Function at 0x10002840
Capabilities:
Contain obfuscated stackstrings
Create http request
Create process on windows
Encode data using xor
Read data from internet
Receive data
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000c776
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1118
call fcn.1000c6a0
mov eax, dword [0x10010040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 1
push str.HTTP
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edx, eax
mov dword [ebp - 0x10b4], edx
test edx, edx
jne 0x1000298a
movaps xmm0, xmmword [0x1000db50]
mov al, 0xd6
mov byte [ebp - 0x1020], 0x18
mov cl, 0xe0
xor al, byte [ebp - 0x1020]
mov ch, 0xf2
mov byte [ebp - 0x101f], al
mov dl, 0xf0
mov al, byte [ebp - 0x1020]
mov ah, 0xf9
mov dh, 0xf8
mov byte [ebp - 0x1019], 0
xor cl, al
mov byte [ebp - 0x1019], 0
xor ch, al
mov byte [ebp - 0x101e], cl
xor dl, al
mov byte [ebp - 0x101b], ch
xor ah, al
mov byte [ebp - 0x101d], dl
xor dh, al
mov byte [ebp - 0x101c], ah
movups xmmword [ebp - 0x10ac], xmm0
xor ecx, ecx
mov byte [ebp - 0x101a], dh
movaps xmm0, xmmword [0x1000db40]
movups xmmword [ebp - 0x109c], xmm0
mov dword [ebp - 0x108c], 0xb7a8ad65
mov dword [ebp - 0x1088], 0xa0a8b5a0
mov dword [ebp - 0x1084], 0x6ba9abb7
mov byte [ebp - 0x1080], 0
nop word [eax + eax]
mov al, byte [ebp - 0x10ac]
xor byte [ebp + ecx - 0x10ab], al
inc ecx
cmp ecx, 0x2b
jb 0x10002950
push 0x10
lea eax, [ebp - 0x101f]
mov byte [ebp - 0x1080], 0
push eax
lea eax, [ebp - 0x10ab]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movaps xmm0, xmmword [0x1000d930]
xor ecx, ecx
movups xmmword [ebp - 0x1128], xmm0
mov dword [ebp - 0x10c8], 0x4a4b151d
movaps xmm0, xmmword [0x1000da10]
movups xmmword [ebp - 0x1118], xmm0
mov dword [ebp - 0x10c4], 0x4e564e0e
movaps xmm0, xmmword [0x1000d990]
movups xmmword [ebp - 0x1108], xmm0
mov byte [ebp - 0x10c0], 0
movaps xmm0, xmmword [0x1000d9f0]
movups xmmword [ebp - 0x10f8], xmm0
movaps xmm0, xmmword [0x1000d9a0]
movups xmmword [ebp - 0x10e8], xmm0
movaps xmm0, xmmword [0x1000d920]
movups xmmword [ebp - 0x10d8], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x1128]
xor byte [ebp + ecx - 0x1127], al
inc ecx
cmp ecx, 0x67
jb 0x10002a00
push 0
push 0x80000000
push 0
push 0
lea eax, [ebp - 0x1127]
mov byte [ebp - 0x10c0], 0
push eax
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
mov dword [ebp - 0x10b0], esi
test esi, esi
jne 0x10002b2b
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
movaps xmm1, xmmword [0x1000da90]
mov al, 0xd6
movaps xmm0, xmmword [0x1000daf0]
mov cl, 0xe0
mov byte [ebp - 0x1020], 0x18
mov ch, 0xf2
xor al, byte [ebp - 0x1020]
mov dl, 0xf0
mov byte [ebp - 0x101f], al
mov ah, 0xf9
mov al, byte [ebp - 0x1020]
mov dh, 0xf8
xor cl, al
mov byte [ebp - 0x1019], 0
xor ch, al
mov byte [ebp - 0x101e], cl
xor dl, al
mov byte [ebp - 0x101b], ch
xor ah, al
mov byte [ebp - 0x101d], dl
xor dh, al
mov byte [ebp - 0x101c], ah
mov byte [ebp - 0x101a], dh
xor ecx, ecx
mov byte [ebp - 0x1019], 0
movups xmmword [ebp - 0x10ac], xmm0
mov dword [ebp - 0x108c], 0x418d8191
movups xmmword [ebp - 0x109c], xmm1
mov dword [ebp - 0x1088], 0x92938f80
mov word [ebp - 0x1084], 0x4f
nop word [eax + eax]
mov al, byte [ebp - 0x10ac]
xor byte [ebp + ecx - 0x10ab], al
inc ecx
cmp ecx, 0x28
jb 0x10002af0
push 0x10
lea eax, [ebp - 0x101f]
mov byte [ebp - 0x1083], 0
push eax
lea eax, [ebp - 0x10ab]
push eax
push 0
call esi
push dword [ebp - 0x10b4]
call edi
jmp 0x10002a4f
xorps xmm0, xmm0
mov dword [ebp - 0x103c], 0
movups xmmword [ebp - 0x104c], xmm0
mov dword [ebp - 0x1038], 0xf
mov byte [ebp - 0x104c], 0
lea eax, [ebp - 0x1034]
mov dword [ebp - 4], 0
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10002c47
nop dword [eax]
mov eax, dword [ebp - 0x1034]
test eax, eax
je 0x10002c47
cmp eax, 0x1000
jae 0x1000309c
lea edi, [ebp - 0x1018]
mov byte [ebp + eax - 0x1018], 0
lea ecx, [edi + 1]
nop word [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x10002bb0
mov edx, dword [ebp - 0x1038]
sub edi, ecx
mov ecx, dword [ebp - 0x103c]
mov eax, edx
sub eax, ecx
push edi
cmp edi, eax
ja 0x10002c05
lea eax, [edi + ecx]
cmp edx, 0xf
mov dword [ebp - 0x103c], eax
lea esi, [ebp - 0x104c]
cmova esi, dword [ebp - 0x104c]
lea eax, [ebp - 0x1018]
add esi, ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + edi], 0
add esp, 0xc
mov esi, dword [ebp - 0x10b0]
jmp 0x10002c25
lea eax, [ebp - 0x1018]
mov byte [ebp - 0x101c], 0
push eax
push dword [ebp - 0x101c]
lea ecx, [ebp - 0x104c]
push edi
call fcn.10004b80
lea eax, [ebp - 0x1034]
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x10002b80
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x10b4]
call esi
cmp dword [ebp - 0x1038], 0xf
lea ecx, [ebp - 0x104c]
mov eax, dword [ebp - 0x103c]
cmova ecx, dword [ebp - 0x104c]
mov dword [ebp - 0x10b0], ecx
cmp eax, 0xe
jb 0x10002d10
add eax, 0xfffffff3
add eax, ecx
mov dword [ebp - 0x101c], eax
sub eax, ecx
push eax
push 0x22
push ecx
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10002d10
mov ecx, edi
mov edx, str._success_:true
mov esi, 0xa
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002cc1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002cb0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002ce8
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002ce8
cmp esi, 0xfffffffe
je 0x10002ce4
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002ce8
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x10002ce8
xor eax, eax
jmp 0x10002ced
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002de2
mov eax, dword [ebp - 0x101c]
inc edi
sub eax, edi
push eax
push 0x22
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10002ca0
or edi, 0xffffffff
mov ecx, str.false
cmp edi, 0xffffffff
mov eax, str.true
cmove eax, ecx
lea ecx, [ebp - 0x107c]
push eax
call fcn.100046e0
push str.true
lea ecx, [ebp - 0x1064]
mov byte [ebp - 4], 1
call fcn.100046e0
push str.false
lea ecx, [ebp - 0x1030]
mov byte [ebp - 4], 2
call fcn.100046e0
cmp dword [ebp - 0x1050], 0xf
lea ecx, [ebp - 0x1064]
mov edi, dword [ebp - 0x107c]
lea edx, [ebp - 0x107c]
cmova ecx, dword [ebp - 0x1064]
cmp dword [ebp - 0x1068], 0xf
mov esi, dword [ebp - 0x106c]
cmova edx, edi
cmp esi, dword [ebp - 0x1054]
jne 0x10002ef5
sub esi, 4
jb 0x10002da9
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x10002dae
add edx, 4
add ecx, 4
sub esi, 4
jae 0x10002d98
cmp esi, 0xfffffffc
je 0x10002ded
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x10002ddb
cmp esi, 0xfffffffd
je 0x10002ded
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x10002ddb
cmp esi, 0xfffffffe
je 0x10002ded
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x10002ddb
cmp esi, 0xffffffff
je 0x10002ded
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x10002ded
sbb eax, eax
or eax, 1
jmp 0x10002def
sub edi, dword [ebp - 0x10b0]
jmp 0x10002d13
xor eax, eax
test eax, eax
jne 0x10002ef5
mov ecx, dword [ebp - 0x101c]
cmp ecx, 0xf
jbe 0x10002e31
mov edx, dword [ebp - 0x1030]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002e27
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002ec7
push ecx
push edx
call fcn.1000b678
add esp, 8
mov eax, dword [ebp - 0x1050]
cmp eax, 0xf
jbe 0x10002e69
mov edx, dword [ebp - 0x1064]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x10002e5f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002ec7
push ecx
push edx
call fcn.1000b678
add esp, 8
mov eax, dword [ebp - 0x1068]
cmp eax, 0xf
jbe 0x10002e9b
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x10002e91
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002ec7
push ecx
push edi
call fcn.1000b678
add esp, 8
mov ecx, dword [ebp - 0x1038]
cmp ecx, 0xf
jbe 0x10002ed7
mov edx, dword [ebp - 0x104c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002ecd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10002ecd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1000b678
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000b66a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov dl, 0x59
mov dword [ebp - 0x1028], 0x353c0d59
mov dword [ebp - 0x1024], 0x382b3e3c
xor ecx, ecx
mov dword [ebp - 0x1020], 0x363b7934
mov word [ebp - 0x101c], 0x2d
lea eax, [ebp - 0x1027]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10002f37
mov dl, byte [ebp - 0x1028]
jmp 0x10002f20
movaps xmm0, xmmword [0x1000db20]
xor ecx, ecx
movups xmmword [ebp - 0x1120], xmm0
mov byte [ebp - 0x101b], 0
movaps xmm0, xmmword [0x1000dab0]
movups xmmword [ebp - 0x1110], xmm0
mov dword [ebp - 0x10d0], 0x888e808e
movaps xmm0, xmmword [0x1000daa0]
movups xmmword [ebp - 0x1100], xmm0
mov dword [ebp - 0x10cc], 0x4b878b9b
movaps xmm0, xmmword [0x1000da00]
movups xmmword [ebp - 0x10f0], xmm0
mov dword [ebp - 0x10c8], 0x8e99858a
movaps xmm0, xmmword [0x1000db10]
movups xmmword [ebp - 0x10e0], xmm0
mov word [ebp - 0x10c4], 0x45
nop dword [eax]
mov al, byte [ebp - 0x1120]
xor byte [ebp + ecx - 0x111f], al
inc ecx
cmp ecx, 0x5c
jb 0x10002fb0
push 0x40
lea eax, [ebp - 0x1027]
mov byte [ebp - 0x10c3], 0
push eax
lea eax, [ebp - 0x111f]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
movaps xmm0, xmmword [0x1000da70]
xor ecx, ecx
movups xmmword [ebp - 0x10a0], xmm0
mov dword [ebp - 0x1090], 0x735c596f
mov dword [ebp - 0x108c], 0x40404547
mov dword [ebp - 0x1088], 0x4e737e49
mov word [ebp - 0x1084], 0x5843
mov byte [ebp - 0x1082], 0
mov al, byte [ebp - 0x10a0]
xor byte [ebp + ecx - 0x109f], al
inc ecx
cmp ecx, 0x1d
jb 0x10003020
mov ch, 0x2b
mov byte [ebp - 0x101b], 0
push 0xa
mov al, 0x44
mov byte [ebp - 0x1082], 0
mov ah, 0x45
mov byte [ebp - 0x1020], ch
xor al, ch
mov byte [ebp - 0x101b], 0
xor ah, ch
mov byte [ebp - 0x101f], al
push 0
mov byte [ebp - 0x101c], ah
mov cl, 0x5b
push 0
lea eax, [ebp - 0x109f]
mov dl, 0x4e
push eax
lea eax, [ebp - 0x101f]
xor cl, ch
push eax
xor dl, ch
mov byte [ebp - 0x101e], cl
push 0
mov byte [ebp - 0x101d], dl
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.1000bb16
int3