Function at 0x10001773
Capabilities:
Copy file
Encode data using xor
Query environment variable
Terminate process

Disassembly:
push 0xac4
mov eax, 0x1001abbb
call fcn.1001a517
mov dword [ebp - 0xa8c], edx
mov esi, ecx
mov dword [ebp - 0xab0], esi
xor eax, eax
lea edi, [ebp - 0x81c]
stosd dword es:[edi], eax
xor ecx, ecx
push 7
pop edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 0x808], edx
mov word [ebp - 0x81c], ax
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x834]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x820], edx
mov word [ebp - 0x834], ax
push esi
push str._s.
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 1
push 0xff
push eax
call fcn.10001030
mov eax, dword [0x10024464]
lea ecx, [ebp - 0xa84]
add esp, 0x10
push ecx
lea ecx, [ebp - 0x210]
push ecx
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
push 0xa
pop eax
push 0x6c
pop ecx
push 0x69
mov dword [ebp - 0xa94], edi
mov dword [ebp - 0xa90], eax
pop edx
cmp edi, 0xffffffff
je 0x10001bbf
cmp dword [0x10024484], 1
jne 0x10001847
cmp dword [0x10024480], 1
je 0x10001bb9
test byte [ebp - 0xa84], 0x10
mov ax, word [ebp - 0xa58]
je 0x10001894
cmp ax, 0x2e
je 0x10001894
lea eax, [ebp - 0xa58]
push eax
push esi
push 0x10020eb4
lea eax, [ebp - 0x210]
push 0xff
push eax
call fcn.10001030
mov edx, dword [ebp - 0xa8c]
lea ecx, [ebp - 0x210]
add esp, 0x14
call fcn.10001773
jmp 0x10001b9c
cmp dword [0x10024480], 0
jne 0x10001b12
cmp ax, 0x6d
jne 0x10001b12
cmp word [ebp - 0xa56], 0x79
jne 0x10001b9c
cmp word [ebp - 0xa54], cx
jne 0x10001b9c
cmp word [ebp - 0xa52], dx
jne 0x10001b9c
cmp word [ebp - 0xa50], 0x6e
jne 0x10001b9c
push str.IRA3BDVBaRAtB_VB_BAwBKhBaBAsBD7BbtBvBDtBadAqBB__
lea eax, [ebp - 0x404]
push 0x1f4
push eax
call fcn.100010b9
lea edx, [ebp - 0x404]
add esp, 0xc
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10001903
sub edx, ecx
lea eax, [ebp - 0xa88]
push eax
lea ecx, [ebp - 0x404]
mov dword [ebp - 0xa88], edx
call fcn.10002aad
mov ecx, dword [ebp - 0xa88]
mov esi, eax
push esi
push 0x10020cb8
mov edi, 0xff
lea eax, [ebp - 0x804]
push edi
push eax
mov word [ecx + esi], 0
call fcn.10001030
push esi
call fcn.1000bc09
add esp, 0x18
lea eax, [ebp - 0x604]
push edi
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x604]
push eax
lea ecx, [ebp - 0xad0]
call fcn.1000268c
push 3
pop ecx
push ecx
push ecx
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.100028e5
push eax
lea ecx, [ebp - 0xaac]
call fcn.10002651
lea ecx, [ebp - 0x81c]
call fcn.100027ab
push 6
pop ecx
lea esi, [ebp - 0xaac]
xor eax, eax
lea edi, [ebp - 0x81c]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0xa98], 7
lea ecx, [ebp - 0xaac]
mov dword [ebp - 0xa9c], edi
mov word [ebp - 0xaac], ax
call fcn.100027ab
lea ecx, [ebp - 0xad0]
mov byte [ebp - 4], 1
call fcn.100027ab
push 0xa
push str.s_bovb_ff
lea ecx, [ebp - 0x834]
call fcn.100027d1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa88], esp
push str.PT30S
call fcn.1000268c
push 3
pop eax
sub esp, 0x18
mov byte [ebp - 4], al
lea eax, [ebp - 0x81c]
mov dword [ebp - 0xab4], esp
mov ecx, esp
push eax
call fcn.1000272a
sub esp, 0x18
mov byte [ebp - 4], 4
mov esi, esp
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0xaac]
call fcn.1000272a
mov ecx, edi
cmp dword [ebp - 0xa9c], ecx
jbe 0x10001a75
push 3
pop edx
cmp dword [ebp - 0xa98], 7
lea eax, [ebp - 0xaac]
cmova eax, dword [ebp - 0xaac]
xor word [eax + ecx*2], dx
inc ecx
cmp ecx, dword [ebp - 0xa9c]
jb 0x10001a54
lea eax, [ebp - 0xaac]
mov ecx, esi
push eax
call fcn.10002651
lea ecx, [ebp - 0xaac]
call fcn.100027ab
mov ecx, str.CLIManagementTask
mov byte [ebp - 4], 1
call fcn.10001e52
mov esi, dword [ebp - 0xab0]
lea eax, [ebp - 0xa58]
push eax
push esi
push 0x10020eb4
lea eax, [ebp - 0x210]
push 0xff
push eax
call fcn.10001030
add esp, 0x5c
lea eax, [ebp - 0x604]
push edi
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push dword [0x10024470]
mov dword [0x10024480], 1
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x10024470]
call ebx
push dword [0x10024474]
call ebx
mov ax, word [ebp - 0xa58]
mov edi, dword [ebp - 0xa94]
push 0x6c
pop ecx
push 0x69
pop edx
cmp ax, 0x65
jne 0x10001b9c
cmp word [ebp - 0xa56], 0x71
jne 0x10001b9c
cmp word [ebp - 0xa54], cx
jne 0x10001b9c
cmp word [ebp - 0xa52], dx
jne 0x10001b9c
cmp word [ebp - 0xa50], 0x73
jne 0x10001b9c
lea eax, [ebp - 0xa58]
push eax
push esi
push 0x10020eb4
lea eax, [ebp - 0x210]
push 0xff
push eax
call fcn.10001030
add esp, 0x14
mov dword [0x10024484], 1
push 0
push dword [0x10024454]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x10024454]
call ebx
push dword [0x10024458]
call ebx
mov edx, dword [ebp - 0xa8c]
lea ecx, [ebp - 0x210]
call fcn.10001bec
mov eax, dword [0x10024468]
lea ecx, [ebp - 0xa84]
push ecx
push edi
call eax
push 0x6c
pop ecx
push 0x69
pop edx
test eax, eax
jne 0x10001831
mov eax, dword [ebp - 0xa90]
sub eax, 1
mov dword [ebp - 0xa90], eax
jne 0x10001828
lea ecx, [ebp - 0x834]
call fcn.100027ab
lea ecx, [ebp - 0x81c]
call fcn.100027ab
xor eax, eax
call fcn.1001a4d5
ret