Function at 0x1002cee0
Capabilities:
Check if file exists
Copy file
Create process on windows
Encode data using base64 via winapi
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089734
mov eax, dword fs:[0]
push eax
sub esp, 0x460
mov eax, dword [0x100bb758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3f4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x418], ecx
mov dword [eax], 0
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1002d8e9
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x400], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.100609f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x100bd974]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002cfc2
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x400]
call fcn.10006650
lea eax, [ebp - 0x3e8]
push 1
push eax
call fcn.10051200
add esp, 8
mov ecx, 0x10094808
mov eax, dword [eax]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002d026
test dx, dx
je 0x1002d022
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002d026
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002d000
xor edi, edi
jmp 0x1002d02b
sbb edi, edi
or edi, 1
mov edx, dword [ebp - 0x3e8]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002d04b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
test edi, edi
jne 0x1002d05c
push str.Tool.exe
jmp 0x1002d061
push str.HpSnap.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call fcn.100400f0
mov edi, dword [ebp - 0x400]
add esp, 4
test eax, eax
jne 0x1002d090
mov dword [ebp - 0x3f0], 0x80070005
jmp 0x1002d8aa
call fcn.1006ed6c
cdq
mov ecx, 0x64
idiv ecx
mov eax, dword [ebp - 0x3f4]
mov eax, dword [eax + 0x48]
cmp edx, dword [eax + 0xc]
jge 0x1002d1ac
call fcn.10054f50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1002d198
push 4
push str.FILE
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], al
call fcn.1000afb0
push 3
push 0x1008ea34
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.1000afb0
mov byte [ebp - 4], 2
call fcn.10054f50
mov dword [ebp - 0x3e8], eax
lea ecx, [ebp - 0x2e0]
push 0x18f
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.100083a0
mov esi, eax
push str.rand_check
push esi
mov byte [ebp - 4], 3
call fcn.10007c20
mov eax, dword [ebp - 0x3e8]
add esp, 8
mov ecx, eax
mov edx, dword [eax]
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x2e0]
call fcn.10009260
lea ecx, [ebp - 0x230]
call fcn.10005f50
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.10005f50
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1002d8f3
jmp 0x1002d34e
call fcn.10025000
test eax, eax
je 0x1002d198
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1002d8fd
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3ec], eax
push edi
lea eax, [ebp - 0x3ec]
mov byte [ebp - 4], 4
push str._s_taskpop.exe
push eax
call fcn.10006340
mov esi, dword [ebp - 0x3ec]
lea eax, [ebp - 0x218]
add esp, 0xc
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002d433
lea ecx, [ebp - 0x218]
mov eax, esi
mov edi, ecx
mov edx, 0x104
sub eax, edi
mov edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1002d243
movzx eax, word [ecx + edi]
test ax, ax
je 0x1002d243
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1002d225
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.10054f50
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x400]
movzx eax, al
sub eax, 1
jne 0x1002d433
push 4
push str.FILE
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
call fcn.1000afb0
push 3
push 0x1008ea34
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 5
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.1000afb0
mov byte [ebp - 4], 6
call fcn.10054f50
mov dword [ebp - 0x3e8], eax
lea ecx, [ebp - 0x2e0]
push 0x1a2
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.100083a0
mov dword [ebp - 0x3f4], eax
push str.rand_check_IsxxxSafeRunning
push eax
mov byte [ebp - 4], 7
call fcn.10007c20
mov eax, dword [ebp - 0x3e8]
add esp, 8
mov ecx, eax
mov edx, dword [eax]
push dword [ebp - 0x3f4]
call dword [edx + 0x1c]
lea ecx, [ebp - 0x2e0]
call fcn.10009260
lea ecx, [ebp - 0x248]
call fcn.10005f50
lea ecx, [ebp - 0x230]
call fcn.10005f50
jmp 0x1002d433
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 8
call fcn.1006ed6c
cdq
mov esi, 0x1a
idiv esi
lea eax, [edx + 0x61]
mov dword [ebp - 0x3e8], eax
call fcn.1006ed6c
cdq
idiv esi
lea eax, [edx + 0x61]
mov dword [ebp - 0x3f4], eax
call fcn.1006ed6c
cdq
idiv esi
lea esi, [edx + 0x61]
call fcn.1006ed6c
cdq
mov ecx, 0x1a
idiv ecx
mov eax, dword [ebp - 0x3e8]
movzx eax, ax
add edx, 0x61
push eax
mov eax, dword [ebp - 0x3f4]
movzx eax, ax
push eax
movzx eax, si
push eax
movzx eax, dx
push eax
push edi
lea eax, [ebp - 0x3ec]
push str._s_c_c_c_c32.exe
push eax
call fcn.10006340
mov esi, dword [ebp - 0x3ec]
lea eax, [ebp - 0x218]
add esp, 0x1c
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1002d433
lea ecx, [ebp - 0x218]
mov eax, esi
mov edi, ecx
mov edx, 0x104
sub eax, edi
mov edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1002d420
movzx eax, word [ecx + edi]
test ax, ax
je 0x1002d420
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1002d402
mov edi, dword [ebp - 0x400]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002d451
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10006430
mov ecx, eax
test ecx, ecx
je 0x1002d907
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3fc], eax
push dword [ebp - 0x3f0]
lea eax, [ebp - 0x3fc]
mov byte [ebp - 4], 9
push dword [ebp - 0x408]
push dword [ebp - 0x40c]
push dword [ebp + 0x10]
push dword [ebp - 0x410]
push dword [ebp - 0x404]
push str.Utilsutility.dll
push str.__dll_s___entryHaloTB___hwnd_p___filemap__s____length_u___icon_path__s____thumbnail_path__s____preview_path__s_
push eax
call fcn.10006340
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.10051200
add esp, 0x2c
mov ecx, 0x10094808
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002d4f1
test dx, dx
je 0x1002d4e5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002d4f1
add eax, 4
add ecx, 4
test dx, dx
jne 0x1002d4c3
mov dword [ebp - 0x3ec], 0
jmp 0x1002d4fc
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x3ec], ecx
mov edx, dword [ebp - 0x404]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002d519
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x3ec], 0
je 0x1002d7a9
lea ecx, [ebp - 0x2b0]
call fcn.1002c250
mov eax, dword [ebp - 0x3fc]
push str.cmd_line
mov byte [ebp - 4], 0xa
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
lea ecx, [ebp - 0x2b0]
call fcn.1002c7c0
mov esi, dword [ebp - 0x250]
mov eax, dword [ebp - 0x254]
sub esi, eax
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x3f4], esi
jne 0x1002d57a
xor esi, esi
jmp 0x1002d6d2
push esi
mov dword [ebp - 0x3ec], 0
call fcn.10067253
add esp, 4
mov dword [ebp - 0x3f0], eax
test eax, eax
jne 0x1002d59e
xor esi, esi
jmp 0x1002d6d2
push esi
push dword [ebp - 0x404]
push eax
call fcn.1005fef0
add esp, 0xc
test esi, esi
je 0x1002d654
xor edi, edi
nop dword [eax + eax]
mov eax, 0xd41d41d5
mov esi, edi
mul edi
mov eax, edi
mov ecx, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x23
sub esi, eax
mov eax, 0x2f684bdb
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1b
sub ecx, eax
mov al, byte [ebp + esi - 0x27c]
mov esi, dword [ebp - 0x3f4]
xor al, byte [ebp + ecx - 0x297]
mov byte [ebp - 0x3f5], al
mov eax, 0xf0f0f0f1
mul edi
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
mov cl, byte [ebp - 0x3f5]
xor cl, byte [ebp + eax - 0x2a8]
mov eax, edi
and eax, 7
xor cl, byte [ebp + eax - 0x2b0]
mov eax, dword [ebp - 0x3f0]
xor byte [edi + eax], cl
inc edi
cmp edi, esi
jb 0x1002d5c0
mov edi, dword [ebp - 0x400]
jmp 0x1002d65a
mov eax, dword [ebp - 0x3f0]
lea ecx, [ebp - 0x3ec]
push ecx
push 0
push 0x40000001
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
push eax
call esi
push dword [ebp - 0x3ec]
call fcn.10055e6b
add esp, 4
mov dword [ebp - 0x3e8], eax
lea ecx, [ebp - 0x3ec]
push ecx
push eax
push 0x40000001
push dword [ebp - 0x3f4]
push dword [ebp - 0x3f0]
call esi
test eax, eax
je 0x1002d6b7
push dword [ebp - 0x3e8]
call fcn.10071028
add esp, 4
mov esi, eax
jmp 0x1002d6b9
xor esi, esi
push dword [ebp - 0x3f0]
call fcn.1006724e
push dword [ebp - 0x3e8]
call fcn.10055e74
add esp, 8
push 0
lea eax, [ebp - 0x3e0]
push esi
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 0x3e4], eax
call fcn.1001c020
push dword [ebp - 0x3e4]
lea eax, [ebp - 0x3fc]
mov byte [ebp - 4], 0xb
push str.__param_s
push eax
call fcn.10006340
mov eax, dword [ebp - 0x3e4]
lea ecx, [ebp - 0x3e0]
add esp, 0xc
cmp eax, ecx
je 0x1002d723
push eax
call fcn.1006724e
add esp, 4
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x254]
push eax
push 0
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.1002c000
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 0x258], 0
test ecx, ecx
je 0x1002d7a5
mov edx, dword [ebp - 0x24c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x1002d77d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002d911
push edx
push ecx
call fcn.10055e5d
add esp, 8
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov byte [ebp - 4], 9
push 0x40
lea eax, [ebp - 0x468]
mov dword [ebp - 0x46c], 0x44
push 0
push eax
call fcn.100609f0
mov esi, dword [ebp - 0x3fc]
xorps xmm0, xmm0
add esp, 0xc
movups xmmword [ebp - 0x428], xmm0
cmp dword [esi - 4], 1
jle 0x1002d7f0
push dword [esi - 0xc]
lea ecx, [ebp - 0x3fc]
call fcn.100062c0
mov esi, dword [ebp - 0x3fc]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1002d837
lea eax, [ebp - 0x218]
push eax
call fcn.10038340
add esp, 4
mov dword [ebp - 0x3f0], 0x80004005
jmp 0x1002d88c
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x414]
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 0x428]
mov dword [ecx], eax
lea ecx, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1002d860
sub edx, ecx
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0x418]
sar edx, 1
push edx
push eax
call fcn.10006650
mov dword [ebp - 0x3f0], 0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002d8aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x1002d8c6
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100561dc
mov esp, ebp
pop ebp
ret 0x20
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
push 0x80004005
call fcn.100060c0
call fcn.10063ae9
int3