte [ebp - 0xa92], 0
nop word [eax + eax]
mov al, byte [ebp - 0xab0]
xor byte [ebp + ecx - 0xaaf], al
inc ecx
cmp ecx, 0x1d
jb 0x100e30f0
lea eax, [ebp - 0xa8b]
mov byte [ebp - 0xa92], 0
push 0x30
push eax
lea eax, [ebp - 0xaaf]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov esi, esp
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.10048e10
add esp, 4
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [esi + 0x14], 0
push 0
mov dword [esi + 0x18], 0xf
push 0x101b8c74
mov byte [esi + 4], 0
call fcn.10048200
call fcn.100e2810
add esp, 0x1c
lea ecx, [ebp - 0xacc]
call fcn.100447b0
mov eax, dword [ebp - 0xab4]
cmp eax, 0x10
jb 0x100e31a5
inc eax
push eax
push dword [ebp - 0xac8]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xacc]
push 8
push eax
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0xab4], 0xf
mov byte [ebp - 0xac8], 0
mov dword [ebp - 0xacc], 0
call fcn.10048ea0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10120250
mov esp, ebp
pop ebp
ret
push 0
push 2
xor bl, bl
mov dword [ebp - 0xc30], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xc30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x100e33dc
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0xc30]
push eax
push esi
call edi
cmp eax, 1
jne 0x100e33d7
nop
push 8
mov byte [ebp - 0xc31], bl
mov dword [ebp - 0xab0], 0
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0
call fcn.10048e10
lea ecx, [ebp - 0xab0]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0xc0c]
mov dword [eax + 4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e32b1
sub ecx, edx
lea eax, [ebp - 0xc0c]
push ecx
push eax
lea ecx, [ebp - 0xab0]
call fcn.10048200
movaps xmm0, xmmword [0x101c25b0]
xor ecx, ecx
movups xmmword [ebp - 0xae0], xmm0
mov word [ebp - 0xad0], 0x24
nop word [eax + eax]
mov al, byte [ebp - 0xae0]
xor byte [ebp + ecx - 0xadf], al
inc ecx
cmp ecx, 0x10
jb 0x100e32f0
lea edx, [ebp - 0xadf]
mov byte [ebp - 0xacf], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100e3313
sub edx, ecx
lea eax, [ebp - 0xadf]
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xaac]
push edx
cmovae ecx, dword [ebp - 0xaac]
mov edx, dword [ebp - 0xa9c]
push eax
push 0
call fcn.10086b30
lea ecx, [ebx + 1]
add esp, 0xc
movzx ebx, cl
cmp eax, 0xffffffff
movzx ecx, byte [ebp - 0xc31]
cmove ebx, ecx
lea ecx, [ebp - 0xab0]
call fcn.100447b0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e3381
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048ea0
add esp, 8
lea eax, [ebp - 0xc30]
push eax
push esi
call edi
cmp eax, 1
je 0x100e3240
cmp bl, 3
jbe 0x100e33d7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, 0x7fffffff
mov cl, 0x37
mov dword [ebp - 0xa90], 0x6e756b37
mov dword [ebp - 0xa8c], 0x64747665
xor eax, eax
mov dword [ebp - 0xa88], 0x5b5b5319
mov byte [ebp - 0xa84], 0
xor byte [ebp + eax - 0xa8f], cl
inc eax
cmp eax, 0xb
jae 0x100e341a
mov cl, byte [ebp - 0xa90]
jmp 0x100e3405
mov edx, dword [0x102add4c]
lea ecx, [ebp - 0xa8f]
mov byte [ebp - 0xa84], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e3430
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100e42e8
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0xa8f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xab0]
call fcn.10049100
lea ecx, [ebp - 0xacc]
call fcn.100447b0
mov eax, dword [ebp - 0xab4]
cmp eax, 0x10
jb 0x100e349a
inc eax
push eax
push dword [ebp - 0xac8]
call fcn.10048ea0
add esp, 8
lea eax, [ebp - 0xab0]
mov dword [ebp - 0xab8], 0
push eax
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xab4], 0xf
mov byte [ebp - 0xac8], 0
call fcn.10048410
lea ecx, [ebp - 0xab0]
call fcn.100447b0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e34ed
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048ea0
cmp dword [ebp - 0xab4], 0x10
lea eax, [ebp - 0xac8]
push 1
cmovae eax, dword [ebp - 0xac8]
lea ecx, [ebp - 0xd0]
push eax
call fcn.10047000
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xd0]
mov eax, dword [eax + 4]
mov ebx, dword [ebp + eax - 0xc4]
call fcn.100454c0
test bl, 6
je 0x100e3613
movaps xmm0, xmmword [0x101c2fb0]
xor ecx, ecx
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xaa0], 0x1276381f
mov dword [ebp - 0xa9c], 0x3533243f
mov dword [ebp - 0xa98], 0x2f243922
mov byte [ebp - 0xa94], 0
nop dword [eax + eax]
mov al, byte [ebp - 0xab0]
xor byte [ebp + ecx - 0xaaf], al
inc ecx
cmp ecx, 0x1b
jb 0x100e35a0
mov byte [ebp - 0xa94], 0
mov cl, 0x1d
mov dword [ebp - 0xa90], 0x445f411d
xor eax, eax
mov dword [ebp - 0xa8c], 0x4e5e5c4f
mov dword [ebp - 0xa88], 0x71717933
mov byte [ebp - 0xa84], 0
xor byte [ebp + eax - 0xa8f], cl
inc eax
cmp eax, 0xb
jae 0x100e35f8
mov cl, byte [ebp - 0xa90]
jmp 0x100e35e3
lea eax, [ebp - 0xaaf]
mov byte [ebp - 0xa84], 0
push 0x30
push eax
lea eax, [ebp - 0xa8f]
jmp 0x100e3119
push 0x64
lea eax, [ebp - 0x280]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push 8
mov dword [ebp - 0xb00], 0
call fcn.10048e10
lea ecx, [ebp - 0xb04]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0x280]
mov dword [eax + 4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e3681
sub ecx, edx
lea eax, [ebp - 0x280]
push ecx
push eax
lea ecx, [ebp - 0xb04]
call fcn.10048200
push 0x558
call fcn.10120560
mov edx, dword [0x102add4c]
mov cl, 0x77
mov dword [ebp - 0xa88], eax
mov al, 0x2b
xor cl, al
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x17], cl
sub esp, 0x18
lea ecx, [ebp - 0x17]
mov byte [ebp - 0x18], al
mov byte [ebp - 0x16], 0
lea esi, [ecx + 1]
mov dword [ebp - 0xc38], esp
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e36d6
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100e42e8
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0x17]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
mov ecx, dword [ebp - 0xc38]
call fcn.10049100
mov ecx, dword [ebp - 0xa88]
call fcn.100d44e0
push 0x30
mov dword [0x1027c0b4], eax
call fcn.10120560
mov edx, dword [0x102add4c]
mov esi, eax
mov al, 0x24
mov byte [ebp - 0x16], 0
mov cl, 0x78
mov byte [ebp - 0x18], al
add esp, 4
mov dword [ebp - 0xc38], esi
xor cl, al
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x17], cl
lea ecx, [ebp - 0x17]
lea eax, [ecx + 1]
mov dword [ebp - 0xa88], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e3760
sub ecx, dword [ebp - 0xa88]
sub edi, edx
cmp edi, ecx
jb 0x100e42ed
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0x17]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xab0]
call fcn.10049100
lea edi, [esi + 8]
mov dword [ebp - 4], 0
push 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.10048e10
add esi, 0x24
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [eax + 4], 0
mov dword [edi], eax
mov dword [eax], edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10048e10
add esp, 4
mov dword [eax], esi
mov dword [eax + 4], 0
push 0x40
mov dword [esi], eax
call fcn.10048e10
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 4], eax
lea eax, [ebp - 0xab0]
cmp edi, eax
je 0x100e3869
cmp dword [ebp - 0xa98], 0x10
lea eax, [ebp - 0xaac]
push dword [ebp - 0xa9c]
cmovae eax, dword [ebp - 0xaac]
mov ecx, edi
push eax
call fcn.10048200
lea ecx, [ebp - 0xab0]
call fcn.100447b0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e388f
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048ea0
mov eax, dword [ebp - 0xc38]
add esp, 8
mov dword [0x1027c0b0], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0xa88], eax
mov edx, dword [ebp - 0xa88]
mov ecx, dword [0x102adb80]
push str.BYRACS_Log.txt
mov eax, dword [edx + 0xa4]
mov dword [ecx + 0xe8], eax
mov eax, dword [edx + 0xa8]
mov dword [ecx + 0xec], eax
movzx eax, word [edx + 0xac]
mov word [ecx + 0xf0], ax
movzx eax, word [edx + 0xae]
mov word [ecx + 0xf2], ax
mov eax, dword [edx + 0xbc]
mov dword [ecx + 0x100], eax
mov eax, dword [edx + 0xb8]
mov dword [ecx + 0xfc], eax
mov eax, dword [edx + 0xb0]
mov dword [ecx + 0xf4], eax
mov eax, dword [edx + 0xb4]
mov dword [ecx + 0xf8], eax
call fcn.101408f0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x218]
add esp, 4
push eax
push 0x200
call esi
push str.hostfix.bat
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.10142410
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x218]
push 0x101be394
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10141740
mov eax, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
je 0x100e39d3
push eax
call fcn.10136a40
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.10141291
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.101408f0
add esp, 4
push 0x200
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10123240
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x200
call esi
push str.ws2_32.dll
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.10142410
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x218]
push 0x101be394
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10141740
mov eax, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
je 0x100e3a4e
push eax
call fcn.10136a40
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.101408f0
add esp, 4
push 0x400
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.10123240
add esp, 0xc
push 0
push str.Oyun_ba
call fcn.100a4a60
push str.Sat_Oct_26_15:41:51_2024
push str.A510225
lea eax, [ebp - 0xa80]
push str.BYRACS_s
push eax
call fcn.100df000
add esp, 0x10
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.100a4a60
mov ecx, dword [0x102adb80]
movzx eax, word [ecx + 0xf2]
push eax
movzx eax, word [ecx + 0xf0]
push eax
push dword [ecx + 0xec]
lea eax, [ebp - 0xa80]
push dword [ecx + 0xe8]
push str.Windows_s
push eax
call fcn.100df000
add esp, 0x18
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.100a4a60
push 0
push str.Ana_i
call fcn.100a4a60
push 0x400
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.10123240
mov eax, dword [0x102adb80]
add esp, 0xc
add eax, 0x25
xor eax, 0xffffffbb
imul eax, eax, 0xffffff94
and eax, 0xcc
push eax
lea eax, [ebp - 0x680]
push str._KK___x_
push eax
call fcn.100df000
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xb0]
xor eax, 0x2c
imul eax, eax, 0xfffffff5
and eax, 0x5d
push eax
lea eax, [ebp - 0x680]
push str._SZ1___x_
push eax
call fcn.10052e60
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xac]
xor eax, 0xfffffff2
imul eax, eax, 0xfffffff6
and eax, 0x14
push eax
lea eax, [ebp - 0x680]
push str._SZ2___x_
push eax
call fcn.100df000
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xb4]
xor eax, 0xffffffde
imul eax, eax, 0xfffffff1
and eax, 0x4e
push eax
lea eax, [ebp - 0x680]
push str._SZ3___x_
push eax
call fcn.100df000
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
mov eax, dword [0x102adb80]
push dword [eax + 0xc]
lea eax, [ebp - 0x680]
push str.CSRSS_process_id:__i
push eax
call fcn.100df000
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
mov eax, dword [0x102adb80]
push dword [eax + 0x10]
lea eax, [ebp - 0x680]
push str.WLG_process_id:__i
push eax
call fcn.100df000
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xa0]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x680]
push str._SM1___x_
push eax
call fcn.100df000
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0x14]
xor eax, 0x67
imul eax, eax, 0xffffff88
and eax, 0xe3
push eax
lea eax, [ebp - 0x680]
push str._SM2___x_
push eax
call fcn.100df000
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1027c0a4], eax
test eax, eax
je 0x100e3ccf
lea eax, [ebp - 0x18]
push eax
call ebx
push eax
call dword [0x1027c0a4]
cmp dword [ebp - 0x18], 0
je 0x100e3cf9
push 0
push str._x64__sistem_belirlendi
call fcn.100a4a60
push 0
push str.Sistem_servisi_ba
call fcn.100a4a60
push 0
push 0x101bfeb8
call fcn.100a4a60
push 0
push str.Islemci_calisma_kumesi_olusturuldu.
call fcn.100a4a60
push 0
push str.Bellek_arayuzu_entegrasyonu_basladi
call fcn.100a4a60
push 0
push str.Bellek_arayuzu_entegrasyonu_tamamlandi
call fcn.100a4a60
push 0
push str.Essiz_kimlik_olusturuldu
call fcn.100a4a60
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0x2c]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x680]
push str.Yans
push eax
call fcn.100df000
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4a60
push 0
push str.AA_sistemi_aktif_edildi
call fcn.100a4a60
push 0
push str.Haklar_al
call fcn.100a4a60
lea eax, [ebp - 0x18]
push eax
push 0x20
call ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100e42d5
lea eax, [ebp - 0xa8c]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
test eax, eax
je 0x100e4305
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xa88]
push 0
push 0x10
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xadc]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xad0], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100e42f2
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Haklar_elde_edildi
call fcn.100a4a60
push 0
push str.Sistem_ayarlar
call fcn.100a4a60
push 0x101bf380
push str.kernel32.dll
call fcn.100a4b60
push 0x101bf394
push str.kernel32.dll
call fcn.100a4b60
push 0x101c0024
push str.kernel32.dll
call fcn.100a4b60
push 0x101bf3b8
push str.kernel32.dll
call fcn.100a4b60
push 0x101bf3a8
push str.kernel32.dll
call fcn.100a4b60
push 0x101c0034
push str.kernel32.dll
call fcn.100a4b60
push 0x101c000c
push str.Winmm.dll
call fcn.100a4b60
push 0
push str.Sistem_segmentleri_kontrol_ediliyor
call fcn.100a4a60
mov ecx, dword [0x1027c0b4]
call fcn.10095040
push 0
push str.Log_sistemi_aktif_ediliyor
call fcn.100a4a60
push 0
push str.Adres_y
call fcn.100a4a60
push 0
push str.Kimlik_y
call fcn.100a4a60
push 0
push str.Geni
call fcn.100a4a60
call fcn.100e4ad0
push 0
push 0x101c0154
call fcn.100a4a60
push 0x3c
call fcn.10120560
add esp, 4
mov ecx, eax
call fcn.100455c0
mov dword [0x1027c090], eax
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
cmp esi, edi
je 0x100e3fa6
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [eax]
push esi
lea ecx, [ebp - 0xab0]
call fcn.10047840
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xa88]
push ecx
push 0xf003f
lea eax, [ebp - 0xaac]
cmovae eax, dword [ebp - 0xaac]
push 0
push eax
push connect
call ebx
lea ecx, [ebp - 0xab0]
cmp eax, 2
jne 0x100e4151
call fcn.100447b0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e3f65
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048ea0
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100e3f00
xor bh, bh
mov eax, dword [0x1027c090]
mov esi, dword [eax + 0x14]
mov edi, dword [eax + 0x18]
cmp esi, edi
je 0x100e4054
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0xab0]
call fcn.10047840
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xaac]
cmovae ecx, dword [ebp - 0xaac]
call fcn.10045480
lea ecx, [ebp - 0xab0]
test al, al
jne 0x100e41ae
call fcn.100447b0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e4013
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048ea0
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100e3fc0
xor bl, bl
push 0
push str.PC_ban_sistemi_kontrol_ediliyor.
call fcn.100a4a60
test bh, bh
jne 0x100e420b
test bl, bl
jne 0x100e420b
mov eax, dword [0x101bfe3c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x18], eax
mov ax, word [0x101bfe40]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xa88]
push eax
push 0x40
push 5
push 0x510de7
call esi
mov ecx, 0x510de7
mov byte [ebp - 0x18], 0xe9
mov eax, 0x100e2da0
sub eax, 0x510dec
mov dword [ebp - 0x17], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
mov al, byte [ebp - 0x14]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc38]
push eax
push dword [ebp - 0xa88]
push 5
push ecx
call esi
push 0
push 0
push 0
push 0x100e5760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.ClientPlugin_aktif_edildi.
call fcn.100a4a60
lea ecx, [ebp - 0xb04]
call fcn.100447b0
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x100e4116
inc eax
push eax
push dword [ebp - 0xb00]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xb04]
push 8
push eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
call fcn.10048ea0
add esp, 8
jmp 0x100e317f
call fcn.100447b0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e4171
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048ea0
add esp, 8
mov bh, 1
jmp 0x100e3fa8
call fcn.100447b0
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e41ce
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048ea0
add esp, 8
mov bl, 1
jmp 0x100e4056
push 1
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
call fcn.100a4a60
sub esp, 0x1c
mov esi, esp
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.10048e10
add esp, 4
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
push 0x39
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
call fcn.10048200
call fcn.100e2810
add esp, 0x1c
lea ecx, [ebp - 0xb04]
call fcn.100447b0
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x100e429a
inc eax
push eax
push dword [ebp - 0xb00]
call fcn.10048ea0
add esp, 8
mov eax, dword [ebp - 0xb04]
push 8
push eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
call fcn.10048ea0
add esp, 8
jmp 0x100e317f
push 0
push str.Haklar_elde_edilemedi
call fcn.100a4a60
push 0
call fcn.1013fe30
call fcn.10044800
call fcn.10044800
push 0
push str.Haklar_elde_edilemedi__yetersiz_yetkilendirme
call fcn.100a4a60
push 0
call fcn.1013fe30
push str.Haklar_elde_edilemedi__yetersiz_yetki_alani
call fcn.100a4a60
push 0
call fcn.1013fe30
int3