Function at 0x10002850
Capabilities:
Contain obfuscated stackstrings
Create http request
Create process on windows
Encode data using xor
Read data from internet
Receive data
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000c376
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1118
call fcn.1000c2a0
mov eax, dword [0x10010040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 1
push str.HTTP
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edx, eax
mov dword [ebp - 0x10b4], edx
test edx, edx
jne 0x1000299a
movaps xmm0, xmmword [0x1000db90]
or al, 0xff
mov byte [ebp - 0x1020], 0x31
mov cl, 0xc9
xor al, byte [ebp - 0x1020]
mov ch, 0xdb
mov byte [ebp - 0x101f], al
mov dl, 0xd9
mov al, byte [ebp - 0x1020]
mov ah, 0xd0
mov dh, 0xd1
mov byte [ebp - 0x1019], 0
xor cl, al
mov byte [ebp - 0x1019], 0
xor ch, al
mov byte [ebp - 0x101e], cl
xor dl, al
mov byte [ebp - 0x101b], ch
xor ah, al
mov byte [ebp - 0x101d], dl
xor dh, al
mov byte [ebp - 0x101c], ah
movups xmmword [ebp - 0x10ac], xmm0
xor ecx, ecx
mov byte [ebp - 0x101a], dh
movaps xmm0, xmmword [0x1000dba0]
movups xmmword [ebp - 0x109c], xmm0
mov dword [ebp - 0x108c], 0xccd3d61e
mov dword [ebp - 0x1088], 0xdbd3cedb
mov dword [ebp - 0x1084], 0x10d2d0cc
mov byte [ebp - 0x1080], 0
nop word [eax + eax]
mov al, byte [ebp - 0x10ac]
xor byte [ebp + ecx - 0x10ab], al
inc ecx
cmp ecx, 0x2b
jb 0x10002960
push 0x10
lea eax, [ebp - 0x101f]
mov byte [ebp - 0x1080], 0
push eax
lea eax, [ebp - 0x10ab]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movaps xmm0, xmmword [0x1000da30]
xor ecx, ecx
movups xmmword [ebp - 0x1128], xmm0
mov dword [ebp - 0x10c8], 0x7879272f
movaps xmm0, xmmword [0x1000db10]
movups xmmword [ebp - 0x1118], xmm0
mov dword [ebp - 0x10c4], 0x7a647c3c
movaps xmm0, xmmword [0x1000da60]
movups xmmword [ebp - 0x1108], xmm0
mov byte [ebp - 0x10c0], 0
movaps xmm0, xmmword [0x1000db30]
movups xmmword [ebp - 0x10f8], xmm0
movaps xmm0, xmmword [0x1000da70]
movups xmmword [ebp - 0x10e8], xmm0
movaps xmm0, xmmword [0x1000da90]
movups xmmword [ebp - 0x10d8], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x1128]
xor byte [ebp + ecx - 0x1127], al
inc ecx
cmp ecx, 0x67
jb 0x10002a10
push 0
push 0x80000000
push 0
push 0
lea eax, [ebp - 0x1127]
mov byte [ebp - 0x10c0], 0
push eax
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
mov dword [ebp - 0x10b0], esi
test esi, esi
jne 0x10002b3b
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
movaps xmm1, xmmword [0x1000db60]
mov al, 0xdd
movaps xmm0, xmmword [0x1000db50]
mov cl, 0xeb
mov byte [ebp - 0x1020], 0x13
mov ch, 0xf9
xor al, byte [ebp - 0x1020]
mov dl, 0xfb
mov byte [ebp - 0x101f], al
mov ah, 0xf2
mov al, byte [ebp - 0x1020]
mov dh, 0xf3
xor cl, al
mov byte [ebp - 0x1019], 0
xor ch, al
mov byte [ebp - 0x101e], cl
xor dl, al
mov byte [ebp - 0x101b], ch
xor ah, al
mov dword [ebp - 0x108c], 0x4d818d9d
xor dh, al
mov dword [ebp - 0x1088], 0x9e9f838c
movups xmmword [ebp - 0x10ac], xmm0
mov word [ebp - 0x1084], 0x43
xor ecx, ecx
movups xmmword [ebp - 0x109c], xmm1
mov byte [ebp - 0x101d], dl
mov byte [ebp - 0x101c], ah
mov byte [ebp - 0x101a], dh
mov byte [ebp - 0x1019], 0
nop word [eax + eax]
mov al, byte [ebp - 0x10ac]
xor byte [ebp + ecx - 0x10ab], al
inc ecx
cmp ecx, 0x28
jb 0x10002b00
push 0x10
lea eax, [ebp - 0x101f]
mov byte [ebp - 0x1083], 0
push eax
lea eax, [ebp - 0x10ab]
push eax
push 0
call esi
push dword [ebp - 0x10b4]
call edi
jmp 0x10002a5f
xorps xmm0, xmm0
mov dword [ebp - 0x103c], 0
movups xmmword [ebp - 0x104c], xmm0
mov dword [ebp - 0x1038], 0xf
mov byte [ebp - 0x104c], 0
lea eax, [ebp - 0x1034]
mov dword [ebp - 4], 0
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10002c57
nop dword [eax]
mov eax, dword [ebp - 0x1034]
test eax, eax
je 0x10002c57
cmp eax, 0x1000
jae 0x100030ac
lea edi, [ebp - 0x1018]
mov byte [ebp + eax - 0x1018], 0
lea ecx, [edi + 1]
nop word [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x10002bc0
mov edx, dword [ebp - 0x1038]
sub edi, ecx
mov ecx, dword [ebp - 0x103c]
mov eax, edx
sub eax, ecx
push edi
cmp edi, eax
ja 0x10002c15
lea eax, [edi + ecx]
cmp edx, 0xf
mov dword [ebp - 0x103c], eax
lea esi, [ebp - 0x104c]
cmova esi, dword [ebp - 0x104c]
lea eax, [ebp - 0x1018]
add esi, ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + edi], 0
add esp, 0xc
mov esi, dword [ebp - 0x10b0]
jmp 0x10002c35
lea eax, [ebp - 0x1018]
mov byte [ebp - 0x101c], 0
push eax
push dword [ebp - 0x101c]
lea ecx, [ebp - 0x104c]
push edi
call fcn.10004770
lea eax, [ebp - 0x1034]
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x10002b90
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x10b4]
call esi
cmp dword [ebp - 0x1038], 0xf
lea ecx, [ebp - 0x104c]
mov eax, dword [ebp - 0x103c]
cmova ecx, dword [ebp - 0x104c]
mov dword [ebp - 0x10b0], ecx
cmp eax, 0xe
jb 0x10002d20
add eax, 0xfffffff3
add eax, ecx
mov dword [ebp - 0x101c], eax
sub eax, ecx
push eax
push 0x22
push ecx
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10002d20
mov ecx, edi
mov edx, str._success_:true
mov esi, 0xa
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002cd1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002cc0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002cf8
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002cf8
cmp esi, 0xfffffffe
je 0x10002cf4
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002cf8
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x10002cf8
xor eax, eax
jmp 0x10002cfd
sbb eax, eax
or eax, 1
test eax, eax
je 0x10002df2
mov eax, dword [ebp - 0x101c]
inc edi
sub eax, edi
push eax
push 0x22
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10002cb0
or edi, 0xffffffff
mov ecx, str.false
cmp edi, 0xffffffff
mov eax, str.true
cmove eax, ecx
lea ecx, [ebp - 0x107c]
push eax
call fcn.10004200
push str.true
lea ecx, [ebp - 0x1064]
mov byte [ebp - 4], 1
call fcn.10004200
push str.false
lea ecx, [ebp - 0x1030]
mov byte [ebp - 4], 2
call fcn.10004200
cmp dword [ebp - 0x1050], 0xf
lea ecx, [ebp - 0x1064]
mov edi, dword [ebp - 0x107c]
lea edx, [ebp - 0x107c]
cmova ecx, dword [ebp - 0x1064]
cmp dword [ebp - 0x1068], 0xf
mov esi, dword [ebp - 0x106c]
cmova edx, edi
cmp esi, dword [ebp - 0x1054]
jne 0x10002f05
sub esi, 4
jb 0x10002db9
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x10002dbe
add edx, 4
add ecx, 4
sub esi, 4
jae 0x10002da8
cmp esi, 0xfffffffc
je 0x10002dfd
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x10002deb
cmp esi, 0xfffffffd
je 0x10002dfd
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x10002deb
cmp esi, 0xfffffffe
je 0x10002dfd
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x10002deb
cmp esi, 0xffffffff
je 0x10002dfd
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x10002dfd
sbb eax, eax
or eax, 1
jmp 0x10002dff
sub edi, dword [ebp - 0x10b0]
jmp 0x10002d23
xor eax, eax
test eax, eax
jne 0x10002f05
mov ecx, dword [ebp - 0x101c]
cmp ecx, 0xf
jbe 0x10002e41
mov edx, dword [ebp - 0x1030]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002e37
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002ed7
push ecx
push edx
call fcn.1000b268
add esp, 8
mov eax, dword [ebp - 0x1050]
cmp eax, 0xf
jbe 0x10002e79
mov edx, dword [ebp - 0x1064]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x10002e6f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002ed7
push ecx
push edx
call fcn.1000b268
add esp, 8
mov eax, dword [ebp - 0x1068]
cmp eax, 0xf
jbe 0x10002eab
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x10002ea1
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002ed7
push ecx
push edi
call fcn.1000b268
add esp, 8
mov ecx, dword [ebp - 0x1038]
cmp ecx, 0xf
jbe 0x10002ee7
mov edx, dword [ebp - 0x104c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002edd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10002edd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1000b268
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000b25a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov dl, 0x18
mov dword [ebp - 0x1028], 0x747d4c18
mov dword [ebp - 0x1024], 0x796a7f7d
xor ecx, ecx
mov dword [ebp - 0x1020], 0x777a3875
mov word [ebp - 0x101c], 0x6c
lea eax, [ebp - 0x1027]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10002f47
mov dl, byte [ebp - 0x1028]
jmp 0x10002f30
movaps xmm0, xmmword [0x1000dbc0]
xor ecx, ecx
movups xmmword [ebp - 0x1120], xmm0
mov byte [ebp - 0x101b], 0
movaps xmm0, xmmword [0x1000dc00]
movups xmmword [ebp - 0x1110], xmm0
mov dword [ebp - 0x10d0], 0xf1f7f9f7
movaps xmm0, xmmword [0x1000dbf0]
movups xmmword [ebp - 0x1100], xmm0
mov dword [ebp - 0x10cc], 0x32fef2e2
movaps xmm0, xmmword [0x1000da80]
movups xmmword [ebp - 0x10f0], xmm0
mov dword [ebp - 0x10c8], 0xf7e0fcf3
movaps xmm0, xmmword [0x1000dbb0]
movups xmmword [ebp - 0x10e0], xmm0
mov word [ebp - 0x10c4], 0x3c
nop dword [eax]
mov al, byte [ebp - 0x1120]
xor byte [ebp + ecx - 0x111f], al
inc ecx
cmp ecx, 0x5c
jb 0x10002fc0
push 0x40
lea eax, [ebp - 0x1027]
mov byte [ebp - 0x10c3], 0
push eax
lea eax, [ebp - 0x111f]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
movaps xmm0, xmmword [0x1000daa0]
xor ecx, ecx
movups xmmword [ebp - 0x10a0], xmm0
mov dword [ebp - 0x1090], 0x58777244
mov dword [ebp - 0x108c], 0x6b6b6e6c
mov dword [ebp - 0x1088], 0x65585562
mov word [ebp - 0x1084], 0x7368
mov byte [ebp - 0x1082], 0
mov al, byte [ebp - 0x10a0]
xor byte [ebp + ecx - 0x109f], al
inc ecx
cmp ecx, 0x1d
jb 0x10003030
mov ch, 0x45
mov byte [ebp - 0x101b], 0
push 0xa
mov al, 0x2a
mov byte [ebp - 0x1082], 0
mov ah, 0x2b
mov byte [ebp - 0x1020], ch
xor al, ch
mov byte [ebp - 0x101b], 0
xor ah, ch
mov byte [ebp - 0x101f], al
push 0
mov byte [ebp - 0x101c], ah
mov cl, 0x35
push 0
lea eax, [ebp - 0x109f]
mov dl, 0x20
push eax
lea eax, [ebp - 0x101f]
xor cl, ch
push eax
xor dl, ch
mov byte [ebp - 0x101e], cl
push 0
mov byte [ebp - 0x101d], dl
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.1000b706
int3