Function at 0x100e2440
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check os version
Create thread
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Get common file path
Get number of processors
Spawn thread to rwx shellcode
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101809f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc2c
mov eax, dword [0x101dadb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100e2090
push dword [sym.imp.KERNEL32.dll_CreateFileA]
call fcn.100020f0
push 0
push 0
push 0
push 0x100e5120
push 0
push 0
mov dword [0x1027c0ac], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push eax
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0xab0]
call fcn.10046db0
push ecx
push 0x101b8d5c
lea ecx, [ebp - 0xab0]
call fcn.10046a00
push eax
push 0
lea eax, [ebp - 0xae8]
push eax
lea ecx, [ebp - 0xab0]
call fcn.10046930
lea ecx, [ebp - 0xab0]
call fcn.10043e40
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e250b
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048530
add esp, 8
mov ecx, 0x102add38
call fcn.10043e40
mov eax, dword [0x102add50]
cmp eax, 0x10
jb 0x100e2565
inc eax
push eax
push dword [0x102add3c]
call fcn.10048530
add esp, 8
lea eax, [ebp - 0xae8]
mov dword [0x102add4c], 0
push eax
mov ecx, 0x102add38
mov dword [0x102add50], 0xf
mov byte [0x102add3c], 0
call fcn.10047aa0
lea ecx, [ebp - 0xae8]
call fcn.10043e40
mov eax, dword [ebp - 0xad0]
cmp eax, 0x10
jb 0x100e25b7
inc eax
push eax
push dword [ebp - 0xae4]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xae8]
push 8
push eax
mov dword [ebp - 0xad4], 0
mov dword [ebp - 0xad0], 0xf
mov byte [ebp - 0xae4], 0
mov dword [ebp - 0xae8], 0
call fcn.10048530
movaps xmm0, xmmword [0x101c2eb0]
add esp, 8
movups xmmword [ebp - 0xae0], xmm0
mov word [ebp - 0xad0], 0x7d60
xor ecx, ecx
mov byte [ebp - 0xace], 0
nop dword [eax]
mov al, byte [ebp - 0xae0]
xor byte [ebp + ecx - 0xadf], al
inc ecx
cmp ecx, 0x11
jb 0x100e2610
mov edx, dword [0x102add4c]
lea ecx, [ebp - 0xadf]
mov byte [ebp - 0xace], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2640
mov edi, 0x7fffffff
sub ecx, esi
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x100e3948
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0xadf]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xacc]
call fcn.10048790
cmp dword [ebp - 0xab4], 0x10
lea eax, [ebp - 0xac8]
lea ecx, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xac8]
sub esp, 8
push 1
push eax
call fcn.10046690
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xd0]
mov eax, dword [eax + 4]
mov ebx, dword [ebp + eax - 0xc4]
call fcn.10044b50
test bl, 6
je 0x100e2857
mov cl, 0x14
mov dword [ebp - 0xa8c], 0x66665114
mov word [ebp - 0xa88], 0x667b
xor eax, eax
mov byte [ebp - 0xa86], 0
xor byte [ebp + eax - 0xa8b], cl
inc eax
cmp eax, 5
jae 0x100e2705
mov cl, byte [ebp - 0xa8c]
jmp 0x100e26f0
movaps xmm0, xmmword [0x101c1860]
xor ecx, ecx
mov byte [ebp - 0xa86], 0
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xaa0], 0x1b145a1f
mov dword [ebp - 0xa9c], 0x135a1f17
mov dword [ebp - 0xa98], 0x161b0c14
mov word [ebp - 0xa94], 0x1e13
mov byte [ebp - 0xa92], 0
nop word [eax + eax]
mov al, byte [ebp - 0xab0]
xor byte [ebp + ecx - 0xaaf], al
inc ecx
cmp ecx, 0x1d
jb 0x100e2750
lea eax, [ebp - 0xa8b]
mov byte [ebp - 0xa92], 0
push 0x30
push eax
lea eax, [ebp - 0xaaf]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x1c
mov esi, esp
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.100484a0
add esp, 4
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [esi + 0x14], 0
push 0
mov dword [esi + 0x18], 0xf
push 0x101b8c74
mov byte [esi + 4], 0
call fcn.10047890
call fcn.100e1e70
add esp, 0x1c
lea ecx, [ebp - 0xacc]
call fcn.10043e40
mov eax, dword [ebp - 0xab4]
cmp eax, 0x10
jb 0x100e2805
inc eax
push eax
push dword [ebp - 0xac8]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xacc]
push 8
push eax
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0xab4], 0xf
mov byte [ebp - 0xac8], 0
mov dword [ebp - 0xacc], 0
call fcn.10048530
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011f880
mov esp, ebp
pop ebp
ret
push 0
push 2
xor bl, bl
mov dword [ebp - 0xc30], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xc30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x100e2a3c
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0xc30]
push eax
push esi
call edi
cmp eax, 1
jne 0x100e2a37
nop
push 8
mov byte [ebp - 0xc31], bl
mov dword [ebp - 0xab0], 0
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0
call fcn.100484a0
lea ecx, [ebp - 0xab0]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0xc0c]
mov dword [eax + 4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2911
sub ecx, edx
lea eax, [ebp - 0xc0c]
push ecx
push eax
lea ecx, [ebp - 0xab0]
call fcn.10047890
movaps xmm0, xmmword [0x101c1f60]
xor ecx, ecx
movups xmmword [ebp - 0xae0], xmm0
mov word [ebp - 0xad0], 0x3c
nop word [eax + eax]
mov al, byte [ebp - 0xae0]
xor byte [ebp + ecx - 0xadf], al
inc ecx
cmp ecx, 0x10
jb 0x100e2950
lea edx, [ebp - 0xadf]
mov byte [ebp - 0xacf], 0
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100e2973
sub edx, ecx
lea eax, [ebp - 0xadf]
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xaac]
push edx
cmovae ecx, dword [ebp - 0xaac]
mov edx, dword [ebp - 0xa9c]
push eax
push 0
call fcn.100861e0
lea ecx, [ebx + 1]
add esp, 0xc
movzx ebx, cl
cmp eax, 0xffffffff
movzx ecx, byte [ebp - 0xc31]
cmove ebx, ecx
lea ecx, [ebp - 0xab0]
call fcn.10043e40
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e29e1
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048530
add esp, 8
lea eax, [ebp - 0xc30]
push eax
push esi
call edi
cmp eax, 1
je 0x100e28a0
cmp bl, 3
jbe 0x100e2a37
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, 0x7fffffff
mov cl, 0x21
mov dword [ebp - 0xa90], 0x78637d21
mov dword [ebp - 0xa8c], 0x72626073
xor eax, eax
mov dword [ebp - 0xa88], 0x4d4d450f
mov byte [ebp - 0xa84], 0
xor byte [ebp + eax - 0xa8f], cl
inc eax
cmp eax, 0xb
jae 0x100e2a7a
mov cl, byte [ebp - 0xa90]
jmp 0x100e2a65
mov edx, dword [0x102add4c]
lea ecx, [ebp - 0xa8f]
mov byte [ebp - 0xa84], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2a90
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100e3948
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0xa8f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xab0]
call fcn.10048790
lea ecx, [ebp - 0xacc]
call fcn.10043e40
mov eax, dword [ebp - 0xab4]
cmp eax, 0x10
jb 0x100e2afa
inc eax
push eax
push dword [ebp - 0xac8]
call fcn.10048530
add esp, 8
lea eax, [ebp - 0xab0]
mov dword [ebp - 0xab8], 0
push eax
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xab4], 0xf
mov byte [ebp - 0xac8], 0
call fcn.10047aa0
lea ecx, [ebp - 0xab0]
call fcn.10043e40
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e2b4d
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048530
cmp dword [ebp - 0xab4], 0x10
lea eax, [ebp - 0xac8]
push 1
cmovae eax, dword [ebp - 0xac8]
lea ecx, [ebp - 0xd0]
push eax
call fcn.10046690
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xd0]
mov eax, dword [eax + 4]
mov ebx, dword [ebp + eax - 0xc4]
call fcn.10044b50
test bl, 6
je 0x100e2c73
movaps xmm0, xmmword [0x101c2500]
xor ecx, ecx
movups xmmword [ebp - 0xab0], xmm0
mov dword [ebp - 0xaa0], 0x21450b2c
mov dword [ebp - 0xa9c], 0x600170c
mov dword [ebp - 0xa98], 0x1c170a11
mov byte [ebp - 0xa94], 0
nop dword [eax + eax]
mov al, byte [ebp - 0xab0]
xor byte [ebp + ecx - 0xaaf], al
inc ecx
cmp ecx, 0x1b
jb 0x100e2c00
mov byte [ebp - 0xa94], 0
mov cl, 0x7e
mov dword [ebp - 0xa90], 0x273c227e
xor eax, eax
mov dword [ebp - 0xa8c], 0x2d3d3f2c
mov dword [ebp - 0xa88], 0x12121a50
mov byte [ebp - 0xa84], 0
xor byte [ebp + eax - 0xa8f], cl
inc eax
cmp eax, 0xb
jae 0x100e2c58
mov cl, byte [ebp - 0xa90]
jmp 0x100e2c43
lea eax, [ebp - 0xaaf]
mov byte [ebp - 0xa84], 0
push 0x30
push eax
lea eax, [ebp - 0xa8f]
jmp 0x100e2779
push 0x64
lea eax, [ebp - 0x280]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push 8
mov dword [ebp - 0xb00], 0
call fcn.100484a0
lea ecx, [ebp - 0xb04]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 0x280]
mov dword [eax + 4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2ce1
sub ecx, edx
lea eax, [ebp - 0x280]
push ecx
push eax
lea ecx, [ebp - 0xb04]
call fcn.10047890
push 0x558
call fcn.1011fb90
mov edx, dword [0x102add4c]
mov cl, 0x42
mov dword [ebp - 0xa88], eax
mov al, 0x1e
xor cl, al
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x17], cl
sub esp, 0x18
lea ecx, [ebp - 0x17]
mov byte [ebp - 0x18], al
mov byte [ebp - 0x16], 0
lea esi, [ecx + 1]
mov dword [ebp - 0xc38], esp
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2d36
mov eax, edi
sub ecx, esi
sub eax, edx
cmp eax, ecx
jb 0x100e3948
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0x17]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
mov ecx, dword [ebp - 0xc38]
call fcn.10048790
mov ecx, dword [ebp - 0xa88]
call fcn.100d3b40
push 0x30
mov dword [0x1027c0b4], eax
call fcn.1011fb90
mov edx, dword [0x102add4c]
mov esi, eax
mov al, 0x13
mov byte [ebp - 0x16], 0
mov cl, 0x4f
mov byte [ebp - 0x18], al
add esp, 4
mov dword [ebp - 0xc38], esi
xor cl, al
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x17], cl
lea ecx, [ebp - 0x17]
lea eax, [ecx + 1]
mov dword [ebp - 0xa88], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e2dc0
sub ecx, dword [ebp - 0xa88]
sub edi, edx
cmp edi, ecx
jb 0x100e394d
cmp dword [0x102add50], 0x10
mov eax, 0x102add3c
push ecx
cmovae eax, dword [0x102add3c]
lea ecx, [ebp - 0x17]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0xa87]
lea ecx, [ebp - 0xab0]
call fcn.10048790
lea edi, [esi + 8]
mov dword [ebp - 4], 0
push 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.100484a0
add esi, 0x24
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [eax + 4], 0
mov dword [edi], eax
mov dword [eax], edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.100484a0
add esp, 4
mov dword [eax], esi
mov dword [eax + 4], 0
push 0x40
mov dword [esi], eax
call fcn.100484a0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi + 4], eax
lea eax, [ebp - 0xab0]
cmp edi, eax
je 0x100e2ec9
cmp dword [ebp - 0xa98], 0x10
lea eax, [ebp - 0xaac]
push dword [ebp - 0xa9c]
cmovae eax, dword [ebp - 0xaac]
mov ecx, edi
push eax
call fcn.10047890
lea ecx, [ebp - 0xab0]
call fcn.10043e40
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e2eef
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048530
mov eax, dword [ebp - 0xc38]
add esp, 8
mov dword [0x1027c0b0], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0xa88], eax
mov edx, dword [ebp - 0xa88]
mov ecx, dword [0x102adb80]
push str.BYRACS_Log.txt
mov eax, dword [edx + 0xa4]
mov dword [ecx + 0xe8], eax
mov eax, dword [edx + 0xa8]
mov dword [ecx + 0xec], eax
movzx eax, word [edx + 0xac]
mov word [ecx + 0xf0], ax
movzx eax, word [edx + 0xae]
mov word [ecx + 0xf2], ax
mov eax, dword [edx + 0xbc]
mov dword [ecx + 0x100], eax
mov eax, dword [edx + 0xb8]
mov dword [ecx + 0xfc], eax
mov eax, dword [edx + 0xb0]
mov dword [ecx + 0xf4], eax
mov eax, dword [edx + 0xb4]
mov dword [ecx + 0xf8], eax
call fcn.1013ff10
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x218]
add esp, 4
push eax
push 0x200
call esi
push str.hostfix.bat
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.10141a30
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x218]
push 0x101be394
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10140d60
mov eax, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
je 0x100e3033
push eax
call fcn.10136070
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.101408b1
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.1013ff10
add esp, 4
push 0x200
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10122870
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x200
call esi
push str.ws2_32.dll
lea eax, [ebp - 0x218]
push 0x200
push eax
call fcn.10141a30
add esp, 0xc
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x218]
push 0x101be394
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10140d60
mov eax, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
je 0x100e30ae
push eax
call fcn.10136070
add esp, 4
lea eax, [ebp - 0x218]
push eax
call fcn.1013ff10
add esp, 4
push 0x400
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.10122870
add esp, 0xc
push 0
push str.Oyun_ba
call fcn.100a4100
push str.Fri_Oct_18_22:24:49_2024
push str.A510225
lea eax, [ebp - 0xa80]
push str.BYRACS_s
push eax
call fcn.100de660
add esp, 0x10
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.100a4100
mov ecx, dword [0x102adb80]
movzx eax, word [ecx + 0xf2]
push eax
movzx eax, word [ecx + 0xf0]
push eax
push dword [ecx + 0xec]
lea eax, [ebp - 0xa80]
push dword [ecx + 0xe8]
push str.Windows_s
push eax
call fcn.100de660
add esp, 0x18
lea eax, [ebp - 0xa80]
push 0
push eax
call fcn.100a4100
push 0
push str.Ana_i
call fcn.100a4100
push 0x400
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.10122870
mov eax, dword [0x102adb80]
add esp, 0xc
add eax, 0x25
xor eax, 0xffffffbb
imul eax, eax, 0xffffff94
and eax, 0xcc
push eax
lea eax, [ebp - 0x680]
push str._KK___x_
push eax
call fcn.100de660
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xb0]
xor eax, 0x2c
imul eax, eax, 0xfffffff5
and eax, 0x5d
push eax
lea eax, [ebp - 0x680]
push str._SZ1___x_
push eax
call fcn.100524f0
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xac]
xor eax, 0xfffffff2
imul eax, eax, 0xfffffff6
and eax, 0x14
push eax
lea eax, [ebp - 0x680]
push str._SZ2___x_
push eax
call fcn.100de660
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xb4]
xor eax, 0xffffffde
imul eax, eax, 0xfffffff1
and eax, 0x4e
push eax
lea eax, [ebp - 0x680]
push str._SZ3___x_
push eax
call fcn.100de660
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
mov eax, dword [0x102adb80]
push dword [eax + 0xc]
lea eax, [ebp - 0x680]
push str.CSRSS_process_id:__i
push eax
call fcn.100de660
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
mov eax, dword [0x102adb80]
push dword [eax + 0x10]
lea eax, [ebp - 0x680]
push str.WLG_process_id:__i
push eax
call fcn.100de660
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0xa0]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x680]
push str._SM1___x_
push eax
call fcn.100de660
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0x14]
xor eax, 0x67
imul eax, eax, 0xffffff88
and eax, 0xe3
push eax
lea eax, [ebp - 0x680]
push str._SM2___x_
push eax
call fcn.100de660
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1027c0a4], eax
test eax, eax
je 0x100e332f
lea eax, [ebp - 0x18]
push eax
call ebx
push eax
call dword [0x1027c0a4]
cmp dword [ebp - 0x18], 0
je 0x100e3359
push 0
push str._x64__sistem_belirlendi
call fcn.100a4100
push 0
push str.Sistem_servisi_ba
call fcn.100a4100
push 0
push 0x101bfe20
call fcn.100a4100
push 0
push str.Islemci_calisma_kumesi_olusturuldu.
call fcn.100a4100
push 0
push str.Bellek_arayuzu_entegrasyonu_basladi
call fcn.100a4100
push 0
push str.Bellek_arayuzu_entegrasyonu_tamamlandi
call fcn.100a4100
push 0
push str.Essiz_kimlik_olusturuldu
call fcn.100a4100
mov eax, dword [0x102adb80]
mov eax, dword [eax + 0x2c]
xor eax, 0xfffffffe
and eax, 0x21
push eax
lea eax, [ebp - 0x680]
push str.Yans
push eax
call fcn.100de660
add esp, 0xc
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.100a4100
push 0
push str.AA_sistemi_aktif_edildi
call fcn.100a4100
push 0
push str.Haklar_al
call fcn.100a4100
lea eax, [ebp - 0x18]
push eax
push 0x20
call ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100e3935
lea eax, [ebp - 0xa8c]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
test eax, eax
je 0x100e3965
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xa88]
push 0
push 0x10
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xadc]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xad0], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x100e3952
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.Haklar_elde_edildi
call fcn.100a4100
push 0
push str.Sistem_ayarlar
call fcn.100a4100
push 0x101bf2e8
push str.kernel32.dll
call fcn.100a4200
push 0x101bf2fc
push str.kernel32.dll
call fcn.100a4200
push 0x101bff8c
push str.kernel32.dll
call fcn.100a4200
push 0x101bf320
push str.kernel32.dll
call fcn.100a4200
push 0x101bf310
push str.kernel32.dll
call fcn.100a4200
push 0x101bff9c
push str.kernel32.dll
call fcn.100a4200
push 0x101bff74
push str.Winmm.dll
call fcn.100a4200
push 0
push str.Sistem_segmentleri_kontrol_ediliyor
call fcn.100a4100
mov ecx, dword [0x1027c0b4]
call fcn.100946e0
push 0
push str.Log_sistemi_aktif_ediliyor
call fcn.100a4100
push 0
push str.Adres_y
call fcn.100a4100
push 0
push str.Kimlik_y
call fcn.100a4100
push 0
push str.Geni
call fcn.100a4100
call fcn.100e4130
push 0
push 0x101c00bc
call fcn.100a4100
push 0x3c
call fcn.1011fb90
add esp, 4
mov ecx, eax
call fcn.10044c50
mov dword [0x1027c090], eax
mov esi, dword [eax + 4]
mov edi, dword [eax + 8]
cmp esi, edi
je 0x100e3606
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
nop dword [eax]
push esi
lea ecx, [ebp - 0xab0]
call fcn.10046ed0
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xa88]
push ecx
push 0xf003f
lea eax, [ebp - 0xaac]
cmovae eax, dword [ebp - 0xaac]
push 0
push eax
push connect
call ebx
lea ecx, [ebp - 0xab0]
cmp eax, 2
jne 0x100e37b1
call fcn.10043e40
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e35c5
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048530
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100e3560
xor bh, bh
mov eax, dword [0x1027c090]
mov esi, dword [eax + 0x14]
mov edi, dword [eax + 0x18]
cmp esi, edi
je 0x100e36b4
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0xab0]
call fcn.10046ed0
cmp dword [ebp - 0xa98], 0x10
lea ecx, [ebp - 0xaac]
cmovae ecx, dword [ebp - 0xaac]
call fcn.10044b10
lea ecx, [ebp - 0xab0]
test al, al
jne 0x100e380e
call fcn.10043e40
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e3673
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048530
add esi, 0x1c
add esp, 8
cmp esi, edi
jne 0x100e3620
xor bl, bl
push 0
push str.PC_ban_sistemi_kontrol_ediliyor.
call fcn.100a4100
test bh, bh
jne 0x100e386b
test bl, bl
jne 0x100e386b
mov eax, dword [0x101bfda4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x18], eax
mov ax, word [0x101bfda8]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xa88]
push eax
push 0x40
push 5
push 0x510de7
call esi
mov ecx, 0x510de7
mov byte [ebp - 0x18], 0xe9
mov eax, 0x100e2400
sub eax, 0x510dec
mov dword [ebp - 0x17], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
mov al, byte [ebp - 0x14]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc38]
push eax
push dword [ebp - 0xa88]
push 5
push ecx
call esi
push 0
push 0
push 0
push 0x100e4dc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.ClientPlugin_aktif_edildi.
call fcn.100a4100
lea ecx, [ebp - 0xb04]
call fcn.10043e40
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x100e3776
inc eax
push eax
push dword [ebp - 0xb00]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xb04]
push 8
push eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
call fcn.10048530
add esp, 8
jmp 0x100e27df
call fcn.10043e40
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e37d1
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048530
add esp, 8
mov bh, 1
jmp 0x100e3608
call fcn.10043e40
mov eax, dword [ebp - 0xa98]
cmp eax, 0x10
jb 0x100e382e
inc eax
push eax
push dword [ebp - 0xaac]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xab0]
push 8
push eax
mov dword [ebp - 0xa9c], 0
mov dword [ebp - 0xa98], 0xf
mov byte [ebp - 0xaac], 0
mov dword [ebp - 0xab0], 0
call fcn.10048530
add esp, 8
mov bl, 1
jmp 0x100e36b6
push 1
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
call fcn.100a4100
sub esp, 0x1c
mov esi, esp
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.100484a0
add esp, 4
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
push 0x39
push str.Sorry__you_blocked_me_from_performing_an_unwanted_action.
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
call fcn.10047890
call fcn.100e1e70
add esp, 0x1c
lea ecx, [ebp - 0xb04]
call fcn.10043e40
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x100e38fa
inc eax
push eax
push dword [ebp - 0xb00]
call fcn.10048530
add esp, 8
mov eax, dword [ebp - 0xb04]
push 8
push eax
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], 0xf
mov byte [ebp - 0xb00], 0
mov dword [ebp - 0xb04], 0
call fcn.10048530
add esp, 8
jmp 0x100e27df
push 0
push str.Haklar_elde_edilemedi
call fcn.100a4100
push 0
call fcn.1013f450
call fcn.10043e90
call fcn.10043e90
push 0
push str.Haklar_elde_edilemedi__yetersiz_yetkilendirme
call fcn.100a4100
push 0
call fcn.1013f450
push str.Haklar_elde_edilemedi__yetersiz_yetki_alani
call fcn.100a4100
push 0
call fcn.1013f450
int3